| blob | bdcb21bef30eba185e0945aa8f342091a1cd0613 |
1 Automatic regression and interoperability testing of wpa_supplicant's
2 IEEE 802.1X/EAPOL authentication
4 Test program:
5 - Linked some parts of IEEE 802.1X Authenticator implementation from
6 hostapd (RADIUS client and RADIUS processing, EAP<->RADIUS
7 encapsulation/decapsulation) into wpa_supplicant.
8 - Replaced wpa_supplicant.c and wpa.c with test code that trigger
9 IEEE 802.1X authentication automatically without need for wireless
10 client card or AP.
11 - For EAP methods that generate keying material, the key derived by the
12 Supplicant is verified to match with the one received by the (now
13 integrated) Authenticator.
15 The full automated test suite can now be run in couple of seconds, but
16 I'm more than willing to add new RADIUS authentication servers to make
17 this take a bit more time.. ;-) As an extra bonus, this can also be
18 seen as automatic regression/interoperability testing for the RADIUS
19 server, too.
21 In order for me to be able to use a new authentication server, the
22 server need to be available from Internet (at least from one static IP
23 address) and I will need to get suitable user name/password pairs,
24 certificates, and private keys for testing use. Other alternative
25 would be to get an evaluation version of the server so that I can
26 install it on my own test setup. If you are interested in providing
27 either server access or evaluation version, please contact me
28 (j@w1.fi).
31 Test matrix
33 +) tested successfully
34 F) failed
35 -) server did not support
36 ?) not tested
38 Cisco ACS ----------------------------------------------------------.
39 hostapd --------------------------------------------------------. |
40 Cisco Aironet 1200 AP (local RADIUS server) ----------------. | |
41 Periodik Labs Elektron ---------------------------------. | | |
42 Lucent NavisRadius ---------------------------------. | | | |
43 Interlink RAD-Series ---------------------------. | | | | |
44 Radiator -----------------------------------. | | | | | |
45 Meetinghouse Aegis ---------------------. | | | | | | |
46 Funk Steel-Belted ------------------. | | | | | | | |
47 Funk Odyssey -------------------. | | | | | | | | |
48 Microsoft IAS --------------. | | | | | | | | | |
49 FreeRADIUS -------------. | | | | | | | | | | |
50 | | | | | | | | | | | |
52 EAP-MD5 + - - + + + + + - - + +
53 EAP-GTC + - - ? + + + + - - + -
54 EAP-OTP - - - - - + - - - - - -
55 EAP-MSCHAPv2 + - - + + + + + - - + -
56 EAP-TLS + + + + + + + + - - + +
57 EAP-PEAPv0/MSCHAPv2 + + + + + + + + + - + +
58 EAP-PEAPv0/GTC + - + - + + + + - - + +
59 EAP-PEAPv0/OTP - - - - - + - - - - - -
60 EAP-PEAPv0/MD5 + - - + + + + + - - + -
61 EAP-PEAPv0/TLS + + - + + + F + - - + -
62 EAP-PEAPv0/SIM - - - - - - - - - - + -
63 EAP-PEAPv0/AKA - - - - - - - - - - + -
64 EAP-PEAPv0/PSK - - - - - - - - - - + -
65 EAP-PEAPv0/PAX - - - - - - - - - - + -
66 EAP-PEAPv0/SAKE - - - - - - - - - - + -
67 EAP-PEAPv0/GPSK - - - - - - - - - - + -
68 EAP-PEAPv1/MSCHAPv2 - - + + + +1 + +5 +8 - + +
69 EAP-PEAPv1/GTC - - + + + +1 + +5 +8 - + +
70 EAP-PEAPv1/OTP - - - - - +1 - - - - - -
71 EAP-PEAPv1/MD5 - - - + + +1 + +5 - - + -
72 EAP-PEAPv1/TLS - - - + + +1 F +5 - - + -
73 EAP-PEAPv1/SIM - - - - - - - - - - + -
74 EAP-PEAPv1/AKA - - - - - - - - - - + -
75 EAP-PEAPv1/PSK - - - - - - - - - - + -
76 EAP-PEAPv1/PAX - - - - - - - - - - + -
77 EAP-PEAPv1/SAKE - - - - - - - - - - + -
78 EAP-PEAPv1/GPSK - - - - - - - - - - + -
79 EAP-TTLS/CHAP + - +2 + + + + + + - + -
80 EAP-TTLS/MSCHAP + - + + + + + + + - + -
81 EAP-TTLS/MSCHAPv2 + - + + + + + + + - + -
82 EAP-TTLS/PAP + - + + + + + + + - + -
83 EAP-TTLS/EAP-MD5 + - +2 + + + + + + - + -
84 EAP-TTLS/EAP-GTC + - +2 ? + + + + - - + -
85 EAP-TTLS/EAP-OTP - - - - - + - - - - - -
86 EAP-TTLS/EAP-MSCHAPv2 + - +2 + + + + + + - + -
87 EAP-TTLS/EAP-TLS + - +2 + F + + + - - + -
88 EAP-TTLS/EAP-SIM - - - - - - - - - - + -
89 EAP-TTLS/EAP-AKA - - - - - - - - - - + -
90 EAP-TTLS/EAP-PSK - - - - - - - - - - + -
91 EAP-TTLS/EAP-PAX - - - - - - - - - - + -
92 EAP-TTLS/EAP-SAKE - - - - - - - - - - + -
93 EAP-TTLS/EAP-GPSK - - - - - - - - - - + -
94 EAP-TTLS + TNC - - - - - + - - - - + -
95 EAP-SIM + - - ? - + - ? - - + -
96 EAP-AKA - - - - - + - - - - + -
97 EAP-PSK +7 - - - - + - - - - + -
98 EAP-PAX - - - - - + - - - - + -
99 EAP-SAKE - - - - - - - - - - + -
100 EAP-GPSK - - - - - - - - - - + -
101 EAP-FAST/MSCHAPv2(prov) - - - + - - - - - + + +
102 EAP-FAST/GTC(auth) - - - + - - - - - + + +
103 EAP-FAST/MSCHAPv2(aprov)- - - - - - - - - - + +
104 EAP-FAST/GTC(aprov) - - - - - - - - - - + +
105 EAP-FAST/MD5(aprov) - - - - - - - - - - + -
106 EAP-FAST/TLS(aprov) - - - - - - - - - - + +
107 EAP-FAST/SIM(aprov) - - - - - - - - - - + -
108 EAP-FAST/AKA(aprov) - - - - - - - - - - + -
109 EAP-FAST/MSCHAPv2(auth) - - - - - - - - - - + +
110 EAP-FAST/MD5(auth) - - - - - - - - - - + -
111 EAP-FAST/TLS(auth) - - - - - - - - - - + +
112 EAP-FAST/SIM(auth) - - - - - - - - - - + -
113 EAP-FAST/AKA(auth) - - - - - - - - - - + -
114 EAP-FAST + TNC - - - - - - - - - - + -
115 LEAP + - + + + + F +6 - + - +
116 EAP-TNC +9 - - - - + - - - - + -
117 EAP-IKEv2 +10 - - - - - - - - - + -
119 1) PEAPv1 required new label, "client PEAP encryption" instead of "client EAP
120 encryption", during key derivation (requires phase1="peaplabel=1" in the
121 network configuration in wpa_supplicant.conf)
122 2) used FreeRADIUS as inner auth server
123 5) PEAPv1 required termination of negotiation on tunneled EAP-Success and new
124 label in key deriviation
125 (phase1="peap_outer_success=0 peaplabel=1") (in "IETF Draft 5" mode)
126 6) Authenticator simulator required patching for handling Access-Accept within
127 negotiation (for the first EAP-Success of LEAP)
128 7) tested only with an older (incompatible) draft of EAP-PSK; FreeRADIUS does
129 not support the current EAP-PSK (RFC) specification
130 8) PEAPv1 used non-standard version negotiation (client had to force v1 even
131 though server reported v0 as the highest supported version)
132 9) only EAP-TTLS/EAP-TNC tested, i.e., test did not include proper sequence of
133 client authentication followed by TNC inside the tunnel
134 10) worked only with special compatibility code to match the IKEv2 server
135 implementation
138 Automated tests:
140 FreeRADIUS (2.0-beta/CVS snapshot)
141 - EAP-MD5-Challenge
142 - EAP-GTC
143 - EAP-MSCHAPv2
144 - EAP-TLS
145 - EAP-PEAPv0 / MSCHAPv2
146 - EAP-PEAPv0 / GTC
147 - EAP-PEAPv0 / MD5-Challenge
148 - EAP-PEAPv0 / TLS
149 - EAP-TTLS / EAP-MD5-Challenge
150 - EAP-TTLS / EAP-GTC
151 - EAP-TTLS / EAP-MSCHAPv2
152 - EAP-TTLS / EAP-TLS
153 - EAP-TTLS / CHAP
154 - EAP-TTLS / PAP
155 - EAP-TTLS / MSCHAP
156 - EAP-TTLS / MSCHAPv2
157 - EAP-TTLS / EAP-TNC (partial support; no authentication sequence)
158 - EAP-SIM
159 - LEAP
161 Microsoft Windows Server 2003 / IAS
162 - EAP-TLS
163 - EAP-PEAPv0 / MSCHAPv2
164 - EAP-PEAPv0 / TLS
165 - EAP-MD5
166 * IAS does not seem to support other EAP methods
168 Funk Odyssey 2.01.00.653
169 - EAP-TLS
170 - EAP-PEAPv0 / MSCHAPv2
171 - EAP-PEAPv0 / GTC
172 - EAP-PEAPv1 / MSCHAPv2
173 - EAP-PEAPv1 / GTC
174 Note: PEAPv1 requires TLS key derivation to use label "client EAP encryption"
175 - EAP-TTLS / CHAP (using FreeRADIUS as inner auth srv)
176 - EAP-TTLS / MSCHAP
177 - EAP-TTLS / MSCHAPv2
178 - EAP-TTLS / PAP
179 - EAP-TTLS / EAP-MD5-Challenge (using FreeRADIUS as inner auth srv)
180 - EAP-TTLS / EAP-GTC (using FreeRADIUS as inner auth srv)
181 - EAP-TTLS / EAP-MSCHAPv2 (using FreeRADIUS as inner auth srv)
182 - EAP-TTLS / EAP-TLS (using FreeRADIUS as inner auth srv)
183 * not supported in Odyssey:
184 - EAP-MD5-Challenge
185 - EAP-GTC
186 - EAP-MSCHAPv2
187 - EAP-PEAP / MD5-Challenge
188 - EAP-PEAP / TLS
190 Funk Steel-Belted Radius Enterprise Edition v4.71.739
191 - EAP-MD5-Challenge
192 - EAP-MSCHAPv2
193 - EAP-TLS
194 - EAP-PEAPv0 / MSCHAPv2
195 - EAP-PEAPv0 / MD5
196 - EAP-PEAPv0 / TLS
197 - EAP-PEAPv1 / MSCHAPv2
198 - EAP-PEAPv1 / MD5
199 - EAP-PEAPv1 / GTC
200 - EAP-PEAPv1 / TLS
201 Note: PEAPv1 requires TLS key derivation to use label "client EAP encryption"
202 - EAP-TTLS / CHAP
203 - EAP-TTLS / MSCHAP
204 - EAP-TTLS / MSCHAPv2
205 - EAP-TTLS / PAP
206 - EAP-TTLS / EAP-MD5-Challenge
207 - EAP-TTLS / EAP-MSCHAPv2
208 - EAP-TTLS / EAP-TLS
210 Meetinghouse Aegis 1.1.4
211 - EAP-MD5-Challenge
212 - EAP-GTC
213 - EAP-MSCHAPv2
214 - EAP-TLS
215 - EAP-PEAPv0 / MSCHAPv2
216 - EAP-PEAPv0 / TLS
217 - EAP-PEAPv0 / GTC
218 - EAP-PEAPv0 / MD5-Challenge
219 - EAP-PEAPv1 / MSCHAPv2
220 - EAP-PEAPv1 / TLS
221 - EAP-PEAPv1 / GTC
222 - EAP-PEAPv1 / MD5-Challenge
223 Note: PEAPv1 requires TLS key derivation to use label "client EAP encryption"
224 - EAP-TTLS / CHAP
225 - EAP-TTLS / MSCHAP
226 - EAP-TTLS / MSCHAPv2
227 - EAP-TTLS / PAP
228 - EAP-TTLS / EAP-MD5-Challenge
229 - EAP-TTLS / EAP-GTC
230 - EAP-TTLS / EAP-MSCHAPv2
231 * did not work
232 - EAP-TTLS / EAP-TLS
233 (Server rejects authentication without any reason in debug log. It
234 looks like the inner TLS negotiation starts properly and the last
235 packet from Supplicant looks like the one sent in the Phase 1. The
236 server generates a valid looking reply in the same way as in Phase
237 1, but then ends up sending Access-Reject. Maybe an issue with TTLS
238 fragmentation in the Aegis server(?) The packet seems to include
239 1328 bytes of EAP-Message and this may go beyond the fragmentation
240 limit with AVP encapsulation and TLS tunneling. Note: EAP-PEAP/TLS
241 did work, so this issue seems to be with something TTLS specific.)
243 Radiator 3.17.1 (eval, with all patches up to and including 2007-05-25)
244 - EAP-MD5-Challenge
245 - EAP-GTC
246 - EAP-OTP
247 - EAP-MSCHAPv2
248 - EAP-TLS
249 - EAP-PEAPv0 / MSCHAPv2
250 - EAP-PEAPv0 / GTC
251 - EAP-PEAPv0 / OTP
252 - EAP-PEAPv0 / MD5-Challenge
253 - EAP-PEAPv0 / TLS
254 Note: Needed to use unknown identity in outer auth and some times the server
255 seems to get confused and fails to send proper Phase 2 data.
256 - EAP-PEAPv1 / MSCHAPv2
257 - EAP-PEAPv1 / GTC
258 - EAP-PEAPv1 / OTP
259 - EAP-PEAPv1 / MD5-Challenge
260 - EAP-PEAPv1 / TLS
261 Note: This has some additional requirements for EAPTLS_MaxFragmentSize.
262 Using 1300 for outer auth and 500 for inner auth seemed to work.
263 Note: Needed to use unknown identity in outer auth and some times the server
264 seems to get confused and fails to send proper Phase 2 data.
265 - EAP-TTLS / CHAP
266 - EAP-TTLS / MSCHAP
267 - EAP-TTLS / MSCHAPv2
268 - EAP-TTLS / PAP
269 - EAP-TTLS / EAP-MD5-Challenge
270 - EAP-TTLS / EAP-GTC
271 - EAP-TTLS / EAP-OTP
272 - EAP-TTLS / EAP-MSCHAPv2
273 - EAP-TTLS / EAP-TLS
274 Note: This has some additional requirements for EAPTLS_MaxFragmentSize.
275 Using 1300 for outer auth and 500 for inner auth seemed to work.
276 - EAP-SIM
277 - EAP-AKA
278 - EAP-PSK
279 - EAP-PAX
280 - EAP-TNC
282 Interlink Networks RAD-Series 6.1.2.7
283 - EAP-MD5-Challenge
284 - EAP-GTC
285 - EAP-MSCHAPv2
286 - EAP-TLS
287 - EAP-PEAPv0 / MSCHAPv2
288 - EAP-PEAPv0 / GTC
289 - EAP-PEAPv0 / MD5-Challenge
290 - EAP-PEAPv1 / MSCHAPv2
291 - EAP-PEAPv1 / GTC
292 - EAP-PEAPv1 / MD5-Challenge
293 Note: PEAPv1 requires TLS key derivation to use label "client EAP encryption"
294 - EAP-TTLS / CHAP
295 - EAP-TTLS / MSCHAP
296 - EAP-TTLS / MSCHAPv2
297 - EAP-TTLS / PAP
298 - EAP-TTLS / EAP-MD5-Challenge
299 - EAP-TTLS / EAP-GTC
300 - EAP-TTLS / EAP-MSCHAPv2
301 - EAP-TTLS / EAP-TLS
302 * did not work
303 - EAP-PEAPv0 / TLS
304 - EAP-PEAPv1 / TLS
305 (Failed to decrypt Phase 2 data)
307 Lucent NavisRadius 4.4.0
308 - EAP-MD5-Challenge
309 - EAP-GTC
310 - EAP-MSCHAPv2
311 - EAP-TLS
312 - EAP-PEAPv0 / MD5-Challenge
313 - EAP-PEAPv0 / MSCHAPv2
314 - EAP-PEAPv0 / GTC
315 - EAP-PEAPv0 / TLS
316 - EAP-PEAPv1 / MD5-Challenge
317 - EAP-PEAPv1 / MSCHAPv2
318 - EAP-PEAPv1 / GTC
319 - EAP-PEAPv1 / TLS
320 "IETF Draft 5" mode requires phase1="peap_outer_success=0 peaplabel=1"
321 'Cisco ACU 5.05' mode works without phase1 configuration
322 - EAP-TTLS / CHAP
323 - EAP-TTLS / MSCHAP
324 - EAP-TTLS / MSCHAPv2
325 - EAP-TTLS / PAP
326 - EAP-TTLS / EAP-MD5-Challenge
327 - EAP-TTLS / EAP-MSCHAPv2
328 - EAP-TTLS / EAP-GTC
329 - EAP-TTLS / EAP-TLS
331 Note: user certificate from NavisRadius had private key in a format
332 that wpa_supplicant could not use. Converting this to PKCS#12 and then
333 back to PEM allowed wpa_supplicant to use the key.
336 hostapd v0.3.3
337 - EAP-MD5-Challenge
338 - EAP-GTC
339 - EAP-MSCHAPv2
340 - EAP-TLS
341 - EAP-PEAPv0 / MSCHAPv2
342 - EAP-PEAPv0 / GTC
343 - EAP-PEAPv0 / MD5-Challenge
344 - EAP-PEAPv1 / MSCHAPv2
345 - EAP-PEAPv1 / GTC
346 - EAP-PEAPv1 / MD5-Challenge
347 - EAP-TTLS / CHAP
348 - EAP-TTLS / MSCHAP
349 - EAP-TTLS / MSCHAPv2
350 - EAP-TTLS / PAP
351 - EAP-TTLS / EAP-MD5-Challenge
352 - EAP-TTLS / EAP-GTC
353 - EAP-TTLS / EAP-MSCHAPv2
354 - EAP-SIM
355 - EAP-PAX
357 Cisco Secure ACS 3.3(1) for Windows Server
358 - PEAPv1/GTC worked, but PEAPv0/GTC failed in the end after password was
359 sent successfully; ACS is replying with empty PEAP packet (TLS ACK);
360 wpa_supplicant tries to decrypt this.. Replying with TLS ACK and and
361 marking the connection completed was enough to make this work.
364 PEAPv1:
366 Funk Odyssey 2.01.00.653:
367 - uses tunneled EAP-Success, expects reply in tunnel or TLS ACK, sends MPPE
368 keys with outer EAP-Success message after this
369 - uses label "client EAP encryption"
370 - (peap_outer_success 1 and 2 work)
372 Funk Steel-Belted Radius Enterprise Edition v4.71.739
373 - uses tunneled EAP-Success, expects reply in tunnel or TLS ACK, sends MPPE
374 keys with outer EAP-Success message after this
375 - uses label "client EAP encryption"
376 - (peap_outer_success 1 and 2 work)
378 Radiator 3.9:
379 - uses TLV Success and Reply, sends MPPE keys with outer EAP-Success message
380 after this
381 - uses label "client PEAP encryption"
383 Lucent NavisRadius 4.4.0 (in "IETF Draft 5" mode):
384 - sends tunneled EAP-Success with MPPE keys and expects the authentication to
385 terminate at this point (gets somewhat confused with reply to this)
386 - uses label "client PEAP encryption"
387 - phase1="peap_outer_success=0 peaplabel=1"
389 Lucent NavisRadius 4.4.0 (in "Cisco ACU 5.05" mode):
390 - sends tunneled EAP-Success with MPPE keys and expects to receive TLS ACK
391 as a reply
392 - uses label "client EAP encryption"
394 Meetinghouse Aegis 1.1.4
395 - uses tunneled EAP-Success, expects reply in tunnel or TLS ACK, sends MPPE
396 keys with outer EAP-Success message after this
397 - uses label "client EAP encryption"
398 - peap_outer_success 1 and 2 work