fullmac_helpers/
fake_ap.rs

1// Copyright 2024 The Fuchsia Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5use crate::recorded_request_stream::RecordedRequestStream;
6use fidl_fuchsia_wlan_mlme::EapolResultCode;
7use ieee80211::MacAddr;
8use std::sync::{Arc, Mutex};
9use wlan_common::ie::rsn::cipher::{CIPHER_BIP_CMAC_128, CIPHER_CCMP_128};
10use wlan_common::ie::rsn::rsne;
11use wlan_common::{assert_variant, bss};
12use wlan_rsn::rsna::{SecAssocUpdate, UpdateSink};
13use wlan_rsn::Authenticator;
14use zerocopy::IntoBytes;
15use {
16    fidl_fuchsia_wlan_common_security as fidl_wlan_security,
17    fidl_fuchsia_wlan_fullmac as fidl_fullmac, fidl_fuchsia_wlan_mlme as fidl_mlme,
18};
19
20/// Creates a WPA2 authenticator based on the given parameters.
21pub fn create_wpa2_authenticator(
22    client_mac_addr: MacAddr,
23    bss_description: &bss::BssDescription,
24    credentials: fidl_wlan_security::WpaCredentials,
25) -> Authenticator {
26    assert_eq!(bss_description.protection(), bss::Protection::Wpa2Personal);
27
28    // It's assumed that advertised and supplicant protections are the same.
29    let advertised_protection_info = get_protection_info(bss_description);
30    let supplicant_protection_info = get_protection_info(bss_description);
31
32    let nonce_rdr = wlan_rsn::nonce::NonceReader::new(&bss_description.bssid.clone().into())
33        .expect("creating nonce reader");
34    let gtk_provider =
35        wlan_rsn::GtkProvider::new(CIPHER_CCMP_128, 1, 0).expect("creating gtk provider");
36
37    let psk = match credentials {
38        fidl_wlan_security::WpaCredentials::Passphrase(passphrase) => {
39            wlan_rsn::psk::compute(passphrase.as_bytes(), &bss_description.ssid)
40                .expect("Could not compute psk")
41        }
42        fidl_wlan_security::WpaCredentials::Psk(psk) => Box::new(psk),
43        _ => panic!("Unsupported credential type"),
44    };
45
46    Authenticator::new_wpa2psk_ccmp128(
47        nonce_rdr,
48        Arc::new(Mutex::new(gtk_provider)),
49        psk,
50        client_mac_addr,
51        supplicant_protection_info,
52        bss_description.bssid.clone().into(),
53        advertised_protection_info,
54    )
55    .expect("Failed to create authenticator")
56}
57
58/// Creates a WPA3 authenticator based on the given parameters.
59pub fn create_wpa3_authenticator(
60    client_mac_addr: MacAddr,
61    bss_description: &bss::BssDescription,
62    credentials: fidl_wlan_security::WpaCredentials,
63) -> Authenticator {
64    assert_eq!(bss_description.protection(), bss::Protection::Wpa3Personal);
65
66    // It's assumed that advertised and supplicant protections are the same.
67    let advertised_protection_info = get_protection_info(bss_description);
68    let supplicant_protection_info = get_protection_info(bss_description);
69
70    let password =
71        assert_variant!(credentials, fidl_wlan_security::WpaCredentials::Passphrase(p) => p);
72
73    let nonce_rdr = wlan_rsn::nonce::NonceReader::new(&bss_description.bssid.clone().into())
74        .expect("creating nonce reader");
75    let gtk_provider =
76        wlan_rsn::GtkProvider::new(CIPHER_CCMP_128, 1, 0).expect("creating gtk provider");
77    let igtk_provider =
78        wlan_rsn::IgtkProvider::new(CIPHER_BIP_CMAC_128).expect("error creating IgtkProvider");
79
80    Authenticator::new_wpa3(
81        nonce_rdr,
82        Arc::new(Mutex::new(gtk_provider)),
83        Arc::new(Mutex::new(igtk_provider)),
84        bss_description.ssid.clone(),
85        password,
86        client_mac_addr,
87        supplicant_protection_info.clone(),
88        bss_description.bssid.into(),
89        advertised_protection_info,
90    )
91    .expect("Failed to create authenticator")
92}
93
94// Uses |fullmac_req_stream| and |fullmac_ifc_proxy| to perform an SAE exchange as a WPA3
95// authenticator.
96//
97// This assumes that the user has already sent an `SaeHandshakeInd` to the test realm, and the test
98// realm is ready to send the first SAE commit frame to the authenticator.
99//
100// Returns the EAPOL key frame that will be used as the first frame in the EAPOL handshake.
101// When this function returns, the user can expect that:
102//  - |authenticator| is ready to be initiated and used in an EAPOL handshake.
103//  - |fullmac_req_stream| has a pending `SaeHandshakeResp` request.
104//
105// Panics if the handshake fails for any reason.
106pub async fn handle_sae_exchange(
107    authenticator: &mut Authenticator,
108    fullmac_req_stream: &mut RecordedRequestStream,
109    fullmac_ifc_proxy: &fidl_fullmac::WlanFullmacImplIfcProxy,
110) -> UpdateSink {
111    let mut update_sink = UpdateSink::new();
112
113    // Handle supplicant confirm
114    let supplicant_commit_frame = get_sae_frame_from_test_realm(fullmac_req_stream).await;
115    authenticator
116        .on_sae_frame_rx(&mut update_sink, supplicant_commit_frame)
117        .expect("Failed to send SAE commit frame to authenticator");
118
119    // Authenticator produces the commit and confirm frame at the same time
120    // after receiving the supplicant commit.
121    let authenticator_commit_frame = assert_variant!(
122        &update_sink[0], SecAssocUpdate::TxSaeFrame(frame) => frame.clone());
123    let authenticator_confirm_frame = assert_variant!(
124        &update_sink[1], SecAssocUpdate::TxSaeFrame(frame) => frame.clone());
125    update_sink.clear();
126
127    // Send the authenticator commit frame
128    send_sae_frame_to_test_realm(authenticator_commit_frame, fullmac_ifc_proxy).await;
129
130    // Handle supplicant confirm frame
131    let supplicant_confirm_frame = get_sae_frame_from_test_realm(fullmac_req_stream).await;
132    authenticator
133        .on_sae_frame_rx(&mut update_sink, supplicant_confirm_frame)
134        .expect("Failed to send SAE confirm frame to authenticator");
135
136    // Send the authenticator confirm frame
137    send_sae_frame_to_test_realm(authenticator_confirm_frame, fullmac_ifc_proxy).await;
138
139    update_sink
140}
141
142/// Uses |fullmac_req_stream| and |fullmac_ifc_proxy| to perform an EAPOL handshake as an
143/// authenticator.
144/// This assumes that |authenticator| is already initiated.
145/// |frame_to_client| is the first EAPOL frame that the authenticator sends.
146///
147/// Returns the UpdateSink of |authenticator|. By the end of a successful EAPOL handshake, the
148/// UpdateSink should include all the keys for a successful EAPOL handshake.
149/// Panics if the handshake fails for any reason.
150pub async fn handle_fourway_eapol_handshake(
151    authenticator: &mut Authenticator,
152    frame_to_client: eapol::KeyFrameBuf,
153    bssid: [u8; 6],
154    client_sta_addr: [u8; 6],
155    fullmac_req_stream: &mut RecordedRequestStream,
156    fullmac_ifc_proxy: &fidl_fullmac::WlanFullmacImplIfcProxy,
157) -> UpdateSink {
158    let mut update_sink = UpdateSink::new();
159    let mic_size = authenticator.get_negotiated_protection().mic_size;
160
161    send_eapol_frame_to_test_realm(
162        authenticator,
163        frame_to_client,
164        bssid.clone(),
165        client_sta_addr.clone(),
166        fullmac_ifc_proxy,
167    )
168    .await;
169    let frame_to_auth_data =
170        get_eapol_frame_from_test_realm(bssid.clone(), fullmac_req_stream, fullmac_ifc_proxy).await;
171    let frame_to_auth = eapol::KeyFrameRx::parse(mic_size as usize, &frame_to_auth_data[..])
172        .expect("Could not parse EAPOL key frame");
173    authenticator
174        .on_eapol_frame(&mut update_sink, eapol::Frame::Key(frame_to_auth))
175        .expect("Could not send EAPOL frame to authenticator");
176
177    let frame_to_client = assert_variant!(update_sink.remove(0), SecAssocUpdate::TxEapolKeyFrame { frame, .. } => frame);
178    send_eapol_frame_to_test_realm(
179        authenticator,
180        frame_to_client,
181        bssid.clone(),
182        client_sta_addr.clone(),
183        fullmac_ifc_proxy,
184    )
185    .await;
186    let frame_to_auth_data =
187        get_eapol_frame_from_test_realm(bssid.clone(), fullmac_req_stream, fullmac_ifc_proxy).await;
188    let frame_to_auth = eapol::KeyFrameRx::parse(mic_size as usize, &frame_to_auth_data[..])
189        .expect("Could not parse EAPOL key frame");
190    authenticator
191        .on_eapol_frame(&mut update_sink, eapol::Frame::Key(frame_to_auth))
192        .expect("Could not send EAPOL frame to authenticator");
193
194    update_sink
195}
196
197/// Sends an EAPOL |frame| to the test realm via |fullmac_ifc_proxy|.
198async fn send_eapol_frame_to_test_realm(
199    authenticator: &mut Authenticator,
200    frame: eapol::KeyFrameBuf,
201    authenticator_addr: [u8; 6],
202    client_addr: [u8; 6],
203    fullmac_ifc_proxy: &fidl_fullmac::WlanFullmacImplIfcProxy,
204) {
205    fullmac_ifc_proxy
206        .eapol_ind(&fidl_fullmac::WlanFullmacImplIfcEapolIndRequest {
207            src_addr: Some(authenticator_addr),
208            dst_addr: Some(client_addr),
209            data: Some(frame.into()),
210            ..Default::default()
211        })
212        .await
213        .expect("Could not send EAPOL ind");
214    let mut update_sink = UpdateSink::new();
215    authenticator
216        .on_eapol_conf(&mut update_sink, EapolResultCode::Success)
217        .expect("Could not send EAPOL conf to authenticator");
218    assert_eq!(update_sink.len(), 0);
219}
220
221/// Returns the buffer containing EAPOL frame data from the test realm through |fullmac_req_stream|.
222async fn get_eapol_frame_from_test_realm(
223    authenticator_addr: [u8; 6],
224    fullmac_req_stream: &mut RecordedRequestStream,
225    fullmac_ifc_proxy: &fidl_fullmac::WlanFullmacImplIfcProxy,
226) -> Vec<u8> {
227    let frame_data = assert_variant!(fullmac_req_stream.next().await,
228        fidl_fullmac::WlanFullmacImpl_Request::EapolTx { payload, responder } => {
229            responder
230                .send()
231                .expect("Failed to respond to EapolTx");
232            payload.data.unwrap()
233    });
234
235    fullmac_ifc_proxy
236        .eapol_conf(&fidl_fullmac::WlanFullmacImplIfcEapolConfRequest {
237            result_code: Some(fidl_fullmac::EapolTxResult::Success),
238            dst_addr: Some(authenticator_addr),
239            ..Default::default()
240        })
241        .await
242        .expect("Could not send EAPOL conf");
243
244    frame_data
245}
246
247fn get_protection_info(bss_description: &bss::BssDescription) -> wlan_rsn::ProtectionInfo {
248    let (_, rsne) = rsne::from_bytes(bss_description.rsne().unwrap()).expect("Could not get RSNE");
249    wlan_rsn::ProtectionInfo::Rsne(rsne)
250}
251
252async fn get_sae_frame_from_test_realm(
253    fullmac_req_stream: &mut RecordedRequestStream,
254) -> fidl_mlme::SaeFrame {
255    let fullmac_sae_frame = assert_variant!(fullmac_req_stream.next().await,
256        fidl_fullmac::WlanFullmacImpl_Request::SaeFrameTx { frame, responder } => {
257            responder
258                .send()
259                .expect("Failed to respond to SaeFrameTx");
260            frame
261    });
262
263    fidl_mlme::SaeFrame {
264        peer_sta_address: fullmac_sae_frame.peer_sta_address.unwrap(),
265        status_code: fullmac_sae_frame.status_code.unwrap(),
266        seq_num: fullmac_sae_frame.seq_num.unwrap(),
267        sae_fields: fullmac_sae_frame.sae_fields.unwrap(),
268    }
269}
270
271async fn send_sae_frame_to_test_realm(
272    frame: fidl_mlme::SaeFrame,
273    fullmac_ifc_proxy: &fidl_fullmac::WlanFullmacImplIfcProxy,
274) {
275    fullmac_ifc_proxy
276        .sae_frame_rx(&fidl_fullmac::SaeFrame {
277            peer_sta_address: Some(frame.peer_sta_address),
278            status_code: Some(frame.status_code),
279            seq_num: Some(frame.seq_num),
280            sae_fields: Some(frame.sae_fields.clone()),
281            ..Default::default()
282        })
283        .await
284        .expect("Could not send authenticator SAE commit frame");
285}
fullmac_helpers/fake_ap.rs

fullmac_helpers/
fake_ap.rs
