[RFC 27/30] wpa_supplicant: SMD: Add a testing option to generate invalid ST requests

[Ilan Peer]

Add an smd_test_st_fail wpa_supplicant testing option that omits the
Nonce and DH Parameter elements from the ST preparation request,
advertises an unsupported DH group, omits the MIC element from the ST
execution request, or corrupts that MIC.

These options can later be used to test AP processing of the ST
requests.

Signed-off-by: Ilan Peer <ilan.peer at intel.com>
---
 wpa_supplicant/ctrl_iface.c       |  2 ++
 wpa_supplicant/smd.c              | 29 +++++++++++++++++++++++++----
 wpa_supplicant/wpa_supplicant_i.h |  8 ++++++++
 3 files changed, 35 insertions(+), 4 deletions(-)

diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
index 0411384f876c..12581dc506ed 100644
--- a/wpa_supplicant/ctrl_iface.c
+++ b/wpa_supplicant/ctrl_iface.c
@@ -889,6 +889,8 @@ static int wpa_supplicant_ctrl_iface_set(struct wpa_supplicant *wpa_s,
 		/* Populate value to wpa_sm if already associated. */
 		wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_DISABLE_EAPOL_G2_TX,
 				 wpa_s->disable_eapol_g2_tx);
+	} else if (os_strcasecmp(cmd, "smd_test_st_fail") == 0) {
+		wpa_s->smd_test_st_fail = atoi(value);
 	} else if (os_strcasecmp(cmd, "test_assoc_comeback_type") == 0) {
 		wpa_s->test_assoc_comeback_type = atoi(value);
 #ifdef CONFIG_DPP
diff --git a/wpa_supplicant/smd.c b/wpa_supplicant/smd.c
index 2e5dea3fd1c2..a919fbbfba1c 100644
--- a/wpa_supplicant/smd.c
+++ b/wpa_supplicant/smd.c
@@ -72,6 +72,18 @@ bool wpas_smd_st_candidate(struct wpa_supplicant *wpa_s, struct wpa_bss *bss)
 }
 
 
+static bool wpas_smd_test_fail(struct wpa_supplicant *wpa_s, unsigned int fail)
+{
+#ifdef CONFIG_TESTING_OPTIONS
+	if (wpa_s->smd_test_st_fail == fail) {
+		wpa_printf(MSG_INFO, "SMD: TEST: apply ST failure %u", fail);
+		return true;
+	}
+#endif /* CONFIG_TESTING_OPTIONS */
+	return false;
+}
+
+
 int wpas_smd_st_start(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
 		      struct wpa_ssid *ssid)
 {
@@ -119,7 +131,8 @@ int wpas_smd_st_start(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
 	wpa_s->smd.smd_per_ap_mld_ptk_mode = bss->smd_per_ap_mld_ptk_mode;
 
 	/* Setup information for per-AP PTK mode */
-	if (bss->smd_per_ap_mld_ptk_mode) {
+	if (bss->smd_per_ap_mld_ptk_mode &&
+	    !wpas_smd_test_fail(wpa_s, SMD_TEST_ST_FAIL_NO_PTK_PARAMS)) {
 		if (random_get_bytes(wpa_s->smd.snonce, WPA_NONCE_LEN) < 0) {
 			wpa_printf(MSG_DEBUG,
 				   "SMD: Failed to generate SNonce");
@@ -160,7 +173,10 @@ int wpas_smd_st_start(struct wpa_supplicant *wpa_s, struct wpa_bss *bss,
 		wpabuf_put_u8(elems, WLAN_EID_EXTENSION);
 		wpabuf_put_u8(elems, 1 + 2 + wpabuf_len(pubkey_buf));
 		wpabuf_put_u8(elems, WLAN_EID_EXT_OWE_DH_PARAM);
-		wpabuf_put_le16(elems, 19);
+		wpabuf_put_le16(elems,
+				wpas_smd_test_fail(wpa_s,
+						   SMD_TEST_ST_FAIL_DH_GROUP) ?
+				20 : 19);
 		wpabuf_put_buf(elems, pubkey_buf);
 
 		params.ies = wpabuf_head(elems);
@@ -251,8 +267,13 @@ static int wpas_smd_st_execute(struct wpa_supplicant *wpa_s)
 		mic_elem[0] = WLAN_EID_MIC;
 		mic_elem[1] = ret;
 
-		params.ies = mic_elem;
-		params.ies_len = 2 + ret;
+		if (wpas_smd_test_fail(wpa_s, SMD_TEST_ST_FAIL_BAD_MIC))
+			mic_elem[2] ^= 0x80;
+
+		if (!wpas_smd_test_fail(wpa_s, SMD_TEST_ST_FAIL_NO_MIC)) {
+			params.ies = mic_elem;
+			params.ies_len = 2 + ret;
+		}
 	}
 
 	ret = wpa_drv_st_execute(wpa_s, &params);
diff --git a/wpa_supplicant/wpa_supplicant_i.h b/wpa_supplicant/wpa_supplicant_i.h
index fce1adb9a5a8..e313d4d35deb 100644
--- a/wpa_supplicant/wpa_supplicant_i.h
+++ b/wpa_supplicant/wpa_supplicant_i.h
@@ -798,6 +798,13 @@ struct smd_info {
 	u8 target_ap_mld_addr[ETH_ALEN];
 };
 
+/* Ways of breaking the per-AP MLD PTK parameters of an SMD Transition */
+#define SMD_TEST_ST_FAIL_NONE		0
+#define SMD_TEST_ST_FAIL_NO_PTK_PARAMS	1
+#define SMD_TEST_ST_FAIL_DH_GROUP	2
+#define SMD_TEST_ST_FAIL_NO_MIC		3
+#define SMD_TEST_ST_FAIL_BAD_MIC	4
+
 /**
  * struct wpa_supplicant - Internal data for wpa_supplicant interface
  *
@@ -1546,6 +1553,7 @@ struct wpa_supplicant {
 	unsigned int oci_freq_override_fils_assoc;
 	unsigned int oci_freq_override_wnm_sleep;
 	unsigned int disable_eapol_g2_tx;
+	unsigned int smd_test_st_fail;
 	unsigned int eapol_2_key_info_set_mask;
 	int test_assoc_comeback_type;
 	struct wpabuf *link_ies[MAX_NUM_MLD_LINKS];
-- 
2.55.0