From 1b43fe6694d6c13ab02648a94fa138534b27dd56 Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Sat, 7 Mar 2026 19:11:02 -0600 Subject: [PATCH] [nexus] add test 1.1.8.1.6 for On-Mesh Commissioner Joining (Reject) (#12643) This commit adds Nexus test 1.1.8.1.6, "On-Mesh Commissioner Joining, no JR, wrong Commissioner". This test verifies that an on-mesh Commissioner correctly rejects a Joiner when the Provisioning URL in the JOIN_FIN.req message is not recognized. The test verifies the following sequence: - Successful MLE Discovery and DTLS handshake between Joiner and Commissioner. - Joiner sends a JOIN_FIN.req containing an unrecognized Provisioning URL. - Commissioner responds with a JOIN_FIN.rsp with Reject state. - Commissioner sends an encrypted JOIN_ENT.ntf message. - Joiner responds with an encrypted JOIN_ENT.ntf dummy response. - Joiner terminates the DTLS session with a close_notify alert. Changes include: - Implemented C++ test logic in tests/nexus/test_1_1_8_1_6.cpp. - Implemented Python verification logic in tests/nexus/verify_1_1_8_1_6.py. - Configured DTLS key exporting in the test to allow decryption and verification of CoAP messages in tshark. - Updated tests/nexus/CMakeLists.txt and tests/nexus/run_nexus_tests.sh to include the new test. --- tests/nexus/CMakeLists.txt | 1 + tests/nexus/run_nexus_tests.sh | 1 + tests/nexus/test_1_1_8_1_6.cpp | 271 ++++++++++++++++++ tests/nexus/verify_1_1_8_1_6.py | 269 +++++++++++++++++ tests/nexus/verify_utils.py | 3 + tests/scripts/thread-cert/pktverify/consts.py | 2 + 6 files changed, 547 insertions(+) create mode 100644 tests/nexus/test_1_1_8_1_6.cpp create mode 100644 tests/nexus/verify_1_1_8_1_6.py diff --git a/tests/nexus/CMakeLists.txt b/tests/nexus/CMakeLists.txt index e878c42b7..2fd1ea02a 100644 --- a/tests/nexus/CMakeLists.txt +++ b/tests/nexus/CMakeLists.txt @@ -198,6 +198,7 @@ ot_nexus_test(1_1_7_1_7 "cert;nexus") ot_nexus_test(1_1_7_1_8 "cert;nexus") ot_nexus_test(1_1_8_1_1 "cert;nexus") ot_nexus_test(1_1_8_1_2 "cert;nexus") +ot_nexus_test(1_1_8_1_6 "cert;nexus") ot_nexus_test(1_1_9_2_1 "cert;nexus") ot_nexus_test(1_1_9_2_2 "cert;nexus") ot_nexus_test(1_1_9_2_3 "cert;nexus") diff --git a/tests/nexus/run_nexus_tests.sh b/tests/nexus/run_nexus_tests.sh index 600085b6a..83983e95b 100755 --- a/tests/nexus/run_nexus_tests.sh +++ b/tests/nexus/run_nexus_tests.sh @@ -133,6 +133,7 @@ DEFAULT_TESTS=( "1_1_7_1_8" "1_1_8_1_1" "1_1_8_1_2" + "1_1_8_1_6" "1_1_9_2_1" "1_1_9_2_2" "1_1_9_2_3" diff --git a/tests/nexus/test_1_1_8_1_6.cpp b/tests/nexus/test_1_1_8_1_6.cpp new file mode 100644 index 000000000..078f931a3 --- /dev/null +++ b/tests/nexus/test_1_1_8_1_6.cpp @@ -0,0 +1,271 @@ +/* + * Copyright (c) 2026, The OpenThread Authors. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the copyright holder nor the + * names of its contributors may be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#include + +#include "platform/nexus_core.hpp" +#include "platform/nexus_node.hpp" + +namespace ot { +namespace Nexus { + +/** + * Time to advance for a node to form a network and become leader, in milliseconds. + */ +static constexpr uint32_t kFormNetworkTime = 13 * Time::kOneSecondInMsec; + +/** + * Time to advance for the Commissioner to start, in milliseconds. + */ +static constexpr uint32_t kCommissionerStartTime = 1 * Time::kOneSecondInMsec; + +/** + * Time to advance for the Joining process to proceed, in milliseconds. + */ +static constexpr uint32_t kJoiningProcessTime = 30 * Time::kOneSecondInMsec; + +/** + * The timeout for the Joiner entry on Commissioner, in seconds. + */ +static constexpr uint32_t kJoinerTimeout = 100; + +/** + * The PSKd used for joining. + */ +static const char kPskd[] = "J01NME"; + +/** + * The filename for the DTLS key log. + */ +static const char kKeyLogFilename[] = "test_1_1_8_1_6.keys"; + +/** + * The master secret length in bytes. + */ +static constexpr uint8_t kMasterSecretLength = 48; + +/** + * The random buffer length in bytes. + */ +static constexpr uint8_t kRandomBufferLength = MeshCoP::SecureTransport::kSecureTransportRandomBufferSize; + +/** + * The channel used for the test. + */ +static constexpr uint8_t kTestChannel = 11; + +/** + * The Joiner UDP port. + */ +static constexpr uint16_t kJoinerPort = 49153; + +static void HandleMbedtlsExportKeys(void *aContext, + mbedtls_ssl_key_export_type aType, + const unsigned char *aMasterSecret, + size_t aMasterSecretLen, + const unsigned char aClientRandom[kRandomBufferLength], + const unsigned char aServerRandom[kRandomBufferLength], + mbedtls_tls_prf_types aTlsPrfType) +{ + FILE *file = fopen(kKeyLogFilename, "a"); + + OT_UNUSED_VARIABLE(aContext); + OT_UNUSED_VARIABLE(aMasterSecretLen); + OT_UNUSED_VARIABLE(aServerRandom); + OT_UNUSED_VARIABLE(aTlsPrfType); + + if (file != nullptr) + { + if (aType == MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET) + { + fprintf(file, "CLIENT_RANDOM "); + for (int i = 0; i < kRandomBufferLength; i++) + { + fprintf(file, "%02x", aClientRandom[i]); + } + fprintf(file, " "); + for (int i = 0; i < kMasterSecretLength; i++) + { + fprintf(file, "%02x", aMasterSecret[i]); + } + fprintf(file, "\n"); + } + fclose(file); + } +} + +static void HandleJoinerComplete(otError aError, void *aContext) +{ + Node *node = static_cast(aContext); + Log(" Joiner on node %u completed with error: %s", node->GetId(), otThreadErrorToString(aError)); +} + +void Test1_1_8_1_6(const char *aJsonFileName) +{ + /** + * 8.1.6 On-Mesh Commissioner Joining, no JR, wrong Commissioner. + * + * 8.1.6.1 Topology + * (Note: A topology diagram is included in the source material depicting Topology A (DUT as Commissioner) and + * Topology B (DUT as Joiner_1), with a point-to-point connection between the Commissioner and Joiner_1.) + * + * 8.1.6.2 Purpose & Description + * The purpose of this test case is to verify the DTLS session between an on-mesh Commissioner and a Joiner and + * ensure that the session does not stay open. + * + * Spec Reference | V1.1 Section | V1.3.0 Section + * --------------------------|--------------|--------------- + * Dissemination of Datasets | 8.4.3 | 8.4.3 + * Joiner Protocol | 8.4.4 | 8.4.4 + */ + + Core nexus; + + Node &commissionerNode = nexus.CreateNode(); + Node &joinerNode = nexus.CreateNode(); + + commissionerNode.SetName("Commissioner"); + joinerNode.SetName("Joiner_1"); + + nexus.AdvanceTime(0); + + Instance::SetLogLevel(kLogLevelNote); + + // Remove any existing key log file. + remove(kKeyLogFilename); + + Log("---------------------------------------------------------------------------------------"); + Log("Step 1: Joiner_1"); + + /** + * Step 1: Joiner_1 + * - Description: PSKd configured on Joiner_1 is the same as PSKd configured on Commissioner. + * - Pass Criteria: N/A + */ + + Log("---------------------------------------------------------------------------------------"); + Log("Step 2: All"); + + /** + * Step 2: All + * - Description: Begin wireless sniffer and ensure topology is created and connectivity between nodes. + * - Pass Criteria: N/A + */ + + commissionerNode.Get().SetMode(Mac::Filter::kModeRssInOnly); + joinerNode.Get().SetMode(Mac::Filter::kModeRssInOnly); + + commissionerNode.Form(); + { + MeshCoP::Dataset::Info datasetInfo; + SuccessOrQuit(commissionerNode.Get().Read(datasetInfo)); + datasetInfo.Set(kTestChannel); + commissionerNode.Get().SaveLocal(datasetInfo); + } + nexus.AdvanceTime(kFormNetworkTime); + + MeshCoP::Commissioner &commissioner = commissionerNode.Get(); + + SuccessOrQuit(commissioner.Start(nullptr, nullptr, nullptr)); + nexus.AdvanceTime(kCommissionerStartTime); + +#if OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT + static_cast(commissionerNode.Get()) + .SetKeylogCallback(HandleMbedtlsExportKeys, &commissionerNode.Get()); +#endif + + // Commissioner expects "correct-url" + SuccessOrQuit(commissioner.SetProvisioningUrl("correct-url")); + SuccessOrQuit(commissioner.AddJoinerAny(kPskd, kJoinerTimeout)); + + Log("---------------------------------------------------------------------------------------"); + Log("Step 3: Joiner_1"); + + /** + * Step 3: Joiner_1 + * - Description: Initiate the DTLS-Handshake by sending a DTLS-ClientHello handshake record to the Commissioner. + * - Pass Criteria: Verify that the following details occur in the exchange between Joiner_1 and the Commissioner: + * - 1. UDP port (Specified by Commissioner in Discovery Response) is used as destination port for UDP datagrams + * from Joiner_1 to Commissioner. + * - 2. Joiner_1 sends an initial DTLS-ClientHello handshake record to the Commissioner. + * - 3. The Commissioner receives the initial DTLS-ClientHello handshake record and sends a + * DTLS-HelloVerifyRequest handshake record to Joiner_1. + * - 4. Joiner_1 receives the DTLS-HelloVerifyRequest handshake record and sends a subsequent DTLS-ClientHello + * handshake record in one UDP datagram to the Commissioner. + * - Verify that both DTLS-HelloVerifyRequest and subsequent DTLS-ClientHello contain the same cookie. + * - 5. The Commissioner receives the subsequent DTLS-ClientHello handshake record and sends, in order, + * DTLS-ServerHello, DTLS-ServerKeyExchange and DTLS-ServerHelloDone handshake records to Joiner_1. + * - 6. Joiner_1 receives the DTLS-ServerHello, DTLS-ServerKeyExchange and DTLS-ServerHelloDone handshake records + * and sends, in order, a DTLS-ClientKeyExchange handshake record, a DTLS-ChangeCipherSpec record and an + * encrypted DTLS-Finished handshake record to the Commissioner. + * - 7. The Commissioner receives the DTLS-ClientKeyExchange handshake record, the DTLS-ChangeCipherSpec record + * and the encrypted DTLS-Finished handshake record; it then sends, in order a DTLS-ChangeCipherSpec record and + * an encrypted DTLS-Finished handshake record to Joiner_1. + * - 8. Joiner_1 receives the DTLS-ChangeCipherSpec record and the encrypted DTLS-Finished handshake record; it + * then sends a JOIN_FIN.req message in an encrypted DTLS-ApplicationData record in a single UDP datagram to the + * Commissioner. + * - The JOIN_FIN.req message must contain a Provisioning URL TLV which the Commissioner will not recognize. + * - 9. The Commissioner receives the encrypted DTLS-ApplicationData record and sends a JOIN_FIN.rsp message with + * Reject state in an encrypted DTLS-ApplicationData record in a single UDP datagram to Joiner_1. + * - 10. Commissioner sends an encrypted JOIN_ENT.ntf message to Joiner_1. + * - 11. Joiner_1 receives the encrypted JOIN_ENT.ntf message and sends an encrypted JOIN_ENT.ntf dummy response + * to Commissioner. + * - 12. Joiner_1 sends an encrypted DTLS-Alert record with a code of 0 (close_notify) to the Commissioner. + */ + + joinerNode.Get().Up(); + SuccessOrQuit(joinerNode.Get().SetPanChannel(kTestChannel)); + joinerNode.Get().SetSupportedChannelMask(Mac::ChannelMask(1 << kTestChannel)); + + SuccessOrQuit(joinerNode.Get().SetUdpPort(kJoinerPort)); + + // Joiner uses "wrong-url" which the Commissioner will not recognize. + SuccessOrQuit(joinerNode.Get().Start(kPskd, "wrong-url", nullptr, nullptr, nullptr, nullptr, + HandleJoinerComplete, &joinerNode)); + + nexus.AdvanceTime(kJoiningProcessTime); + + Log(" Joiner state: %s", MeshCoP::Joiner::StateToString(joinerNode.Get().GetState())); + + // Joiner should be in Idle state after rejection and Alert. + VerifyOrQuit(joinerNode.Get().GetState() == MeshCoP::Joiner::kStateIdle); + + nexus.SaveTestInfo(aJsonFileName); +} + +} // namespace Nexus +} // namespace ot + +int main(int argc, char *argv[]) +{ + const char *jsonFile = (argc > 2) ? argv[2] : "test_1_1_8_1_6.json"; + + ot::Nexus::Test1_1_8_1_6(jsonFile); + printf("All tests passed\n"); + return 0; +} diff --git a/tests/nexus/verify_1_1_8_1_6.py b/tests/nexus/verify_1_1_8_1_6.py new file mode 100644 index 000000000..c96aba0c7 --- /dev/null +++ b/tests/nexus/verify_1_1_8_1_6.py @@ -0,0 +1,269 @@ +#!/usr/bin/env python3 +# +# Copyright (c) 2026, The OpenThread Authors. +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# 3. Neither the name of the copyright holder nor the +# names of its contributors may be used to endorse or promote products +# derived from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE +# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS +# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN +# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +# POSSIBILITY OF SUCH DAMAGE. +# + +import sys +import os +import json +import traceback + +# Add the current directory to sys.path to find verify_utils +CUR_DIR = os.path.dirname(os.path.abspath(__file__)) +sys.path.append(CUR_DIR) + +import verify_utils +from pktverify import consts +from pktverify.null_field import nullField + +# COAP URIs and TLVs not in consts.py +JOIN_FIN_URI = '/c/jf' +JOIN_ENT_URI = '/c/je' + +# Constants +JOINER_UDP_PORT = 49153 +ALERT_DESC_CLOSE_NOTIFY = 0 +ALERT_LEVEL_FATAL = 2 +DTLS_PORT = 1000 + +STATE_REJECT = 255 # -1 in 8-bit unsigned + + +def verify(pv): + # 8.1.6 On-Mesh Commissioner Joining, no JR, wrong Commissioner. + # + # 8.1.6.1 Topology + # (Note: A topology diagram is included in the source material depicting Topology A (DUT as Commissioner) and + # Topology B (DUT as Joiner_1), with a point-to-point connection between the Commissioner and Joiner_1.) + # + # 8.1.6.2 Purpose & Description + # The purpose of this test case is to verify the DTLS session between an on-mesh Commissioner and a Joiner and + # ensure that the session does not stay open. + # + # Spec Reference | V1.1 Section | V1.3.0 Section + # ------------------------------|---------------|--------------- + # Dissemination of Datasets | 8.4.3 | 8.4.3 + # Joiner Protocol | 8.4.4 | 8.4.4 + + pkts = pv.pkts + pv.summary.show() + + COMMISSIONER = pv.vars['Commissioner'] + + # Step 1: Joiner_1 + # - Description: PSKd configured on Joiner_1 is the same as PSKd configured on Commissioner. + # - Pass Criteria: N/A + print("Step 1: Joiner_1 configured with correct PSKd.") + + # Step 2: All + # - Description: Begin wireless sniffer and ensure topology is created and connectivity between nodes. + # - Pass Criteria: N/A + print("Step 2: Topology created and connectivity ensured.") + + # Step 3: Joiner_1 + # - Description: Initiate the DTLS-Handshake by sending a DTLS-ClientHello handshake record to the Commissioner. + # - Pass Criteria: Verify that the following details occur in the exchange between Joiner_1 and the Commissioner: + print("Step 3: Joiner_1 initiates DTLS handshake.") + + # - 1. UDP port (Specified by Commissioner in Discovery Response) is used as destination port for UDP datagrams + # from Joiner_1 to Commissioner. + print("Step 3.1: UDP port (Specified by Commissioner in Discovery Response) is used.") + _pkt = pkts.filter_LLARMA().\ + filter_mle_cmd(consts.MLE_DISCOVERY_REQUEST).\ + must_next() + DISCOVERY_JOINER = _pkt.wpan.src64 + + _pkt = pkts.filter_wpan_src64(COMMISSIONER).\ + filter_wpan_dst64(DISCOVERY_JOINER).\ + filter_mle_cmd(consts.MLE_DISCOVERY_RESPONSE).\ + must_next() + COMMISSIONER_UDP_PORTS = _pkt.thread_meshcop.tlv.udp_port + + # - 2. Joiner_1 sends an initial DTLS-ClientHello handshake record to the Commissioner. + print("Step 3.2: Joiner_1 sends an initial DTLS-ClientHello.") + _pkt = pkts.filter_wpan_dst64(COMMISSIONER).\ + filter(lambda p: consts.HANDSHAKE_CLIENT_HELLO in p.dtls.handshake.type).\ + filter(lambda p: p.udp.srcport == JOINER_UDP_PORT).\ + filter(lambda p: p.udp.dstport in COMMISSIONER_UDP_PORTS).\ + must_next() + JOINER = _pkt.wpan.src64 + + # - 3. The Commissioner receives the initial DTLS-ClientHello handshake record and sends a + # DTLS-HelloVerifyRequest handshake record to Joiner_1. + print("Step 3.3: Commissioner sends a DTLS-HelloVerifyRequest.") + hvr = pkts.filter_wpan_src64(COMMISSIONER).\ + filter_wpan_dst64(JOINER).\ + filter(lambda p: consts.HANDSHAKE_HELLO_VERIFY_REQUEST in p.dtls.handshake.type).\ + filter(lambda p: p.udp.srcport in COMMISSIONER_UDP_PORTS).\ + must_next() + + # - 4. Joiner_1 receives the DTLS-HelloVerifyRequest handshake record and sends a subsequent DTLS-ClientHello + # handshake record in one UDP datagram to the Commissioner. + # - Verify that both DTLS-HelloVerifyRequest and subsequent DTLS-ClientHello contain the same cookie. + print("Step 3.4: Joiner_1 sends a subsequent DTLS-ClientHello.") + pkts.filter_wpan_src64(JOINER).\ + filter_wpan_dst64(COMMISSIONER).\ + filter(lambda p: consts.HANDSHAKE_CLIENT_HELLO in p.dtls.handshake.type).\ + filter(lambda p: p.dtls.handshake.cookie == hvr.dtls.handshake.cookie).\ + filter(lambda p: p.udp.dstport in COMMISSIONER_UDP_PORTS).\ + must_next() + + # - 5. The Commissioner receives the subsequent DTLS-ClientHello handshake record and sends, in order, + # DTLS-ServerHello, DTLS-ServerKeyExchange and DTLS-ServerHelloDone handshake records to Joiner_1. + print("Step 3.5: Commissioner sends DTLS-ServerHello, DTLS-ServerKeyExchange and DTLS-ServerHelloDone.") + pkts.filter_wpan_src64(COMMISSIONER).\ + filter_wpan_dst64(JOINER).\ + filter(lambda p: { + consts.HANDSHAKE_SERVER_HELLO, + consts.HANDSHAKE_SERVER_KEY_EXCHANGE, + consts.HANDSHAKE_SERVER_HELLO_DONE + } <= set(p.dtls.handshake.type)).\ + filter(lambda p: p.udp.srcport in COMMISSIONER_UDP_PORTS).\ + must_next() + + # - 6. Joiner_1 receives the DTLS-ServerHello, DTLS-ServerKeyExchange and DTLS-ServerHelloDone handshake records + # and sends, in order, a DTLS-ClientKeyExchange handshake record, a DTLS-ChangeCipherSpec record and an + # encrypted DTLS-Finished handshake record to the Commissioner. + print("Step 3.6: Joiner_1 sends DTLS-ClientKeyExchange, DTLS-ChangeCipherSpec and DTLS-Finished.") + pkts.filter_wpan_src64(JOINER).\ + filter_wpan_dst64(COMMISSIONER).\ + filter(lambda p: { + consts.HANDSHAKE_CLIENT_KEY_EXCHANGE, + consts.HANDSHAKE_FINISHED + } <= set(p.dtls.handshake.type)).\ + filter(lambda p: consts.CONTENT_CHANGE_CIPHER_SPEC in p.dtls.record.content_type).\ + filter(lambda p: p.udp.dstport in COMMISSIONER_UDP_PORTS).\ + must_next() + + # - 7. The Commissioner receives the DTLS-ClientKeyExchange handshake record, the DTLS-ChangeCipherSpec record + # and the encrypted DTLS-Finished handshake record; it then sends, in order a DTLS-ChangeCipherSpec record and + # an encrypted DTLS-Finished handshake record to Joiner_1. + print("Step 3.7: Commissioner sends DTLS-ChangeCipherSpec and DTLS-Finished.") + pkts.filter_wpan_src64(COMMISSIONER).\ + filter_wpan_dst64(JOINER).\ + filter(lambda p: consts.HANDSHAKE_FINISHED in p.dtls.handshake.type).\ + filter(lambda p: consts.CONTENT_CHANGE_CIPHER_SPEC in p.dtls.record.content_type).\ + filter(lambda p: p.udp.srcport in COMMISSIONER_UDP_PORTS).\ + must_next() + + # - 8. Joiner_1 receives the DTLS-ChangeCipherSpec record and the encrypted DTLS-Finished handshake record; it + # then sends a JOIN_FIN.req message in an encrypted DTLS-ApplicationData record in a single UDP datagram to the + # Commissioner. + # - The JOIN_FIN.req message must contain a Provisioning URL TLV which the Commissioner will not recognize. + print("Step 3.8: Joiner_1 sends a JOIN_FIN.req (Application Data).") + pkts.filter_wpan_src64(JOINER).\ + filter_wpan_dst64(COMMISSIONER).\ + filter(lambda p: consts.CONTENT_APPLICATION_DATA in p.dtls.record.content_type).\ + filter(lambda p: p.coap.uri_path == JOIN_FIN_URI).\ + filter(lambda p: p.coap.tlv.provisioning_url == 'wrong-url').\ + filter(lambda p: p.udp.dstport in COMMISSIONER_UDP_PORTS).\ + must_next() + + # - 9. The Commissioner receives the encrypted DTLS-ApplicationData record and sends a JOIN_FIN.rsp message with + # Reject state in an encrypted DTLS-ApplicationData record in a single UDP datagram to Joiner_1. + print("Step 3.9: Commissioner sends a JOIN_FIN.rsp (Application Data) with Reject state.") + pkts.filter_wpan_src64(COMMISSIONER).\ + filter_wpan_dst64(JOINER).\ + filter(lambda p: consts.CONTENT_APPLICATION_DATA in p.dtls.record.content_type).\ + filter(lambda p: p.coap.code == consts.COAP_CODE_ACK).\ + filter(lambda p: p.coap.tlv.state == STATE_REJECT).\ + filter(lambda p: p.udp.srcport in COMMISSIONER_UDP_PORTS).\ + must_next() + + # - 10. Commissioner sends an encrypted JOIN_ENT.ntf message to Joiner_1. + print("Step 3.10: Commissioner sends JOIN_ENT.ntf (Encrypted).") + pkts.copy().filter_wpan_src64(COMMISSIONER).\ + filter_wpan_dst64(JOINER).\ + filter(lambda p: p.wpan.security == True).\ + must_next() + + # - 11. Joiner_1 receives the encrypted JOIN_ENT.ntf message and sends an encrypted JOIN_ENT.ntf dummy response + # to Commissioner. + print("Step 3.11: Joiner_1 sends JOIN_ENT.ntf response (Encrypted).") + pkts.copy().filter_wpan_src64(JOINER).\ + filter_wpan_dst64(COMMISSIONER).\ + filter(lambda p: p.wpan.security == True).\ + must_next() + + # - 12. Joiner_1 sends an encrypted DTLS-Alert record with a code of 0 (close_notify) to the Commissioner. + # Note: OpenThread Joiner sends close_notify immediately after receiving JOIN_FIN.rsp with Reject state. + print("Step 3.12: Joiner_1 sends DTLS-Alert (close_notify).") + pkts.copy().filter_wpan_src64(JOINER).\ + filter_wpan_dst64(COMMISSIONER).\ + filter(lambda p: consts.CONTENT_ALERT in p.dtls.record.content_type).\ + filter(lambda p: p.dtls.alert_message.desc == ALERT_DESC_CLOSE_NOTIFY).\ + filter(lambda p: p.udp.dstport in COMMISSIONER_UDP_PORTS).\ + must_next() + + # Fail Conditions: + # - 3. A DTLS-Alert record with a Fatal alert level is sent by either Joiner_1 or the Commissioner. + print("Check for no Fatal DTLS alerts.") + pkts.filter(lambda p: consts.CONTENT_ALERT in p.dtls.record.content_type).\ + filter(lambda p: p.dtls.alert_message.level == ALERT_LEVEL_FATAL).\ + must_not_next() + + +if __name__ == '__main__': + verify_utils.apply_patches() + + json_file = os.path.abspath(sys.argv[1]) + keys_file = json_file.replace('.json', '.keys') + + with open(json_file, 'rt') as f: + data = json.load(f) + + consts.WIRESHARK_DECODE_AS_ENTRIES[f'udp.port=={JOINER_UDP_PORT}'] = 'dtls' + consts.WIRESHARK_DECODE_AS_ENTRIES[f'dtls.port=={JOINER_UDP_PORT}'] = 'coap' + + wireshark_prefs = consts.WIRESHARK_OVERRIDE_PREFS.copy() + if os.path.exists(keys_file): + wireshark_prefs['tls.keylog_file'] = keys_file + + existing_keys_str = wireshark_prefs.get('uat:ieee802154_keys', '') + keys = [line.strip() for line in existing_keys_str.split('\n') if line.strip()] + + network_key = data.get('network_key') + if network_key: + new_key = f'"{network_key}","1","Thread hash"' + if not any(network_key in k for k in keys): + keys.append(new_key) + wireshark_prefs['uat:ieee802154_keys'] = '\n'.join(keys) + + try: + pv = verify_utils.PacketVerifier(json_file, wireshark_prefs=wireshark_prefs) + pv.add_common_vars() + + for node_id, rloc16 in data.get('rloc16s', {}).items(): + name = pv.test_info.get_node_name(int(node_id)) + pv.add_vars(**{f'{name}_RLOC16': int(rloc16, 16)}) + + verify(pv) + print("Verification PASSED") + except Exception as e: + print(f"Verification FAILED: {e}") + traceback.print_exc() + sys.exit(1) diff --git a/tests/nexus/verify_utils.py b/tests/nexus/verify_utils.py index 9d44018be..6afdecd3c 100644 --- a/tests/nexus/verify_utils.py +++ b/tests/nexus/verify_utils.py @@ -133,6 +133,8 @@ def thread_coap_tlv_parse(t, v, layer=None): kvs.append(('pan_id', struct.unpack('>H', v)[0])) elif t == consts.NM_NETWORK_MESH_LOCAL_PREFIX_TLV and len(v) == 8 and not is_diag: kvs.append(('mesh_local_prefix', v)) + elif t == consts.NM_PROVISIONING_URL_TLV and not is_diag: + kvs.append(('provisioning_url', v.decode('utf-8', errors='replace'))) elif t == consts.NM_FUTURE_TLV: kvs.append(('future_tlv', v)) @@ -271,6 +273,7 @@ def apply_patches(): layer_fields._LAYER_FIELDS['coap.tlv.leader_router_id'] = layer_fields._auto layer_fields._LAYER_FIELDS['coap.tlv.child_id'] = layer_fields._list(layer_fields._auto) layer_fields._LAYER_FIELDS['coap.tlv.child_mode'] = layer_fields._list(layer_fields._auto) + layer_fields._LAYER_FIELDS['coap.tlv.provisioning_url'] = layer_fields._str layer_fields._LAYER_FIELDS['coap.tlv.channel_pages'] = layer_fields._bytes layer_fields._LAYER_FIELDS['coap.tlv.steering_data'] = layer_fields._bytes layer_fields._LAYER_FIELDS['coap.tlv.future_tlv'] = layer_fields._bytes diff --git a/tests/scripts/thread-cert/pktverify/consts.py b/tests/scripts/thread-cert/pktverify/consts.py index dee1ea25f..15732c92d 100644 --- a/tests/scripts/thread-cert/pktverify/consts.py +++ b/tests/scripts/thread-cert/pktverify/consts.py @@ -210,6 +210,7 @@ NM_JOINER_UDP_PORT_TLV = 18 NM_JOINER_IID_TLV = 19 NM_JOINER_ROUTER_LOCATOR_TLV = 20 NM_JOINER_ROUTER_KEK_TLV = 21 +NM_PROVISIONING_URL_TLV = 32 NM_PENDING_TIMESTAMP_TLV = 51 NM_DELAY_TIMER_TLV = 52 NM_CHANNEL_MASK_TLV = 53 @@ -399,6 +400,7 @@ CSL_DEFAULT_CHANNEL = 12 THREAD_VERSION_1_1 = 2 THREAD_VERSION_1_2 = 3 THREAD_VERSION_1_3 = 4 +THREAD_VERSION_1_4 = 5 # ICMPv6 Types ICMPV6_TYPE_DESTINATION_UNREACHABLE = 1