tests/hwsim/test_nfc_wps.py

   1 # WPS+NFC tests
   2 # Copyright (c) 2013, Jouni Malinen <j@w1.fi>
   3 #
   4 # This software may be distributed under the terms of the BSD license.
   5 # See README for more details.
   6
   7 import time
   8 import subprocess
   9 import logging
  10 logger = logging.getLogger()
  11
  12 import hwsim_utils
  13 import hostapd
  14
  15 def check_wpa2_connection(sta, ap, ssid, mixed=False):
  16     status = sta.get_status()
  17     if status['wpa_state'] != 'COMPLETED':
  18         raise Exception("Not fully connected")
  19     if status['bssid'] != ap['bssid']:
  20         raise Exception("Unexpected BSSID")
  21     if status['ssid'] != ssid:
  22         raise Exception("Unexpected SSID")
  23     if status['pairwise_cipher'] != 'CCMP':
  24         raise Exception("Unexpected encryption configuration")
  25     if status['group_cipher'] != 'CCMP' and not mixed:
  26         raise Exception("Unexpected encryption configuration")
  27     if status['key_mgmt'] != 'WPA2-PSK':
  28         raise Exception("Unexpected key_mgmt")
  29     hwsim_utils.test_connectivity(sta.ifname, ap['ifname'])
  30
  31 def ap_wps_params(ssid):
  32     return { "ssid": ssid, "eap_server": "1", "wps_state": "2",
  33              "wpa_passphrase": "12345678", "wpa": "2",
  34              "wpa_key_mgmt": "WPA-PSK", "rsn_pairwise": "CCMP"}
  35
  36 def test_nfc_wps_password_token_sta(dev, apdev):
  37     """NFC tag with password token on the station/Enrollee"""
  38     ssid = "test-wps-nfc-pw-token-conf"
  39     params = ap_wps_params(ssid)
  40     hostapd.add_ap(apdev[0]['ifname'], params)
  41     hapd = hostapd.Hostapd(apdev[0]['ifname'])
  42     logger.info("WPS provisioning step using password token from station")
  43     pw = dev[0].request("WPS_NFC_TOKEN NDEF").rstrip()
  44     if "FAIL" in pw:
  45         raise Exception("Failed to generate password token")
  46     res = hapd.request("WPS_NFC_TAG_READ " + pw)
  47     if "FAIL" in res:
  48         raise Exception("Failed to provide NFC tag contents to hostapd")
  49     dev[0].dump_monitor()
  50     res = dev[0].request("WPS_NFC")
  51     if "FAIL" in res:
  52         raise Exception("Failed to start Enrollee using NFC password token")
  53     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=30)
  54     if ev is None:
  55         raise Exception("Association with the AP timed out")
  56     check_wpa2_connection(dev[0], apdev[0], ssid)
  57
  58 def test_nfc_wps_config_token(dev, apdev):
  59     """NFC tag with configuration token from AP"""
  60     ssid = "test-wps-nfc-conf-token"
  61     params = ap_wps_params(ssid)
  62     hostapd.add_ap(apdev[0]['ifname'], params)
  63     hapd = hostapd.Hostapd(apdev[0]['ifname'])
  64     logger.info("NFC configuration token from AP to station")
  65     conf = hapd.request("WPS_NFC_CONFIG_TOKEN NDEF").rstrip()
  66     if "FAIL" in conf:
  67         raise Exception("Failed to generate configuration token")
  68     dev[0].dump_monitor()
  69     res = dev[0].request("WPS_NFC_TAG_READ " + conf)
  70     if "FAIL" in res:
  71         raise Exception("Failed to provide NFC tag contents to wpa_supplicant")
  72     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=15)
  73     if ev is None:
  74         raise Exception("Association with the AP timed out")
  75     check_wpa2_connection(dev[0], apdev[0], ssid)
  76
  77 def test_nfc_wps_config_token_init(dev, apdev):
  78     """NFC tag with configuration token from AP with auto configuration"""
  79     ssid = "test-wps-nfc-conf-token-init"
  80     hostapd.add_ap(apdev[0]['ifname'],
  81                    { "ssid": ssid, "eap_server": "1", "wps_state": "1" })
  82     hapd = hostapd.Hostapd(apdev[0]['ifname'])
  83     logger.info("NFC configuration token from AP to station")
  84     conf = hapd.request("WPS_NFC_CONFIG_TOKEN NDEF").rstrip()
  85     if "FAIL" in conf:
  86         raise Exception("Failed to generate configuration token")
  87     dev[0].dump_monitor()
  88     res = dev[0].request("WPS_NFC_TAG_READ " + conf)
  89     if "FAIL" in res:
  90         raise Exception("Failed to provide NFC tag contents to wpa_supplicant")
  91     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=15)
  92     if ev is None:
  93         raise Exception("Association with the AP timed out")
  94     check_wpa2_connection(dev[0], apdev[0], ssid, mixed=True)
  95
  96 def test_nfc_wps_password_token_sta_init(dev, apdev):
  97     """Initial AP configuration with first WPS NFC Enrollee"""
  98     ssid = "test-wps-nfc-pw-token-init"
  99     hostapd.add_ap(apdev[0]['ifname'],
 100                    { "ssid": ssid, "eap_server": "1", "wps_state": "1" })
 101     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 102     logger.info("WPS provisioning step using password token from station")
 103     pw = dev[0].request("WPS_NFC_TOKEN NDEF").rstrip()
 104     if "FAIL" in pw:
 105         raise Exception("Failed to generate password token")
 106     res = hapd.request("WPS_NFC_TAG_READ " + pw)
 107     if "FAIL" in res:
 108         raise Exception("Failed to provide NFC tag contents to hostapd")
 109     dev[0].dump_monitor()
 110     res = dev[0].request("WPS_NFC")
 111     if "FAIL" in res:
 112         raise Exception("Failed to start Enrollee using NFC password token")
 113     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=30)
 114     if ev is None:
 115         raise Exception("Association with the AP timed out")
 116     check_wpa2_connection(dev[0], apdev[0], ssid, mixed=True)
 117
 118 def test_nfc_wps_password_token_ap(dev, apdev):
 119     """WPS registrar configuring an AP using AP password token"""
 120     ssid = "test-wps-nfc-pw-token-init"
 121     hostapd.add_ap(apdev[0]['ifname'],
 122                    { "ssid": ssid, "eap_server": "1", "wps_state": "1" })
 123     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 124     logger.info("WPS configuration step")
 125     pw = hapd.request("WPS_NFC_TOKEN NDEF").rstrip()
 126     if "FAIL" in pw:
 127         raise Exception("Failed to generate password token")
 128     res = hapd.request("WPS_NFC_TOKEN enable")
 129     if "FAIL" in pw:
 130         raise Exception("Failed to enable AP password token")
 131     res = dev[0].request("WPS_NFC_TAG_READ " + pw)
 132     if "FAIL" in res:
 133         raise Exception("Failed to provide NFC tag contents to wpa_supplicant")
 134     dev[0].dump_monitor()
 135     new_ssid = "test-wps-nfc-pw-token-new-ssid"
 136     new_passphrase = "1234567890"
 137     res = dev[0].request("WPS_REG " + apdev[0]['bssid'] + " nfc-pw " + new_ssid.encode("hex") + " WPA2PSK CCMP " + new_passphrase.encode("hex"))
 138     if "FAIL" in res:
 139         raise Exception("Failed to start Registrar using NFC password token")
 140     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=30)
 141     if ev is None:
 142         raise Exception("Association with the AP timed out")
 143     check_wpa2_connection(dev[0], apdev[0], new_ssid, mixed=True)
 144     if "FAIL" in hapd.request("WPS_NFC_TOKEN disable"):
 145         raise Exception("Failed to disable AP password token")
 146     if "FAIL" in hapd.request("WPS_NFC_TOKEN WPS"):
 147         raise Exception("Unexpected WPS_NFC_TOKEN WPS failure")
 148
 149 def test_nfc_wps_handover_init(dev, apdev):
 150     """Connect to WPS AP with NFC connection handover and move to configured state"""
 151     dev[0].request("SET ignore_old_scan_res 1")
 152     ssid = "test-wps-nfc-handover-init"
 153     hostapd.add_ap(apdev[0]['ifname'],
 154                    { "ssid": ssid, "eap_server": "1", "wps_state": "1" })
 155     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 156     logger.info("NFC connection handover")
 157     req = dev[0].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 158     if "FAIL" in req:
 159         raise Exception("Failed to generate NFC connection handover request")
 160     sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 161     if "FAIL" in sel:
 162         raise Exception("Failed to generate NFC connection handover select")
 163     res = hapd.request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 164     if "FAIL" in res:
 165         raise Exception("Failed to report NFC connection handover to to hostapd")
 166     dev[0].dump_monitor()
 167     res = dev[0].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 168     if "FAIL" in res:
 169         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 170     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=15)
 171     if ev is None:
 172         raise Exception("Association with the AP timed out")
 173     check_wpa2_connection(dev[0], apdev[0], ssid, mixed=True)
 174
 175 def test_nfc_wps_handover_errors(dev, apdev):
 176     """WPS AP NFC handover report error cases"""
 177     ssid = "test-wps-nfc-handover"
 178     hostapd.add_ap(apdev[0]['ifname'],
 179                    { "ssid": ssid, "eap_server": "1", "wps_state": "1" })
 180     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 181     sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 182     if "FAIL" in sel:
 183         raise Exception("Failed to generate NFC connection handover select")
 184     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER "):
 185         raise Exception("Unexpected handover report success")
 186     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP"):
 187         raise Exception("Unexpected handover report success")
 188     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP WPS"):
 189         raise Exception("Unexpected handover report success")
 190     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP WPS 001122"):
 191         raise Exception("Unexpected handover report success")
 192     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP WPS 001122 00"):
 193         raise Exception("Unexpected handover report success")
 194     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP WPS 0 00"):
 195         raise Exception("Unexpected handover report success")
 196     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP WPS 001122 0"):
 197         raise Exception("Unexpected handover report success")
 198     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP WPS 00q122 001122"):
 199         raise Exception("Unexpected handover report success")
 200     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP WPS 001122 001q22"):
 201         raise Exception("Unexpected handover report success")
 202     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP FOO 001122 00"):
 203         raise Exception("Unexpected handover report success")
 204
 205 def test_nfc_wps_handover(dev, apdev):
 206     """Connect to WPS AP with NFC connection handover"""
 207     ssid = "test-wps-nfc-handover"
 208     params = ap_wps_params(ssid)
 209     hostapd.add_ap(apdev[0]['ifname'], params)
 210     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 211     logger.info("NFC connection handover")
 212     req = dev[0].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 213     if "FAIL" in req:
 214         raise Exception("Failed to generate NFC connection handover request")
 215     sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 216     if "FAIL" in sel:
 217         raise Exception("Failed to generate NFC connection handover select")
 218     res = hapd.request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 219     if "FAIL" in res:
 220         raise Exception("Failed to report NFC connection handover to to hostapd")
 221     dev[0].dump_monitor()
 222     res = dev[0].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 223     if "FAIL" in res:
 224         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 225     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=30)
 226     if ev is None:
 227         raise Exception("Association with the AP timed out")
 228     check_wpa2_connection(dev[0], apdev[0], ssid)
 229
 230 def test_nfc_wps_handover_5ghz(dev, apdev):
 231     """Connect to WPS AP with NFC connection handover on 5 GHz band"""
 232     try:
 233         ssid = "test-wps-nfc-handover"
 234         params = ap_wps_params(ssid)
 235         params["country_code"] = "FI"
 236         params["hw_mode"] = "a"
 237         params["channel"] = "36"
 238         hapd = hostapd.add_ap(apdev[0]['ifname'], params)
 239         logger.info("NFC connection handover")
 240         req = dev[0].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 241         if "FAIL" in req:
 242             raise Exception("Failed to generate NFC connection handover request")
 243         sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 244         if "FAIL" in sel:
 245             raise Exception("Failed to generate NFC connection handover select")
 246         res = hapd.request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 247         if "FAIL" in res:
 248             raise Exception("Failed to report NFC connection handover to to hostapd")
 249         dev[0].dump_monitor()
 250         res = dev[0].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 251         if "FAIL" in res:
 252             raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 253         ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=30)
 254         if ev is None:
 255             raise Exception("Association with the AP timed out")
 256         check_wpa2_connection(dev[0], apdev[0], ssid)
 257     finally:
 258         subprocess.call(['sudo', 'iw', 'reg', 'set', '00'])
 259
 260 def test_nfc_wps_handover_chan14(dev, apdev):
 261     """Connect to WPS AP with NFC connection handover on channel 14"""
 262     try:
 263         ssid = "test-wps-nfc-handover"
 264         params = ap_wps_params(ssid)
 265         params["country_code"] = "JP"
 266         params["hw_mode"] = "b"
 267         params["channel"] = "14"
 268         hapd = hostapd.add_ap(apdev[0]['ifname'], params)
 269         logger.info("NFC connection handover")
 270         req = dev[0].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 271         if "FAIL" in req:
 272             raise Exception("Failed to generate NFC connection handover request")
 273         sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 274         if "FAIL" in sel:
 275             raise Exception("Failed to generate NFC connection handover select")
 276         res = hapd.request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 277         if "FAIL" in res:
 278             raise Exception("Failed to report NFC connection handover to to hostapd")
 279         dev[0].dump_monitor()
 280         res = dev[0].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 281         if "FAIL" in res:
 282             raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 283         ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=30)
 284         if ev is None:
 285             raise Exception("Association with the AP timed out")
 286         check_wpa2_connection(dev[0], apdev[0], ssid)
 287     finally:
 288         subprocess.call(['sudo', 'iw', 'reg', 'set', '00'])
 289
 290 def test_nfc_wps_handover_with_pw_token_set(dev, apdev):
 291     """Connect to WPS AP with NFC connection handover (wps_nfc_* set)"""
 292     ssid = "test-wps-nfc-handover2"
 293     params = ap_wps_params(ssid)
 294     hostapd.add_ap(apdev[0]['ifname'], params)
 295     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 296     # enable a password token (which won't be used in this test case)
 297     pw = hapd.request("WPS_NFC_TOKEN NDEF").rstrip()
 298     if "FAIL" in pw:
 299         raise Exception("Failed to generate password token")
 300     res = hapd.request("WPS_NFC_TOKEN enable")
 301     if "FAIL" in pw:
 302         raise Exception("Failed to enable AP password token")
 303     logger.info("NFC connection handover")
 304     req = dev[0].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 305     if "FAIL" in req:
 306         raise Exception("Failed to generate NFC connection handover request")
 307     sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 308     if "FAIL" in sel:
 309         raise Exception("Failed to generate NFC connection handover select")
 310     res = hapd.request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 311     if "FAIL" in res:
 312         raise Exception("Failed to report NFC connection handover to to hostapd")
 313     dev[0].dump_monitor()
 314     res = dev[0].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 315     if "FAIL" in res:
 316         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 317     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=15)
 318     if ev is None:
 319         raise Exception("Association with the AP timed out")
 320     check_wpa2_connection(dev[0], apdev[0], ssid)
 321
 322 def test_nfc_wps_handover_pk_hash_mismatch_sta(dev, apdev):
 323     """WPS NFC connection handover with invalid pkhash from station (negative)"""
 324     ssid = "wps-nfc-handover-pkhash-sta"
 325     if "FAIL" in dev[0].request("SET wps_corrupt_pkhash 1"):
 326         raise Exception("Could not enable wps_corrupt_pkhash")
 327     params = ap_wps_params(ssid)
 328     hostapd.add_ap(apdev[0]['ifname'], params)
 329     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 330     logger.info("NFC connection handover")
 331     req = dev[0].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 332     if "FAIL" in req:
 333         raise Exception("Failed to generate NFC connection handover request")
 334     sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 335     if "FAIL" in sel:
 336         raise Exception("Failed to generate NFC connection handover select")
 337     res = hapd.request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 338     if "FAIL" in res:
 339         raise Exception("Failed to report NFC connection handover to to hostapd")
 340     dev[0].dump_monitor()
 341     res = dev[0].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 342     if "FAIL" in res:
 343         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 344     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED", "WPS-FAIL"], timeout=15)
 345     if ev is None:
 346         raise Exception("Timed out")
 347     if "WPS-FAIL" not in ev:
 348         raise Exception("Public key hash mismatch not detected")
 349
 350 def test_nfc_wps_handover_pk_hash_mismatch_ap(dev, apdev):
 351     """WPS NFC connection handover with invalid pkhash from AP (negative)"""
 352     ssid = "wps-nfc-handover-pkhash-ap"
 353     params = ap_wps_params(ssid)
 354     hostapd.add_ap(apdev[0]['ifname'], params)
 355     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 356     if "FAIL" in hapd.request("SET wps_corrupt_pkhash 1"):
 357         raise Exception("Could not enable wps_corrupt_pkhash")
 358     logger.info("NFC connection handover")
 359     req = dev[0].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 360     if "FAIL" in req:
 361         raise Exception("Failed to generate NFC connection handover request")
 362     sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 363     if "FAIL" in sel:
 364         raise Exception("Failed to generate NFC connection handover select")
 365     res = hapd.request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 366     if "FAIL" in res:
 367         raise Exception("Failed to report NFC connection handover to to hostapd")
 368     dev[0].dump_monitor()
 369     res = dev[0].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 370     if "FAIL" in res:
 371         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 372     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED", "WPS-FAIL"], timeout=15)
 373     if ev is None:
 374         raise Exception("Timed out")
 375     if "WPS-FAIL" not in ev:
 376         raise Exception("Public key hash mismatch not detected")
 377
 378 def start_ap_er(er, ap, ssid):
 379     ap_pin = "12345670"
 380     ap_uuid = "27ea801a-9e5c-4e73-bd82-f89cbcd10d7e"
 381     hostapd.add_ap(ap['ifname'],
 382                    { "ssid": ssid, "eap_server": "1", "wps_state": "2",
 383                      "wpa_passphrase": "12345678", "wpa": "2",
 384                      "wpa_key_mgmt": "WPA-PSK", "rsn_pairwise": "CCMP",
 385                      "device_name": "Wireless AP", "manufacturer": "Company",
 386                      "model_name": "WAP", "model_number": "123",
 387                      "serial_number": "12345", "device_type": "6-0050F204-1",
 388                      "os_version": "01020300",
 389                      "config_methods": "label push_button",
 390                      "ap_pin": ap_pin, "uuid": ap_uuid, "upnp_iface": "lo"})
 391     logger.info("Learn AP configuration")
 392     er.dump_monitor()
 393     er.request("SET ignore_old_scan_res 1")
 394     er.wps_reg(ap['bssid'], ap_pin)
 395
 396     logger.info("Start ER")
 397     er.request("WPS_ER_STOP")
 398     time.sleep(1)
 399     er.request("WPS_ER_START ifname=lo")
 400     ev = er.wait_event(["WPS-ER-AP-ADD"], timeout=15)
 401     if ev is None:
 402         raise Exception("AP discovery timed out")
 403     if ap_uuid not in ev:
 404         raise Exception("Expected AP UUID not found")
 405
 406     logger.info("Use learned network configuration on ER")
 407     er.request("WPS_ER_SET_CONFIG " + ap_uuid + " 0")
 408
 409 def test_nfc_wps_er_pw_token(dev, apdev):
 410     """WPS NFC password token from Enrollee to ER"""
 411     ssid = "wps-nfc-er-pw-token"
 412     start_ap_er(dev[0], apdev[0], ssid)
 413     logger.info("WPS provisioning step using password token from station")
 414     dev[1].request("SET ignore_old_scan_res 1")
 415     pw = dev[1].request("WPS_NFC_TOKEN NDEF").rstrip()
 416     if "FAIL" in pw:
 417         raise Exception("Failed to generate password token")
 418     res = dev[0].request("WPS_NFC_TAG_READ " + pw)
 419     if "FAIL" in res:
 420         raise Exception("Failed to provide NFC tag contents to WPS ER")
 421     dev[0].dump_monitor()
 422     res = dev[1].request("WPS_NFC")
 423     if "FAIL" in res:
 424         raise Exception("Failed to start Enrollee using NFC password token")
 425     ev = dev[0].wait_event(["WPS-SUCCESS"], timeout=15)
 426     if ev is None:
 427         raise Exception("WPS ER did not report success")
 428     ev = dev[1].wait_event(["CTRL-EVENT-CONNECTED"], timeout=15)
 429     if ev is None:
 430         raise Exception("Association with the AP timed out")
 431     check_wpa2_connection(dev[1], apdev[0], ssid)
 432
 433 def test_nfc_wps_er_config_token(dev, apdev):
 434     """WPS NFC configuration token from ER to Enrollee"""
 435     ssid = "wps-nfc-er-config-token"
 436     start_ap_er(dev[0], apdev[0], ssid)
 437     logger.info("WPS provisioning step using configuration token from ER")
 438     conf = dev[0].request("WPS_ER_NFC_CONFIG_TOKEN NDEF " + apdev[0]['bssid']).rstrip()
 439     if "FAIL" in conf:
 440         raise Exception("Failed to generate configugration token")
 441     dev[1].request("SET ignore_old_scan_res 1")
 442     res = dev[1].request("WPS_NFC_TAG_READ " + conf)
 443     if "FAIL" in res:
 444         raise Exception("Failed to provide NFC tag contents to wpa_supplicant")
 445     ev = dev[1].wait_event(["CTRL-EVENT-CONNECTED"], timeout=15)
 446     if ev is None:
 447         raise Exception("Association with the AP timed out")
 448     check_wpa2_connection(dev[1], apdev[0], ssid)
 449
 450 def test_nfc_wps_er_handover(dev, apdev):
 451     """WPS NFC connection handover between Enrollee and ER"""
 452     ssid = "wps-nfc-er-handover"
 453     start_ap_er(dev[0], apdev[0], ssid)
 454     logger.info("WPS provisioning step using connection handover")
 455     req = dev[1].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 456     if "FAIL" in req:
 457         raise Exception("Failed to generate NFC connection handover request")
 458     sel = dev[0].request("NFC_GET_HANDOVER_SEL NDEF WPS-CR " + apdev[0]['bssid']).rstrip()
 459     if "FAIL" in sel:
 460         raise Exception("Failed to generate NFC connection handover select")
 461     res = dev[0].request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 462     if "FAIL" in res:
 463         raise Exception("Failed to report NFC connection handover to to hostapd")
 464     dev[1].dump_monitor()
 465     res = dev[1].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 466     if "FAIL" in res:
 467         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 468     ev = dev[1].wait_event(["CTRL-EVENT-CONNECTED"], timeout=15)
 469     if ev is None:
 470         raise Exception("Association with the AP timed out")
 471     check_wpa2_connection(dev[1], apdev[0], ssid)
 472
 473 def test_nfc_wps_er_handover_pk_hash_mismatch_sta(dev, apdev):
 474     """WPS NFC connection handover with invalid pkhash from station to ER (negative)"""
 475     ssid = "wps-nfc-er-handover-pkhash-sta"
 476     start_ap_er(dev[0], apdev[0], ssid)
 477     logger.info("WPS provisioning step using connection handover")
 478     if "FAIL" in dev[1].request("SET wps_corrupt_pkhash 1"):
 479         raise Exception("Could not enable wps_corrupt_pkhash")
 480     dev[1].request("SET ignore_old_scan_res 1")
 481     req = dev[1].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 482     if "FAIL" in req:
 483         raise Exception("Failed to generate NFC connection handover request")
 484     sel = dev[0].request("NFC_GET_HANDOVER_SEL NDEF WPS-CR " + apdev[0]['bssid']).rstrip()
 485     if "FAIL" in sel:
 486         raise Exception("Failed to generate NFC connection handover select")
 487     res = dev[0].request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 488     if "FAIL" in res:
 489         raise Exception("Failed to report NFC connection handover to to hostapd")
 490     dev[1].dump_monitor()
 491     res = dev[1].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 492     if "FAIL" in res:
 493         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 494     ev = dev[1].wait_event(["CTRL-EVENT-CONNECTED", "WPS-FAIL"], timeout=15)
 495     if ev is None:
 496         raise Exception("Timed out")
 497     if "WPS-FAIL" not in ev:
 498         raise Exception("Public key hash mismatch not detected")
 499
 500 def test_nfc_wps_er_handover_pk_hash_mismatch_er(dev, apdev):
 501     """WPS NFC connection handover with invalid pkhash from ER to station (negative)"""
 502     ssid = "wps-nfc-er-handover-pkhash-er"
 503     start_ap_er(dev[0], apdev[0], ssid)
 504     logger.info("WPS provisioning step using connection handover")
 505     if "FAIL" in dev[0].request("SET wps_corrupt_pkhash 1"):
 506         raise Exception("Could not enable wps_corrupt_pkhash")
 507     dev[1].request("SET ignore_old_scan_res 1")
 508     req = dev[1].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 509     if "FAIL" in req:
 510         raise Exception("Failed to generate NFC connection handover request")
 511     sel = dev[0].request("NFC_GET_HANDOVER_SEL NDEF WPS-CR " + apdev[0]['bssid']).rstrip()
 512     if "FAIL" in sel:
 513         raise Exception("Failed to generate NFC connection handover select")
 514     res = dev[0].request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 515     if "FAIL" in res:
 516         raise Exception("Failed to report NFC connection handover to to hostapd")
 517     dev[1].dump_monitor()
 518     res = dev[1].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 519     if "FAIL" in res:
 520         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 521     ev = dev[1].wait_event(["CTRL-EVENT-CONNECTED", "WPS-FAIL"], timeout=15)
 522     if ev is None:
 523         raise Exception("Timed out")
 524     if "WPS-FAIL" not in ev:
 525         raise Exception("Public key hash mismatch not detected")