tests/hwsim/test_nfc_wps.py

   1 # WPS+NFC tests
   2 # Copyright (c) 2013, Jouni Malinen <j@w1.fi>
   3 #
   4 # This software may be distributed under the terms of the BSD license.
   5 # See README for more details.
   6
   7 import time
   8 import subprocess
   9 import logging
  10 logger = logging.getLogger()
  11
  12 import hwsim_utils
  13 import hostapd
  14
  15 def check_wpa2_connection(sta, ap, hapd, ssid, mixed=False):
  16     status = sta.get_status()
  17     if status['wpa_state'] != 'COMPLETED':
  18         raise Exception("Not fully connected")
  19     if status['bssid'] != ap['bssid']:
  20         raise Exception("Unexpected BSSID")
  21     if status['ssid'] != ssid:
  22         raise Exception("Unexpected SSID")
  23     if status['pairwise_cipher'] != 'CCMP':
  24         raise Exception("Unexpected encryption configuration")
  25     if status['group_cipher'] != 'CCMP' and not mixed:
  26         raise Exception("Unexpected encryption configuration")
  27     if status['key_mgmt'] != 'WPA2-PSK':
  28         raise Exception("Unexpected key_mgmt")
  29     hwsim_utils.test_connectivity(sta, hapd)
  30
  31 def ap_wps_params(ssid):
  32     return { "ssid": ssid, "eap_server": "1", "wps_state": "2",
  33              "wpa_passphrase": "12345678", "wpa": "2",
  34              "wpa_key_mgmt": "WPA-PSK", "rsn_pairwise": "CCMP"}
  35
  36 def test_nfc_wps_password_token_sta(dev, apdev):
  37     """NFC tag with password token on the station/Enrollee"""
  38     ssid = "test-wps-nfc-pw-token-conf"
  39     params = ap_wps_params(ssid)
  40     hostapd.add_ap(apdev[0]['ifname'], params)
  41     hapd = hostapd.Hostapd(apdev[0]['ifname'])
  42     logger.info("WPS provisioning step using password token from station")
  43     wps = dev[0].request("WPS_NFC_TOKEN WPS").rstrip()
  44     if "FAIL" in wps:
  45         raise Exception("Failed to generate password token (WPS only)")
  46     pw = dev[0].request("WPS_NFC_TOKEN NDEF").rstrip()
  47     if "FAIL" in pw:
  48         raise Exception("Failed to generate password token")
  49     res = hapd.request("WPS_NFC_TAG_READ " + pw)
  50     if "FAIL" in res:
  51         raise Exception("Failed to provide NFC tag contents to hostapd")
  52     dev[0].dump_monitor()
  53     res = dev[0].request("WPS_NFC")
  54     if "FAIL" in res:
  55         raise Exception("Failed to start Enrollee using NFC password token")
  56     dev[0].wait_connected(timeout=30)
  57     check_wpa2_connection(dev[0], apdev[0], hapd, ssid)
  58
  59 def test_nfc_wps_config_token(dev, apdev):
  60     """NFC tag with configuration token from AP"""
  61     ssid = "test-wps-nfc-conf-token"
  62     params = ap_wps_params(ssid)
  63     hostapd.add_ap(apdev[0]['ifname'], params)
  64     hapd = hostapd.Hostapd(apdev[0]['ifname'])
  65     logger.info("NFC configuration token from AP to station")
  66     conf = hapd.request("WPS_NFC_CONFIG_TOKEN NDEF").rstrip()
  67     if "FAIL" in conf:
  68         raise Exception("Failed to generate configuration token")
  69     dev[0].dump_monitor()
  70     res = dev[0].request("WPS_NFC_TAG_READ " + conf)
  71     if "FAIL" in res:
  72         raise Exception("Failed to provide NFC tag contents to wpa_supplicant")
  73     dev[0].wait_connected(timeout=15)
  74     check_wpa2_connection(dev[0], apdev[0], hapd, ssid)
  75
  76 def test_nfc_wps_config_token_init(dev, apdev):
  77     """NFC tag with configuration token from AP with auto configuration"""
  78     ssid = "test-wps-nfc-conf-token-init"
  79     hostapd.add_ap(apdev[0]['ifname'],
  80                    { "ssid": ssid, "eap_server": "1", "wps_state": "1" })
  81     hapd = hostapd.Hostapd(apdev[0]['ifname'])
  82     logger.info("NFC configuration token from AP to station")
  83     conf = hapd.request("WPS_NFC_CONFIG_TOKEN NDEF").rstrip()
  84     if "FAIL" in conf:
  85         raise Exception("Failed to generate configuration token")
  86     dev[0].dump_monitor()
  87     res = dev[0].request("WPS_NFC_TAG_READ " + conf)
  88     if "FAIL" in res:
  89         raise Exception("Failed to provide NFC tag contents to wpa_supplicant")
  90     dev[0].wait_connected(timeout=15)
  91     check_wpa2_connection(dev[0], apdev[0], hapd, ssid, mixed=True)
  92
  93 def test_nfc_wps_password_token_sta_init(dev, apdev):
  94     """Initial AP configuration with first WPS NFC Enrollee"""
  95     ssid = "test-wps-nfc-pw-token-init"
  96     hostapd.add_ap(apdev[0]['ifname'],
  97                    { "ssid": ssid, "eap_server": "1", "wps_state": "1" })
  98     hapd = hostapd.Hostapd(apdev[0]['ifname'])
  99     logger.info("WPS provisioning step using password token from station")
 100     pw = dev[0].request("WPS_NFC_TOKEN NDEF").rstrip()
 101     if "FAIL" in pw:
 102         raise Exception("Failed to generate password token")
 103     res = hapd.request("WPS_NFC_TAG_READ " + pw)
 104     if "FAIL" in res:
 105         raise Exception("Failed to provide NFC tag contents to hostapd")
 106     dev[0].dump_monitor()
 107     res = dev[0].request("WPS_NFC")
 108     if "FAIL" in res:
 109         raise Exception("Failed to start Enrollee using NFC password token")
 110     dev[0].wait_connected(timeout=30)
 111     check_wpa2_connection(dev[0], apdev[0], hapd, ssid, mixed=True)
 112
 113 def test_nfc_wps_password_token_ap(dev, apdev):
 114     """WPS registrar configuring an AP using AP password token"""
 115     ssid = "test-wps-nfc-pw-token-init"
 116     hostapd.add_ap(apdev[0]['ifname'],
 117                    { "ssid": ssid, "eap_server": "1", "wps_state": "1" })
 118     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 119     logger.info("WPS configuration step")
 120     pw = hapd.request("WPS_NFC_TOKEN NDEF").rstrip()
 121     if "FAIL" in pw:
 122         raise Exception("Failed to generate password token")
 123     res = hapd.request("WPS_NFC_TOKEN enable")
 124     if "FAIL" in pw:
 125         raise Exception("Failed to enable AP password token")
 126     res = dev[0].request("WPS_NFC_TAG_READ " + pw)
 127     if "FAIL" in res:
 128         raise Exception("Failed to provide NFC tag contents to wpa_supplicant")
 129     dev[0].dump_monitor()
 130     new_ssid = "test-wps-nfc-pw-token-new-ssid"
 131     new_passphrase = "1234567890"
 132     res = dev[0].request("WPS_REG " + apdev[0]['bssid'] + " nfc-pw " + new_ssid.encode("hex") + " WPA2PSK CCMP " + new_passphrase.encode("hex"))
 133     if "FAIL" in res:
 134         raise Exception("Failed to start Registrar using NFC password token")
 135     dev[0].wait_connected(timeout=30)
 136     check_wpa2_connection(dev[0], apdev[0], hapd, new_ssid, mixed=True)
 137     if "FAIL" in hapd.request("WPS_NFC_TOKEN disable"):
 138         raise Exception("Failed to disable AP password token")
 139     if "FAIL" in hapd.request("WPS_NFC_TOKEN WPS"):
 140         raise Exception("Unexpected WPS_NFC_TOKEN WPS failure")
 141
 142 def test_nfc_wps_handover_init(dev, apdev):
 143     """Connect to WPS AP with NFC connection handover and move to configured state"""
 144     dev[0].request("SET ignore_old_scan_res 1")
 145     ssid = "test-wps-nfc-handover-init"
 146     hostapd.add_ap(apdev[0]['ifname'],
 147                    { "ssid": ssid, "eap_server": "1", "wps_state": "1" })
 148     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 149     logger.info("NFC connection handover")
 150     req = dev[0].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 151     if "FAIL" in req:
 152         raise Exception("Failed to generate NFC connection handover request")
 153     sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 154     if "FAIL" in sel:
 155         raise Exception("Failed to generate NFC connection handover select")
 156     res = hapd.request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 157     if "FAIL" in res:
 158         raise Exception("Failed to report NFC connection handover to to hostapd")
 159     dev[0].dump_monitor()
 160     res = dev[0].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 161     if "FAIL" in res:
 162         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 163     dev[0].wait_connected(timeout=15)
 164     check_wpa2_connection(dev[0], apdev[0], hapd, ssid, mixed=True)
 165
 166 def test_nfc_wps_handover_errors(dev, apdev):
 167     """WPS AP NFC handover report error cases"""
 168     ssid = "test-wps-nfc-handover"
 169     hostapd.add_ap(apdev[0]['ifname'],
 170                    { "ssid": ssid, "eap_server": "1", "wps_state": "1" })
 171     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 172     sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 173     if "FAIL" in sel:
 174         raise Exception("Failed to generate NFC connection handover select")
 175     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER "):
 176         raise Exception("Unexpected handover report success")
 177     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP"):
 178         raise Exception("Unexpected handover report success")
 179     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP WPS"):
 180         raise Exception("Unexpected handover report success")
 181     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP WPS 001122"):
 182         raise Exception("Unexpected handover report success")
 183     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP WPS 001122 00"):
 184         raise Exception("Unexpected handover report success")
 185     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP WPS 0 00"):
 186         raise Exception("Unexpected handover report success")
 187     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP WPS 001122 0"):
 188         raise Exception("Unexpected handover report success")
 189     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP WPS 00q122 001122"):
 190         raise Exception("Unexpected handover report success")
 191     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP WPS 001122 001q22"):
 192         raise Exception("Unexpected handover report success")
 193     if "FAIL" not in hapd.request("NFC_REPORT_HANDOVER RESP FOO 001122 00"):
 194         raise Exception("Unexpected handover report success")
 195
 196 def test_nfc_wps_handover(dev, apdev):
 197     """Connect to WPS AP with NFC connection handover"""
 198     ssid = "test-wps-nfc-handover"
 199     params = ap_wps_params(ssid)
 200     hostapd.add_ap(apdev[0]['ifname'], params)
 201     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 202     logger.info("NFC connection handover")
 203     req = dev[0].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 204     if "FAIL" in req:
 205         raise Exception("Failed to generate NFC connection handover request")
 206     sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 207     if "FAIL" in sel:
 208         raise Exception("Failed to generate NFC connection handover select")
 209     res = hapd.request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 210     if "FAIL" in res:
 211         raise Exception("Failed to report NFC connection handover to to hostapd")
 212     dev[0].dump_monitor()
 213     res = dev[0].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 214     if "FAIL" in res:
 215         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 216     dev[0].wait_connected(timeout=30)
 217     check_wpa2_connection(dev[0], apdev[0], hapd, ssid)
 218
 219 def test_nfc_wps_handover_5ghz(dev, apdev):
 220     """Connect to WPS AP with NFC connection handover on 5 GHz band"""
 221     try:
 222         ssid = "test-wps-nfc-handover"
 223         params = ap_wps_params(ssid)
 224         params["country_code"] = "FI"
 225         params["hw_mode"] = "a"
 226         params["channel"] = "36"
 227         hapd = hostapd.add_ap(apdev[0]['ifname'], params)
 228         logger.info("NFC connection handover")
 229         req = dev[0].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 230         if "FAIL" in req:
 231             raise Exception("Failed to generate NFC connection handover request")
 232         sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 233         if "FAIL" in sel:
 234             raise Exception("Failed to generate NFC connection handover select")
 235         res = hapd.request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 236         if "FAIL" in res:
 237             raise Exception("Failed to report NFC connection handover to to hostapd")
 238         dev[0].dump_monitor()
 239         res = dev[0].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 240         if "FAIL" in res:
 241             raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 242         dev[0].wait_connected(timeout=30)
 243         check_wpa2_connection(dev[0], apdev[0], hapd, ssid)
 244     finally:
 245         dev[0].request("DISCONNECT")
 246         if hapd:
 247             hapd.request("DISABLE")
 248         subprocess.call(['sudo', 'iw', 'reg', 'set', '00'])
 249         dev[0].flush_scan_cache()
 250
 251 def test_nfc_wps_handover_chan14(dev, apdev):
 252     """Connect to WPS AP with NFC connection handover on channel 14"""
 253     try:
 254         ssid = "test-wps-nfc-handover"
 255         params = ap_wps_params(ssid)
 256         params["country_code"] = "JP"
 257         params["hw_mode"] = "b"
 258         params["channel"] = "14"
 259         hapd = hostapd.add_ap(apdev[0]['ifname'], params)
 260         logger.info("NFC connection handover")
 261         req = dev[0].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 262         if "FAIL" in req:
 263             raise Exception("Failed to generate NFC connection handover request")
 264         sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 265         if "FAIL" in sel:
 266             raise Exception("Failed to generate NFC connection handover select")
 267         res = hapd.request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 268         if "FAIL" in res:
 269             raise Exception("Failed to report NFC connection handover to to hostapd")
 270         dev[0].dump_monitor()
 271         res = dev[0].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 272         if "FAIL" in res:
 273             raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 274         dev[0].wait_connected(timeout=30)
 275         check_wpa2_connection(dev[0], apdev[0], hapd, ssid)
 276     finally:
 277         dev[0].request("DISCONNECT")
 278         if hapd:
 279             hapd.request("DISABLE")
 280         subprocess.call(['sudo', 'iw', 'reg', 'set', '00'])
 281         dev[0].flush_scan_cache()
 282
 283 def test_nfc_wps_handover_with_pw_token_set(dev, apdev):
 284     """Connect to WPS AP with NFC connection handover (wps_nfc_* set)"""
 285     ssid = "test-wps-nfc-handover2"
 286     params = ap_wps_params(ssid)
 287     hostapd.add_ap(apdev[0]['ifname'], params)
 288     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 289     # enable a password token (which won't be used in this test case)
 290     pw = hapd.request("WPS_NFC_TOKEN NDEF").rstrip()
 291     if "FAIL" in pw:
 292         raise Exception("Failed to generate password token")
 293     res = hapd.request("WPS_NFC_TOKEN enable")
 294     if "FAIL" in pw:
 295         raise Exception("Failed to enable AP password token")
 296     logger.info("NFC connection handover")
 297     req = dev[0].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 298     if "FAIL" in req:
 299         raise Exception("Failed to generate NFC connection handover request")
 300     sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 301     if "FAIL" in sel:
 302         raise Exception("Failed to generate NFC connection handover select")
 303     res = hapd.request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 304     if "FAIL" in res:
 305         raise Exception("Failed to report NFC connection handover to to hostapd")
 306     dev[0].dump_monitor()
 307     res = dev[0].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 308     if "FAIL" in res:
 309         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 310     dev[0].wait_connected(timeout=15)
 311     check_wpa2_connection(dev[0], apdev[0], hapd, ssid)
 312
 313 def test_nfc_wps_handover_pk_hash_mismatch_sta(dev, apdev):
 314     """WPS NFC connection handover with invalid pkhash from station (negative)"""
 315     ssid = "wps-nfc-handover-pkhash-sta"
 316     if "FAIL" in dev[0].request("SET wps_corrupt_pkhash 1"):
 317         raise Exception("Could not enable wps_corrupt_pkhash")
 318     params = ap_wps_params(ssid)
 319     hostapd.add_ap(apdev[0]['ifname'], params)
 320     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 321     logger.info("NFC connection handover")
 322     req = dev[0].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 323     if "FAIL" in req:
 324         raise Exception("Failed to generate NFC connection handover request")
 325     sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 326     if "FAIL" in sel:
 327         raise Exception("Failed to generate NFC connection handover select")
 328     res = hapd.request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 329     if "FAIL" in res:
 330         raise Exception("Failed to report NFC connection handover to to hostapd")
 331     dev[0].dump_monitor()
 332     res = dev[0].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 333     if "FAIL" in res:
 334         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 335     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED", "WPS-FAIL"], timeout=15)
 336     if ev is None:
 337         raise Exception("Timed out")
 338     if "WPS-FAIL" not in ev:
 339         raise Exception("Public key hash mismatch not detected")
 340
 341 def test_nfc_wps_handover_pk_hash_mismatch_ap(dev, apdev):
 342     """WPS NFC connection handover with invalid pkhash from AP (negative)"""
 343     ssid = "wps-nfc-handover-pkhash-ap"
 344     params = ap_wps_params(ssid)
 345     hostapd.add_ap(apdev[0]['ifname'], params)
 346     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 347     if "FAIL" in hapd.request("SET wps_corrupt_pkhash 1"):
 348         raise Exception("Could not enable wps_corrupt_pkhash")
 349     logger.info("NFC connection handover")
 350     req = dev[0].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 351     if "FAIL" in req:
 352         raise Exception("Failed to generate NFC connection handover request")
 353     sel = hapd.request("NFC_GET_HANDOVER_SEL NDEF WPS-CR").rstrip()
 354     if "FAIL" in sel:
 355         raise Exception("Failed to generate NFC connection handover select")
 356     res = hapd.request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 357     if "FAIL" in res:
 358         raise Exception("Failed to report NFC connection handover to to hostapd")
 359     dev[0].dump_monitor()
 360     res = dev[0].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 361     if "FAIL" in res:
 362         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 363     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED", "WPS-FAIL"], timeout=15)
 364     if ev is None:
 365         raise Exception("Timed out")
 366     if "WPS-FAIL" not in ev:
 367         raise Exception("Public key hash mismatch not detected")
 368
 369 def start_ap_er(er, ap, ssid):
 370     ap_pin = "12345670"
 371     ap_uuid = "27ea801a-9e5c-4e73-bd82-f89cbcd10d7e"
 372     hostapd.add_ap(ap['ifname'],
 373                    { "ssid": ssid, "eap_server": "1", "wps_state": "2",
 374                      "wpa_passphrase": "12345678", "wpa": "2",
 375                      "wpa_key_mgmt": "WPA-PSK", "rsn_pairwise": "CCMP",
 376                      "device_name": "Wireless AP", "manufacturer": "Company",
 377                      "model_name": "WAP", "model_number": "123",
 378                      "serial_number": "12345", "device_type": "6-0050F204-1",
 379                      "os_version": "01020300",
 380                      "config_methods": "label push_button",
 381                      "ap_pin": ap_pin, "uuid": ap_uuid, "upnp_iface": "lo"})
 382     logger.info("Learn AP configuration")
 383     er.dump_monitor()
 384     er.request("SET ignore_old_scan_res 1")
 385     er.wps_reg(ap['bssid'], ap_pin)
 386
 387     logger.info("Start ER")
 388     er.request("WPS_ER_STOP")
 389     time.sleep(1)
 390     er.request("WPS_ER_START ifname=lo")
 391     ev = er.wait_event(["WPS-ER-AP-ADD"], timeout=15)
 392     if ev is None:
 393         raise Exception("AP discovery timed out")
 394     if ap_uuid not in ev:
 395         raise Exception("Expected AP UUID not found")
 396
 397     logger.info("Use learned network configuration on ER")
 398     er.request("WPS_ER_SET_CONFIG " + ap_uuid + " 0")
 399
 400 def test_nfc_wps_er_pw_token(dev, apdev):
 401     """WPS NFC password token from Enrollee to ER"""
 402     try:
 403         _test_nfc_wps_er_pw_token(dev, apdev)
 404     finally:
 405         dev[0].request("WPS_ER_STOP")
 406
 407 def _test_nfc_wps_er_pw_token(dev, apdev):
 408     ssid = "wps-nfc-er-pw-token"
 409     start_ap_er(dev[0], apdev[0], ssid)
 410     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 411     logger.info("WPS provisioning step using password token from station")
 412     dev[1].request("SET ignore_old_scan_res 1")
 413     pw = dev[1].request("WPS_NFC_TOKEN NDEF").rstrip()
 414     if "FAIL" in pw:
 415         raise Exception("Failed to generate password token")
 416     res = dev[0].request("WPS_NFC_TAG_READ " + pw)
 417     if "FAIL" in res:
 418         raise Exception("Failed to provide NFC tag contents to WPS ER")
 419     dev[0].dump_monitor()
 420     res = dev[1].request("WPS_NFC")
 421     if "FAIL" in res:
 422         raise Exception("Failed to start Enrollee using NFC password token")
 423     ev = dev[0].wait_event(["WPS-SUCCESS"], timeout=15)
 424     if ev is None:
 425         raise Exception("WPS ER did not report success")
 426     dev[1].wait_connected(timeout=15)
 427     check_wpa2_connection(dev[1], apdev[0], hapd, ssid)
 428
 429 def test_nfc_wps_er_config_token(dev, apdev):
 430     """WPS NFC configuration token from ER to Enrollee"""
 431     try:
 432         _test_nfc_wps_er_config_token(dev, apdev)
 433     finally:
 434         dev[0].request("WPS_ER_STOP")
 435
 436 def _test_nfc_wps_er_config_token(dev, apdev):
 437     ssid = "wps-nfc-er-config-token"
 438     start_ap_er(dev[0], apdev[0], ssid)
 439     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 440     logger.info("WPS provisioning step using configuration token from ER")
 441     wps = dev[0].request("WPS_ER_NFC_CONFIG_TOKEN WPS " + apdev[0]['bssid']).rstrip()
 442     if "FAIL" in wps:
 443         raise Exception("Failed to generate configuration token (WPS format)")
 444     conf = dev[0].request("WPS_ER_NFC_CONFIG_TOKEN NDEF " + apdev[0]['bssid']).rstrip()
 445     if "FAIL" in conf:
 446         raise Exception("Failed to generate configuration token")
 447     dev[1].request("SET ignore_old_scan_res 1")
 448     res = dev[1].request("WPS_NFC_TAG_READ " + conf)
 449     if "FAIL" in res:
 450         raise Exception("Failed to provide NFC tag contents to wpa_supplicant")
 451     dev[1].wait_connected(timeout=15)
 452     check_wpa2_connection(dev[1], apdev[0], hapd, ssid)
 453
 454 def test_nfc_wps_er_handover(dev, apdev):
 455     """WPS NFC connection handover between Enrollee and ER"""
 456     try:
 457         _test_nfc_wps_er_handover(dev, apdev)
 458     finally:
 459         dev[0].request("WPS_ER_STOP")
 460
 461 def _test_nfc_wps_er_handover(dev, apdev):
 462     ssid = "wps-nfc-er-handover"
 463     start_ap_er(dev[0], apdev[0], ssid)
 464     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 465     logger.info("WPS provisioning step using connection handover")
 466     req = dev[1].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 467     if "FAIL" in req:
 468         raise Exception("Failed to generate NFC connection handover request")
 469     sel = dev[0].request("NFC_GET_HANDOVER_SEL NDEF WPS-CR " + apdev[0]['bssid']).rstrip()
 470     if "FAIL" in sel:
 471         raise Exception("Failed to generate NFC connection handover select")
 472     res = dev[0].request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 473     if "FAIL" in res:
 474         raise Exception("Failed to report NFC connection handover to to hostapd")
 475     dev[1].dump_monitor()
 476     res = dev[1].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 477     if "FAIL" in res:
 478         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 479     dev[1].wait_connected(timeout=15)
 480     check_wpa2_connection(dev[1], apdev[0], hapd, ssid)
 481
 482 def test_nfc_wps_er_handover_pk_hash_mismatch_sta(dev, apdev):
 483     """WPS NFC connection handover with invalid pkhash from station to ER (negative)"""
 484     try:
 485         _test_nfc_wps_er_handover_pk_hash_mismatch_sta(dev, apdev)
 486     finally:
 487         dev[0].request("WPS_ER_STOP")
 488
 489 def _test_nfc_wps_er_handover_pk_hash_mismatch_sta(dev, apdev):
 490     ssid = "wps-nfc-er-handover-pkhash-sta"
 491     start_ap_er(dev[0], apdev[0], ssid)
 492     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 493     logger.info("WPS provisioning step using connection handover")
 494     if "FAIL" in dev[1].request("SET wps_corrupt_pkhash 1"):
 495         raise Exception("Could not enable wps_corrupt_pkhash")
 496     dev[1].request("SET ignore_old_scan_res 1")
 497     req = dev[1].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 498     if "FAIL" in req:
 499         raise Exception("Failed to generate NFC connection handover request")
 500     sel = dev[0].request("NFC_GET_HANDOVER_SEL NDEF WPS-CR " + apdev[0]['bssid']).rstrip()
 501     if "FAIL" in sel:
 502         raise Exception("Failed to generate NFC connection handover select")
 503     res = dev[0].request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 504     if "FAIL" in res:
 505         raise Exception("Failed to report NFC connection handover to to hostapd")
 506     dev[1].dump_monitor()
 507     res = dev[1].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 508     if "FAIL" in res:
 509         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 510     ev = dev[1].wait_event(["CTRL-EVENT-CONNECTED", "WPS-FAIL"], timeout=15)
 511     if ev is None:
 512         raise Exception("Timed out")
 513     if "WPS-FAIL" not in ev:
 514         raise Exception("Public key hash mismatch not detected")
 515
 516 def test_nfc_wps_er_handover_pk_hash_mismatch_er(dev, apdev):
 517     """WPS NFC connection handover with invalid pkhash from ER to station (negative)"""
 518     try:
 519         _test_nfc_wps_er_handover_pk_hash_mismatch_er(dev, apdev)
 520     finally:
 521         dev[0].request("WPS_ER_STOP")
 522
 523 def _test_nfc_wps_er_handover_pk_hash_mismatch_er(dev, apdev):
 524     ssid = "wps-nfc-er-handover-pkhash-er"
 525     start_ap_er(dev[0], apdev[0], ssid)
 526     hapd = hostapd.Hostapd(apdev[0]['ifname'])
 527     logger.info("WPS provisioning step using connection handover")
 528     if "FAIL" in dev[0].request("SET wps_corrupt_pkhash 1"):
 529         raise Exception("Could not enable wps_corrupt_pkhash")
 530     dev[1].request("SET ignore_old_scan_res 1")
 531     req = dev[1].request("NFC_GET_HANDOVER_REQ NDEF WPS-CR").rstrip()
 532     if "FAIL" in req:
 533         raise Exception("Failed to generate NFC connection handover request")
 534     sel = dev[0].request("NFC_GET_HANDOVER_SEL NDEF WPS-CR " + apdev[0]['bssid']).rstrip()
 535     if "FAIL" in sel:
 536         raise Exception("Failed to generate NFC connection handover select")
 537     res = dev[0].request("NFC_REPORT_HANDOVER RESP WPS " + req + " " + sel)
 538     if "FAIL" in res:
 539         raise Exception("Failed to report NFC connection handover to to hostapd")
 540     dev[1].dump_monitor()
 541     res = dev[1].request("NFC_REPORT_HANDOVER INIT WPS " + req + " " + sel)
 542     if "FAIL" in res:
 543         raise Exception("Failed to report NFC connection handover to to wpa_supplicant")
 544     ev = dev[1].wait_event(["CTRL-EVENT-CONNECTED", "WPS-FAIL"], timeout=15)
 545     if ev is None:
 546         raise Exception("Timed out")
 547     if "WPS-FAIL" not in ev:
 548         raise Exception("Public key hash mismatch not detected")