WPS connectivity problem

[arborwoods5]

Hello,

I'm trying WPS test with several types of Wi-Fi APs by using WPS API of NONOS-SDK_V1.5.1_16_01_08.
It works well with certain APs, but with some APs, API returns timeout callback (WPS_CB_ST_TIMEOUT) or failed callback (WPS_CB_ST_FAILED).

Please refer the following cases.
(Case 1 and case 2 are tested with different APs.)

[Case 1:]
Some AP doesn't return the correct response of "EAPoL start" frame, AP sends "EAPoL WPA Key1" frame instead of "EAP Request/Identity" frame.
WPS negotiation doesn't proceed and API returns timeout callback. I had confirmed the AP surely transitioned to WPS mode by the WPS-button operation, and WPS negotiation of wpa_supplicant worked normally with same AP.
I checked ESP's "Association request" frame with Wi-Fi packet capture, it contains "RSN Information" tag, but wpa_supplicant's frame doesn't contain that tag.
So, I suspect this AP doesn’t ignore that tag and transitions to WPA authentication mode instead of WPS negotiation mode.


[Case 2:]
API returns failed callback after receiving “EAP WPS M2” frame from certain AP.
In WPS successful case, the size of “EAP WPS M2” frame is smaller than size of the frame in failure case.

Frame size example:
WPS successful case: 447 bytes
WPS failure case: 504 bytes
Both frames contain same types of parameters, and the difference of frame size is mostly caused by manufacturer information (e.g. manufacturer name, model name, etc.).

So, I suspect the size of "EAP WPS M2" frame is cause of this failure.
(Is there any limitation of buffer size for WPS process?)


The question: is there any solution to solve those two problems?
Regards.

[ESP_Faye]

Hi,

Can you provide more details about your router, and the setting of your router ?

We will test it using the same router with the same setting.

[gjump]

@ESP_Faye @arborwoods5
Any updates on this issue?
I'm facing the same problem, WPS fails on some routers.
I'm posting on viewtopic.php?f=7&t=3129

[dalbert]

In case it provides more clues, the WPS function seems to work reliably with older 802.11n access points (Trendnet TEW-652, Belkin N300), but fails reliably with 802.11ac access points (AT&T/Pace 5268AC and Asus TM-AC1900).

I am using Arduino/EPS8266 core version 2.3.0 which uses SDK version: 1.5.3(aec24ac9)
I have also tried with Arduino ESP8266 core version 2.4.0rc2 which uses SDK version: 2.1.0(7106d38)

The failure is always the same; it finds the access point, showing it's SSID correctly but fails to successfully process the public key provided by the access point and acquire the PSK (see trace below).

wifi_wps_disable
wifi_wps_enable
wps scan
build public key start
build public key finish
f r0, wps discover [ATT4PcDe8QR]
scandone
WPS: neg start
f r0, scandone
state: 0 -> 2 (b0)
state: 2 -> 3 (0)
state: 3 -> 5 (10)
add 0
aid 4
cnt
process pubkey start
wps: ignore overlap identifier
wps: ignore overlap identifier
wps: ignore overlap identifier
wps: ignore overlap identifier
wps: ignore overlap identifier
wps: ignore overlap identifier
state: 5 -> 2 (17c0)
rm

Has anyone been able to connect to an 802.11ac access point using WPS and if so, can you share details (model #, anything special you had to do in the code)? Thanks!

[dalbert]

Some of my WPS problems appear to be related to insufficient free RAM. When I moved some large constant strings into flash (requires more than just defining them as const with ESP8266 toolchain) to free up RAM, some of my WPS problems disappeared.

However, I still cannot get the ESP8266 to connect to many 802.11ac routers including the Belkin AC1900. WPS scans and finds the router SSID, but fails to connect. It is successful with every 802.11 b/g/n router I have tried.

I am using Arduino Core 2.3.0 (latest) which uses SDK version 1.5.3.
I have also tried Arduino Core 2.4.0-rc2 which uses SDK version: 2.1.0(7106d38)

NOTE: the WPS callback can return 4 which indicates that the scan for an access point with WPS enabled failed; this return value is not defined in the header files.

The code to start WPS:

Code: Select all

extern "C" {
   #include "user_interface.h"
}

LOCAL void ICACHE_FLASH_ATTR
wps_status_cb(int status)
{
   wifi_wps_disable();
   Serial.printf("\n\rwps_status_cb: ");
   switch (status) {
   case WPS_CB_ST_SUCCESS:
      Serial.printf("success!");
      wifi_station_connect();
      break;
   case WPS_CB_ST_FAILED:
      Serial.printf("failed.");
      break;
   case WPS_CB_ST_TIMEOUT:
      Serial.printf("timeout.");
      break;
   case WPS_CB_ST_WEP:
      Serial.printf("WEP: not supported.");
      break;
   case 4:
      Serial.printf("scan error.");
      break;
   default: Serial.printf("%u", status);
   }
   Serial.println();
}

void setup() {
   Serial.begin(115200);
   system_set_os_print(1);
   Serial.setDebugOutput(true);
   wifi_set_opmode(STATION_MODE);
   wifi_station_set_auto_connect(0);
   delay(5000);
   wifi_wps_disable();
   wifi_wps_enable(WPS_TYPE_PBC);
   wifi_set_wps_cb(wps_status_cb);
   wifi_wps_start();
}

void loop() {
   yield();
}



The output when WPS fails looks like this:

wps scan
build public key start
build public key finish
f r0, wifi status: 0 phy_mode: 3
wps discover [belkin.150]
scandone
WPS: neg start
f r0, scandone
state: 0 -> 2 (b0)
state: 2 -> 3 (0)
state: 3 -> 5 (10)
add 0
aid 1
cnt
wifi_wps_disable
state: 5 -> 0 (0)
rm 0

wps_status_cb: failed.