Error handling for restricted NFC

ykman/_cli/__main__.py

@@ -46,6 +46,7 @@
     parse_private_key,
     parse_certificates,
     InvalidPasswordError,
+    is_nfc_restricted,
 )
 from ..logging import init_logging
 from ..diagnostics import get_diagnostics, sys_info
@@ -126,11 +127,21 @@ def require_reader(connection_types, reader):
         readers = list_ccid(reader)
         if len(readers) == 1:
             dev = readers[0]
+            nfc_restricted = False
             try:
                 with dev.open_connection(SmartCardConnection) as conn:
-                    info = read_info(conn, dev.pid)
-                return dev, info
+                    try:
+                        info = read_info(conn, dev.pid)
+                        return dev, info
+                    except ValueError:
+                        nfc_restricted = is_nfc_restricted(conn)
+                        raise  # Re-raise to be handled in block below
             except Exception:
+                if nfc_restricted:
+                    raise CliFail(
+                        "YubiKey is in NFC restricted mode "
+                        "(see: https://www.yubico.com/getting-started/)."
+                    )
                 raise CliFail("Failed to connect to YubiKey.")
         elif len(readers) > 1:
             raise CliFail("Multiple external readers match name.")

ykman/util.py

@@ -26,6 +26,12 @@
 # POSSIBILITY OF SUCH DAMAGE.
 
 from yubikit.core import Tlv, int2bytes
+from yubikit.core.smartcard import (
+    SmartCardConnection,
+    SmartCardProtocol,
+    ApduError,
+    ApplicationNotAvailableError,
+)
 from cryptography.hazmat.primitives.serialization import pkcs12
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.backends import default_backend
@@ -192,3 +198,19 @@ def get_windows_version() -> Tuple[int, int, int]:
     osvi.dwOSVersionInfoSize = ctypes.sizeof(osvi)
     ctypes.windll.Ntdll.RtlGetVersion(ctypes.byref(osvi))  # type: ignore
     return osvi.dwMajorVersion, osvi.dwMinorVersion, osvi.dwBuildNumber
+
+
+_RESTRICTED_NDEF = bytes.fromhex("001FD1011B5504") + b"yubico.com/getting-started"
+
+
+def is_nfc_restricted(connection: SmartCardConnection) -> bool:
+    """Check if the given SmartCardConnection over NFC is in restricted NFC mode."""
+    try:
+        p = SmartCardProtocol(connection)
+        p.select(bytes.fromhex("D2760000850101"))
+        p.send_apdu(0x00, 0xA4, 0x00, 0x0C, bytes([0xE1, 0x04]))
+        ndef = p.send_apdu(0x00, 0xB0, 0x00, 0x00)
+    except (ApduError, ApplicationNotAvailableError):
+        ndef = None
+
+    return ndef == _RESTRICTED_NDEF