RDKB-64957: Observed WPA2-Personal security mode configuration failure - #1308
Open
SakeVictorDaniel wants to merge 1 commit into
Open
RDKB-64957: Observed WPA2-Personal security mode configuration failure#1308SakeVictorDaniel wants to merge 1 commit into
SakeVictorDaniel wants to merge 1 commit into
Conversation
Reason for change: On CONFIG_IEEE80211BE platforms, default private VAP security is WPA3-Personal-Transition with AES+GCMP. When mode is switched to WPA2-Personal, encryption may remain AES+GCMP from previous state. WPA2-Personal supports AES and AES+TKIP, so WPA2-Personal plus AES+GCMP becomes invalid and can fail with invalid encryption for mode. What is changed: 1. Added WPA2 encryption policy normalization to downgrade WPA2-Personal plus AES+GCMP to AES. 2. Preserved valid WPA2 encryptions (AES and AES+TKIP) as is. 3. Added WPA3-Transition encryption policy normalization so transition mode restores platform-expected encryption. 4. Applied normalization across all control paths: --> TR-181 handling --> WebConfig decode path --> WPA3 & RSN Override RFC Disable path Risk: Low Priority: P1 Signed-off-by: Sake Victor Daniel <VictorDaniel_Sake@comcast.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses invalid mode/encryption carry-over when switching security modes (notably on CONFIG_IEEE80211BE platforms), by normalizing encryption selections for WPA2-Personal and WPA3-Transition across the main configuration/control paths.
Changes:
- Introduces WPA2-Personal encryption normalization (downgrade AES+GCMP to AES; keep AES / AES+TKIP; coerce other values to AES).
- Introduces WPA3-Transition encryption normalization to restore platform-default encryption (AES+GCMP on 11be, AES otherwise).
- Applies the normalization consistently in TR-181 handling, WebConfig decode, and RFC enable/disable handlers; renames the prior WPA2-only helper to policy-oriented helpers.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| source/webconfig/wifi_decoder.c | Normalizes mode/encryption pairs before validating compatibility during WebConfig decode. |
| source/utils/wifi_util.h | Replaces the old WPA2 GCMP fallback prototype with two policy helper APIs (WPA2-Personal, WPA3-Transition). |
| source/utils/wifi_util.c | Implements the WPA2-Personal and WPA3-Transition encryption policy normalization helpers. |
| source/dml/tr_181/ml/cosa_wifi_dml.c | Applies the new normalization helpers when TR-181 sets WPA2-Personal / WPA3-Transition. |
| source/core/wifi_ctrl_queue_handlers.c | Applies normalization when RFCs toggle WPA3 transition / RSN override paths to avoid invalid encryption leftovers. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+9301
to
+9302
| /* Preserve AES/AES+TKIP and normalize invalid carry-over values. */ | ||
| apply_wpa2_personal_encr_policy(l_security_cfg); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reason for change:
On CONFIG_IEEE80211BE platforms, default private VAP security is WPA3-Personal-Transition with AES+GCMP. When mode is switched to WPA2-Personal, encryption may remain AES+GCMP from previous state. WPA2-Personal supports AES and AES+TKIP, so WPA2-Personal plus AES+GCMP becomes invalid and can fail with invalid encryption for mode.
What is changed:
Risk:
Low
Priority:
P1