RDKB-64957 : Observed WPA2_Personal security mode configuration is fa…

[SakeVictorDaniel]

RDKB-64957 : Observed WPA2_Personal security mode configuration is failing

Reason for Change:

On platforms with CONFIG_IEEE80211BE enabled, default security mode is WPA3-Personal-Transition with AES+GCMP as its default encryption method. When the security mode is changed to WPA2-Personal, the default AES+GCMP (GCMP is WPA3-era cipher) encryption mode is not valid for WPA2-Personal as it only supports AES and AES+TKIP. This causes WPA2_Personal security mode configuration to fail with "invalid encryption for mode" error.

Added wpa2_personal_gcmp_fallback_to_aes helper to detect and downgrade AES+GCMP to AES when mode is WPA2-Personal. wpa2_personal_gcmp_fallback_to_aes is called at both TR-181 & Webconfig path as the configuration can come from either TR-181 or Webconfig.

AES+TKIP is left as-is since it works fine with WPA2-Personal.

Risks: Low
Priority: P1

[Copilot]

Pull request overview

This PR addresses WPA2-Personal configuration failures on CONFIG_IEEE80211BE platforms by downgrading an invalid WPA3-era cipher (AES+GCMP) to AES when a WPA2-Personal mode is selected, preventing “invalid encryption for mode” validation failures.

Changes:

• Added wpa2_personal_gcmp_fallback_to_aes() helper to force AES when mode is WPA2-Personal and encryption is AES+GCMP.
• Invoked the helper in the Webconfig decode path before encryption/mode validation.
• Invoked the helper in the TR-181 security-mode set path for WPA2-Personal.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
source/webconfig/wifi_decoder.c	Applies WPA2-Personal AES+GCMP→AES fallback before validating encryption/mode.
source/utils/wifi_util.h	Exposes the new fallback helper via the utils header.
source/utils/wifi_util.c	Implements the fallback helper to rewrite invalid AES+GCMP for WPA2-Personal.
source/dml/tr_181/ml/cosa_wifi_dml.c	Applies fallback when switching security mode via TR-181 setter.

Comments suppressed due to low confidence (1)

source/dml/tr_181/ml/cosa_wifi_dml.c:9326

• The GCMP->AES fallback is applied for wifi_security_mode_wpa2_personal, but wifi_security_mode_wpa_wpa2_personal has the same cipher restrictions in is_valid_encr_for_mode(). Adding the fallback here prevents failures when only the mode is changed (encryption left at the previous AES+GCMP default).

            case wifi_security_mode_wpa_wpa2_personal:
				l_security_cfg->u.key.type = wifi_security_key_type_psk;
                l_security_cfg->mfp = wifi_mfp_cfg_disabled;
                break;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.