Skip to content

RDKB-64957: Observed WPA2-Personal security mode configuration failure #1308

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SakeVictorDaniel wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

RDKB-64957: Observed WPA2-Personal security mode configuration failure #1308

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions source/core/wifi_ctrl_queue_handlers.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2761,6 +2761,8 @@ void process_wpa3_rfc(bool type)
vapInfo->u.bss_info.security.wpa3_transition_disable = false;
vapInfo->u.bss_info.security.mfp = wifi_mfp_cfg_optional;
vapInfo->u.bss_info.security.u.key.type = wifi_security_key_type_psk_sae;
/* When WPA3 RFC enables transition mode, restore transition encryption policy. */
apply_wpa3_transition_encr_policy(&vapInfo->u.bss_info.security);
} else {
if (vapInfo->u.bss_info.security.mode == wifi_security_mode_wpa2_personal) {
continue;
Expand All @@ -2769,6 +2771,8 @@ void process_wpa3_rfc(bool type)
if ((radio_params->band == WIFI_FREQUENCY_2_4_BAND) || (radio_params->band == WIFI_FREQUENCY_5_BAND) ||
(radio_params->band == WIFI_FREQUENCY_5L_BAND) || (radio_params->band == WIFI_FREQUENCY_5H_BAND)) {
vapInfo->u.bss_info.security.mode = wifi_security_mode_wpa2_personal;
/* RFC disable should not leave WPA2 with invalid encryption. */
apply_wpa2_personal_encr_policy(&vapInfo->u.bss_info.security);
}
}

Expand Down Expand Up @@ -4299,13 +4303,17 @@ void process_rsn_override_rfc(bool type)
(radio_params->band == WIFI_FREQUENCY_5L_BAND) || (radio_params->band == WIFI_FREQUENCY_5H_BAND)) {
vapInfo->u.bss_info.security.mode = wifi_security_mode_wpa2_personal;
vapInfo->u.bss_info.security.mfp = wifi_mfp_cfg_disabled;
/* RFC disable should not leave WPA2 with invalid encryption. */
apply_wpa2_personal_encr_policy(&vapInfo->u.bss_info.security);
}

if(rfc_param->wpa3_rfc) {
vapInfo->u.bss_info.security.mode = wifi_security_mode_wpa3_transition;
vapInfo->u.bss_info.security.wpa3_transition_disable = false;
vapInfo->u.bss_info.security.mfp = wifi_mfp_cfg_optional;
vapInfo->u.bss_info.security.u.key.type = wifi_security_key_type_psk_sae;
/* When RSN override re-enables WPA3 transition, restore its encryption policy. */
apply_wpa3_transition_encr_policy(&vapInfo->u.bss_info.security);
}
#if defined(CONFIG_IEEE80211BE)
if (radio_params->band == WIFI_FREQUENCY_6_BAND) {
Expand Down
5 changes: 4 additions & 1 deletion source/dml/tr_181/ml/cosa_wifi_dml.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9298,7 +9298,8 @@ Security_SetParamStringValue
case wifi_security_mode_wpa2_personal:
l_security_cfg->u.key.type = wifi_security_key_type_psk;
l_security_cfg->mfp = wifi_mfp_cfg_optional;
wpa2_personal_gcmp_fallback_to_aes(l_security_cfg);
/* Preserve AES/AES+TKIP and normalize invalid carry-over values. */
apply_wpa2_personal_encr_policy(l_security_cfg);
Comment on lines +9301 to +9302
break;
case wifi_security_mode_wpa_wpa2_personal:
l_security_cfg->u.key.type = wifi_security_key_type_psk;
Expand All @@ -9319,6 +9320,8 @@ Security_SetParamStringValue
case wifi_security_mode_wpa3_transition:
l_security_cfg->u.key.type = wifi_security_key_type_psk_sae;
l_security_cfg->mfp = wifi_mfp_cfg_optional;
/* Restore platform default encryption when switching back to WPA3-Transition. */
apply_wpa3_transition_encr_policy(l_security_cfg);
break;
case wifi_security_mode_enhanced_open:
l_security_cfg->mfp = wifi_mfp_cfg_required;
Expand Down
31 changes: 27 additions & 4 deletions source/utils/wifi_util.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4959,19 +4959,42 @@ bool is_valid_encr_for_mode(wifi_security_modes_t mode, wifi_encryption_method_t
return (valid_mask & (1u << encr)) != 0;
}

void wpa2_personal_gcmp_fallback_to_aes(wifi_vap_security_t *security_info)
void apply_wpa2_personal_encr_policy(wifi_vap_security_t *security_info)
{
if (security_info == NULL) {
if (security_info == NULL || security_info->mode != wifi_security_mode_wpa2_personal) {
return;
}

if (security_info->mode == wifi_security_mode_wpa2_personal &&
security_info->encr == wifi_encryption_aes_gcmp256) {
if (security_info->encr == wifi_encryption_aes_gcmp256) {
wifi_util_info_print(WIFI_WEBCONFIG,
"%s:%d enforcing WPA2-Personal encryption fallback AES+GCMP(%d)->AES(%d)\n",
__func__, __LINE__, wifi_encryption_aes_gcmp256, wifi_encryption_aes);
security_info->encr = wifi_encryption_aes;
return;
}

/* Preserve valid WPA2 encryptions (AES, AES+TKIP); normalize anything else to AES. */
if (security_info->encr != wifi_encryption_aes &&
security_info->encr != wifi_encryption_aes_tkip) {
wifi_util_info_print(WIFI_WEBCONFIG,
"%s:%d enforcing WPA2-Personal encryption fallback invalid(%d)->AES(%d)\n",
__func__, __LINE__, security_info->encr, wifi_encryption_aes);
security_info->encr = wifi_encryption_aes;
}
}

void apply_wpa3_transition_encr_policy(wifi_vap_security_t *security_info)
{
if (security_info == NULL || security_info->mode != wifi_security_mode_wpa3_transition) {
return;
}

#ifdef CONFIG_IEEE80211BE
/* 11be builds use AES+GCMP as the policy default for WPA3-Transition. */
security_info->encr = wifi_encryption_aes_gcmp256;
#else
security_info->encr = wifi_encryption_aes;
#endif /* CONFIG_IEEE80211BE */
}

int get_mesh_sta_mac_address_for_radio(wifi_platform_property_t *wifi_prop, unsigned int radio_index, mac_address_t mac)
Expand Down
3 changes: 2 additions & 1 deletion source/utils/wifi_util.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -486,7 +486,8 @@ int interfacename_from_mac(const mac_address_t *mac, char *ifname);
int mac_address_from_name(const char *ifname, mac_address_t mac);
bool is_zero_mac(const uint8_t *mac);
bool is_valid_encr_for_mode(wifi_security_modes_t mode, wifi_encryption_method_t encr);
void wpa2_personal_gcmp_fallback_to_aes(wifi_vap_security_t *security_info);
void apply_wpa2_personal_encr_policy(wifi_vap_security_t *security_info);
void apply_wpa3_transition_encr_policy(wifi_vap_security_t *security_info);
int get_mesh_sta_mac_address_for_radio(wifi_platform_property_t *wifi_prop, unsigned int radio_index, mac_address_t mac);
#ifdef __cplusplus
}
Expand Down
8 changes: 7 additions & 1 deletion source/webconfig/wifi_decoder.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1523,7 +1523,13 @@ webconfig_error_t decode_security_object(const cJSON *security, wifi_vap_securit
return webconfig_error_decode;
}

wpa2_personal_gcmp_fallback_to_aes(security_info);
/* Normalize mode/encryption pairs before compatibility validation. */
if (security_info->mode == wifi_security_mode_wpa3_transition) {
apply_wpa3_transition_encr_policy(security_info);
}
if (security_info->mode == wifi_security_mode_wpa2_personal) {
apply_wpa2_personal_encr_policy(security_info);
}

if (!is_valid_encr_for_mode(security_info->mode, security_info->encr)) {
wifi_util_error_print(WIFI_WEBCONFIG, "%s:%d invalid encryption %d for mode %d\n",
Expand Down
Loading