RDKB-63887 MFPConfig is not set to "Optional" on all secure vAPs using WPA2-Personal by default when FeatureMFPConfig is enabled.

[Sneha3821]

RDKB-63887 MFPConfig is not set to "Optional" on all secure vAPs using WPA2-Personal by default when FeatureMFPConfig is enabled.

Reason For Change: WPA2personal should have mfp as optional
Test Procedure:

1. load custom image
2. check mfp RFC is true
3. change the current security mode as wpa2-personal
4. check mfp for the specific VAP, it should be Optional
   dmcli eRT getv Device.WiFi.FeatureMFPConfig

dmcli eRT setv Device.WiFi.AccessPoint.1.Security.ModeEnabled string "WPA2-Personal"
dmcli eRT setv Device.WiFi.ApplyAccessPointSettings bool 1
dmcli eRT getv Device.WiFi.AccessPoint.1.Security.MFPConfig

Priority: P1
Risks: Low
Signed-off-by: Sneha Kannan , sneha_kannan@comcast.com

[Copilot]

Pull request overview

Updates default PMF/MFP handling so secure VAPs using WPA2-Personal default to MFP Optional (aligned with RDKB-63887) across multiple configuration/translation layers.

Changes:

• Set WPA2-Personal MFP default to Optional in OVSDB translation and multidoc webconfig decoding.
• Update TR-181 DML security mode handling so switching to WPA2-Personal sets MFP to Optional.
• Minor whitespace/formatting cleanups in webconfig encoder/decoder code.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
source/webconfig/wifi_ovsdb_translator.c	Makes WPA2-Personal map to wifi_mfp_cfg_optional in MFP inference logic.
source/webconfig/wifi_encoder.c	Minor formatting change at file end (#endif).
source/webconfig/wifi_decoder.c	Removes an extra blank line (no functional change).
source/dml/tr_181/ml/cosa_wifi_dml.c	Sets WPA2-Personal default MFP to Optional when changing ModeEnabled.
source/core/wifi_multidoc_webconfig.c	Defaults WPA2-Personal MFP to Optional and improves MFPConfig parsing/validation behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

source/core/wifi_multidoc_webconfig.c:501

• MFPConfig from the blob is now parsed for all VAPs and directly applied, but there is no follow-up validation that the resulting MFP setting is compatible with the selected security mode (e.g., WPA3-Personal/Enterprise and Enhanced-Open require PMF/MFP = Required; WPA3-Transition requires Optional; WPA3-Compatibility has band-dependent rules). This can allow invalid combinations to be accepted and later cause configuration failures. Add a mode-aware validation step after parsing MFPConfig (similar to the checks in source/webconfig/wifi_decoder.c for webconfig) and reject/override invalid values.

        if (!strcmp(value, "Disabled")) {
            vap_info->u.bss_info.security.mfp = wifi_mfp_cfg_disabled;
        } else if (!strcmp(value, "Optional")) {
            vap_info->u.bss_info.security.mfp = wifi_mfp_cfg_optional;
        } else if (!strcmp(value, "Required")) {
            vap_info->u.bss_info.security.mfp = wifi_mfp_cfg_required;
        } else {