WiFiService auto detects WPA(2) encryption type on Windows

components/wifi/wifi_service_win.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/wifi/wifi_service.h"
 
 #include <iphlpapi.h>
 #include <objbase.h>
 #include <wlanapi.h>
 
@@ skipping 17 matching lines @@
 const char kWiFiServiceErrorNotImplemented[] =
     "Error.WiFiService.NotImplemented";
 const wchar_t kNwCategoryWizardRegKey[] =
     L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Network\\"
     L"NwCategoryWizard";
 const wchar_t kNwCategoryWizardRegValue[] = L"Show";
 const wchar_t kNwCategoryWizardSavedRegValue[] = L"ShowSaved";
 const wchar_t kNwCategoryWizardDeleteRegValue[] = L"ShowDelete";
 const wchar_t kWlanApiDll[] = L"wlanapi.dll";
 
+// Created Profile Dictionary keys
+const char kProfileXmlKey[] = "xml";
+const char kProfileSharedKey[] = "shared";
+
 // WlanApi function names
 const char kWlanConnect[] = "WlanConnect";
 const char kWlanCloseHandle[] = "WlanCloseHandle";
+const char kWlanDeleteProfile[] = "WlanDeleteProfile";
 const char kWlanDisconnect[] = "WlanDisconnect";
 const char kWlanEnumInterfaces[] = "WlanEnumInterfaces";
 const char kWlanFreeMemory[] = "WlanFreeMemory";
 const char kWlanGetAvailableNetworkList[] = "WlanGetAvailableNetworkList";
 const char kWlanGetNetworkBssList[] = "WlanGetNetworkBssList";
 const char kWlanGetProfile[] = "WlanGetProfile";
 const char kWlanOpenHandle[] = "WlanOpenHandle";
 const char kWlanQueryInterface[] = "WlanQueryInterface";
 const char kWlanRegisterNotification[] = "WlanRegisterNotification";
 const char kWlanSaveTemporaryProfile[] = "WlanSaveTemporaryProfile";
 const char kWlanScan[] = "WlanScan";
 const char kWlanSetProfile[] = "WlanSetProfile";
 
 // WlanApi function definitions
 typedef DWORD (WINAPI* WlanConnectFunction)(
     HANDLE hClientHandle,
     CONST GUID *pInterfaceGuid,
     CONST PWLAN_CONNECTION_PARAMETERS pConnectionParameters,
     PVOID pReserved);
 
 typedef DWORD (WINAPI* WlanCloseHandleFunction)(
     HANDLE hClientHandle,
     PVOID pReserved);
 
+typedef DWORD (WINAPI* WlanDeleteProfileFunction)(
+    HANDLE hClientHandle,
+    const GUID *pInterfaceGuid,
+    LPCWSTR strProfileName,
+    PVOID pReserved);
+
 typedef DWORD (WINAPI* WlanDisconnectFunction)(
     HANDLE hClientHandle,
     CONST GUID *pInterfaceGuid,
     PVOID pReserved);
 
 typedef DWORD (WINAPI* WlanEnumInterfacesFunction)(
     HANDLE hClientHandle,
     PVOID pReserved,
     PWLAN_INTERFACE_INFO_LIST *ppInterfaceList);
 
@@ skipping 140 matching lines @@
                                 std::string* error) OVERRIDE;
 
   virtual void SetEventObservers(
       scoped_refptr<base::MessageLoopProxy> message_loop_proxy,
       const NetworkGuidListCallback& networks_changed_observer,
       const NetworkGuidListCallback& network_list_changed_observer) OVERRIDE;
 
   virtual void RequestConnectedNetworkUpdate() OVERRIDE {}
 
  private:
+  typedef int32 EncryptionType;
+  enum EncryptionTypeEnum {
+    kEncryptionTypeAny = 0,
+    kEncryptionTypeAES = 1,
+    kEncryptionTypeTKIP = 2
+  };
+
   // Static callback for Windows WLAN_NOTIFICATION. Calls OnWlanNotification
   // on WiFiServiceImpl passed back as |context|.
   static void __stdcall OnWlanNotificationCallback(
       PWLAN_NOTIFICATION_DATA wlan_notification_data,
       PVOID context);
 
   // Callback for Windows WLAN_NOTIFICATION. Called on random thread from
   // OnWlanNotificationCallback. Handles network connectivity and scan complete
   // notification and posts tasks to main thread.
   void OnWlanNotification(PWLAN_NOTIFICATION_DATA wlan_notification_data);
@@ skipping 71 matching lines @@
   }
 
   // Get unique |network_guid| string based on |wlan|.
   std::string GUIDFromWLAN(const WLAN_AVAILABLE_NETWORK& wlan) const {
     return SSIDFromWLAN(wlan);
   }
 
   // Deduce |onc::wifi| security from |alg|.
   std::string SecurityFromDot11AuthAlg(DOT11_AUTH_ALGORITHM alg) const;
 
+  // Convert |EncryptionType| into WPA(2) encryption type string.
+  std::string WpaEncryptionFromEncryptionType(
+      EncryptionType encryption_type) const;
+
   // Deduce WLANProfile |authEncryption| values from |onc::wifi| security.
   bool AuthEncryptionFromSecurity(const std::string& security,
+                                  EncryptionType encryption_type,
                                   std::string* authentication,
                                   std::string* encryption,
                                   std::string* key_type) const;
 
   // Populate |properties| based on |wlan| and its corresponding bss info from
   // |wlan_bss_list|.
   void NetworkPropertiesFromAvailableNetwork(const WLAN_AVAILABLE_NETWORK& wlan,
                                              const WLAN_BSS_LIST& wlan_bss_list,
                                              NetworkProperties* properties);
 
@@ skipping 23 matching lines @@
 
   // Get DOT11_BSSID_LIST of desired BSSIDs to connect to |ssid| network on
   // given |frequency|.
   DWORD GetDesiredBssList(DOT11_SSID& ssid,
                           Frequency frequency,
                           scoped_ptr<DOT11_BSSID_LIST>* desired_list);
 
   // Normalizes |frequency_in_mhz| into one of |Frequency| values.
   Frequency GetNormalizedFrequency(int frequency_in_mhz) const;
 
-  // Create |profile_xml| based on |network_properties|.
+  // Create |profile_xml| based on |network_properties|. If |encryption_type|
+  // is |kEncryptionTypeAny| applies the type most suitable for parameters in
+  // |network_properties|.
   bool CreateProfile(const NetworkProperties& network_properties,
+                     EncryptionType encryption_type,
                      std::string* profile_xml);
 
   // Save temporary wireless profile for |network_guid|.
   DWORD SaveTempProfile(const std::string& network_guid);
 
   // Get previously stored |profile_xml| for |network_guid|.
   // If |get_plaintext_key| is true, and process has sufficient privileges, then
   // <sharedKey> data in |profile_xml| will be unprotected.
   DWORD GetProfile(const std::string& network_guid,
                    bool get_plaintext_key,
                    std::string* profile_xml);
 
+  // Set |profile_xml| to current user or all users depending on |shared| flag.
+  // If |overwrite| is false, then returns an error if profile exists.
+  DWORD SetProfile(bool shared, const std::string& profile_xml, bool overwrite);
+
   // Return true if there is previously stored profile xml for |network_guid|.
   bool HaveProfile(const std::string& network_guid);
 
+  // Delete profile that was created, but failed to connect.
+  DWORD DeleteCreatedProfile(const std::string& network_guid);
+
   // Notify |network_list_changed_observer_| that list of visible networks has
   // changed to |networks|.
   void NotifyNetworkListChanged(const NetworkList& networks);
 
   // Notify |networks_changed_observer_| that network |network_guid| status has
   // changed.
   void NotifyNetworkChanged(const std::string& network_guid);
 
   // Load WlanApi.dll from SystemDirectory and get Api function pointers.
   DWORD LoadWlanLibrary();
   // Instance of WlanApi.dll.
   HINSTANCE wlan_api_library_;
   // WlanApi function pointers
   WlanConnectFunction WlanConnect_function_;
   WlanCloseHandleFunction WlanCloseHandle_function_;
+  WlanDeleteProfileFunction WlanDeleteProfile_function_;
   WlanDisconnectFunction WlanDisconnect_function_;
   WlanEnumInterfacesFunction WlanEnumInterfaces_function_;
   WlanFreeMemoryFunction WlanFreeMemory_function_;
   WlanGetAvailableNetworkListFunction WlanGetAvailableNetworkList_function_;
   // WlanGetNetworkBssList function may not be avaiable on Windows XP.
   WlanGetNetworkBssListFunction WlanGetNetworkBssList_function_;
   WlanGetProfileFunction WlanGetProfile_function_;
   WlanOpenHandleFunction WlanOpenHandle_function_;
   WlanQueryInterfaceFunction WlanQueryInterface_function_;
   WlanRegisterNotificationFunction WlanRegisterNotification_function_;
   WlanScanFunction WlanScan_function_;
   WlanSetProfileFunction WlanSetProfile_function_;
   // WlanSaveTemporaryProfile function may not be avaiable on Windows XP.
   WlanSaveTemporaryProfileFunction WlanSaveTemporaryProfile_function_;
 
   // WLAN service handle.
   HANDLE client_;
   // GUID of the currently connected interface, if any, otherwise the GUID of
   // one of the WLAN interfaces.
   GUID interface_guid_;
   // Temporary storage of network properties indexed by |network_guid|. Persist
   // only in memory.
   base::DictionaryValue connect_properties_;
   // Preserved WLAN profile xml.
   std::map<std::string, std::string> saved_profiles_xml_;
+  // Created WLAN Profiles, indexed by |network_guid|. Contains xml with TKIP
+  // encryption type saved by |CreateNetwork| if applicable. Profile has to be
+  // deleted if connection fails. Implicitly created profiles have to be deleted
+  // if connection succeeds. Persist only in memory.
+  base::DictionaryValue created_profiles_;
   // Observer to get notified when network(s) have changed (e.g. connect).
   NetworkGuidListCallback networks_changed_observer_;
   // Observer to get notified when network list has changed (scan complete).
   NetworkGuidListCallback network_list_changed_observer_;
   // Saved value of network location wizard show value.
   scoped_ptr<DWORD> saved_nw_category_wizard_;
   // MessageLoopProxy to post events on UI thread.
   scoped_refptr<base::MessageLoopProxy> message_loop_proxy_;
   // Task runner for worker tasks.
   scoped_refptr<base::SequencedTaskRunner> task_runner_;
   // If |false|, then |networks_changed_observer_| is not notified.
   bool enable_notify_network_changed_;
   // Number of attempts to check that network has connected successfully.
   static const int kMaxAttempts = 100;
   // Delay between attempts to check that network has connected successfully.
   static const int kAttemptDelayMs = 100;
   DISALLOW_COPY_AND_ASSIGN(WiFiServiceImpl);
 };
 
 WiFiServiceImpl::WiFiServiceImpl()
     : wlan_api_library_(NULL),
       WlanConnect_function_(NULL),
       WlanCloseHandle_function_(NULL),
+      WlanDeleteProfile_function_(NULL),
       WlanDisconnect_function_(NULL),
       WlanEnumInterfaces_function_(NULL),
       WlanFreeMemory_function_(NULL),
       WlanGetAvailableNetworkList_function_(NULL),
       WlanGetNetworkBssList_function_(NULL),
       WlanGetProfile_function_(NULL),
       WlanOpenHandle_function_(NULL),
       WlanRegisterNotification_function_(NULL),
       WlanSaveTemporaryProfile_function_(NULL),
       WlanScan_function_(NULL),
@@ skipping 78 matching lines @@
     return;
 
   WiFiService::NetworkProperties network_properties;
   if (!network_properties.UpdateFromValue(*properties)) {
     CheckError(ERROR_INVALID_DATA, kWiFiServiceError, error);
     return;
   }
 
   network_properties.guid = network_properties.ssid;
   std::string profile_xml;
-  if (!CreateProfile(network_properties, &profile_xml)) {
+  if (!CreateProfile(network_properties, kEncryptionTypeAny, &profile_xml)) {
     CheckError(ERROR_INVALID_DATA, kWiFiServiceError, error);
     return;
   }
 
-  base::string16 profile_xml16(base::UTF8ToUTF16(profile_xml));
-  DWORD reason_code = 0u;
-
-  error_code = WlanSetProfile_function_(client_,
-                                        &interface_guid_,
-                                        shared ? 0 : WLAN_PROFILE_USER,
-                                        profile_xml16.c_str(),
-                                        NULL,
-                                        FALSE,
-                                        NULL,
-                                        &reason_code);
+  error_code = SetProfile(shared, profile_xml, false);
   if (CheckError(error_code, kWiFiServiceError, error)) {
     DVLOG(0) << profile_xml;
-    DVLOG(0) << "SetProfile Reason Code:" << reason_code;
     return;
   }
 
+  // WAP and WAP2 networks could use either AES or TKIP encryption type.
+  // Preserve alternative profile to use in case if connection with default
+  // encryption type fails.
+  std::string tkip_profile_xml;
+  if (!CreateProfile(network_properties,
+                     kEncryptionTypeTKIP,
+                     &tkip_profile_xml)) {
+    CheckError(ERROR_INVALID_DATA, kWiFiServiceError, error);
+    return;
+  }
+
+  if (tkip_profile_xml != profile_xml) {
+    scoped_ptr<base::DictionaryValue> tkip_profile(new base::DictionaryValue());
+    tkip_profile->SetString(kProfileXmlKey, tkip_profile_xml);
+    tkip_profile->SetBoolean(kProfileSharedKey, shared);
+    created_profiles_.SetWithoutPathExpansion(network_properties.guid,
+                                              tkip_profile.release());
+  }
+
   *network_guid = network_properties.guid;
 }
 
 void WiFiServiceImpl::GetVisibleNetworks(const std::string& network_type,
                                          base::ListValue* network_list) {
   if (!network_type.empty() &&
       network_type != onc::network_type::kAllTypes &&
       network_type != onc::network_type::kWiFi) {
     return;
   }
@@ skipping 201 matching lines @@
   // Get current list of visible networks and notify that network list has
   // changed.
   DWORD error = GetVisibleNetworkList(&networks);
   DCHECK(error == ERROR_SUCCESS);
   if (error == ERROR_SUCCESS)
     NotifyNetworkListChanged(networks);
 }
 
 void WiFiServiceImpl::WaitForNetworkConnect(const std::string& network_guid,
                                             int attempt) {
-  // If network didn't get connected in |kMaxAttempts|, then restore automatic
-  // network change notifications and stop waiting.
+  // If network didn't get connected in |kMaxAttempts|, then try to connect
+  // using different profile if it was created recently.
   if (attempt > kMaxAttempts) {
-    DLOG(ERROR) << kMaxAttempts << " attempts exceeded waiting for connect to "
-                << network_guid;
+    LOG(ERROR) << kMaxAttempts << " attempts exceeded waiting for connect to "
+               << network_guid;
+
+    base::DictionaryValue* created_profile = NULL;
+    // Check, whether this connection is using newly created profile.
+    if (created_profiles_.GetDictionaryWithoutPathExpansion(
+        network_guid, &created_profile)) {
+      std::string tkip_profile_xml;
+      bool shared = false;
+      // Check, if this connection there is alternative TKIP profile xml that
+      // should be tried. If there is, then set it up and try to connect again.
+      if (created_profile->GetString(kProfileXmlKey, &tkip_profile_xml) &&
+          created_profile->GetBoolean(kProfileSharedKey, &shared)) {
+        // Remove TKIP profile xml, so it will not be tried again.
+        created_profile->Remove(kProfileXmlKey, NULL);
+        created_profile->Remove(kProfileSharedKey, NULL);
+        DWORD error_code = SetProfile(shared, tkip_profile_xml, true);
+        if (error_code == ERROR_SUCCESS) {
+          // Try to connect with new profile.
+          error_code = Connect(network_guid,
+                               GetFrequencyToConnect(network_guid));
+          if (error_code == ERROR_SUCCESS) {
+            // Start waiting again.
+            WaitForNetworkConnect(network_guid, 0);
+            return;
+          } else {
+            LOG(ERROR) << "Failed to set created profile for " << network_guid
+                       << " error=" << error_code;
+          }
+        }
+      } else {
+        // Connection has failed, so delete bad created profile.
+        DWORD error_code = DeleteCreatedProfile(network_guid);
+        if (error_code != ERROR_SUCCESS) {
+          LOG(ERROR) << "Failed to delete created profile for " << network_guid
+                     << " error=" << error_code;
+        }
+      }
+    }
+    // Restore automatic network change notifications and stop waiting.
     enable_notify_network_changed_ = true;
     RestoreNwCategoryWizard();
     return;
   }
   std::string connected_network_guid;
   DWORD error = FindConnectedNetwork(&connected_network_guid);
   if (network_guid == connected_network_guid) {
     DVLOG(1) << "WiFi Connected, Reset DHCP: " << network_guid;
     // Even though wireless network is now connected, it may still be unusable,
     // e.g. after Chromecast device reset. Reset DHCP on wireless network to
     // work around this issue.
     error = ResetDHCP();
+    // There is no need to keep created profile as network is connected.
+    created_profiles_.RemoveWithoutPathExpansion(network_guid, NULL);
     // Restore previously suppressed notifications.
     enable_notify_network_changed_ = true;
     RestoreNwCategoryWizard();
     NotifyNetworkChanged(network_guid);
   } else {
     // Continue waiting for network connection state change.
     task_runner_->PostDelayedTask(
         FROM_HERE,
         base::Bind(&WiFiServiceImpl::WaitForNetworkConnect,
                    base::Unretained(this),
@@ skipping 61 matching lines @@
     return ERROR_NOT_FOUND;
   }
 
   // Initialize WlanApi function pointers
   WlanConnect_function_ =
       reinterpret_cast<WlanConnectFunction>(
           ::GetProcAddress(wlan_api_library_, kWlanConnect));
   WlanCloseHandle_function_ =
       reinterpret_cast<WlanCloseHandleFunction>(
           ::GetProcAddress(wlan_api_library_, kWlanCloseHandle));
+  WlanDeleteProfile_function_ =
+      reinterpret_cast<WlanDeleteProfileFunction>(
+          ::GetProcAddress(wlan_api_library_, kWlanDeleteProfile));
   WlanDisconnect_function_ =
       reinterpret_cast<WlanDisconnectFunction>(
           ::GetProcAddress(wlan_api_library_, kWlanDisconnect));
   WlanEnumInterfaces_function_ =
       reinterpret_cast<WlanEnumInterfacesFunction>(
           ::GetProcAddress(wlan_api_library_, kWlanEnumInterfaces));
   WlanFreeMemory_function_ =
       reinterpret_cast<WlanFreeMemoryFunction>(
           ::GetProcAddress(wlan_api_library_, kWlanFreeMemory));
   WlanGetAvailableNetworkList_function_ =
@@ skipping 19 matching lines @@
           ::GetProcAddress(wlan_api_library_, kWlanSaveTemporaryProfile));
   WlanScan_function_ =
       reinterpret_cast<WlanScanFunction>(
           ::GetProcAddress(wlan_api_library_, kWlanScan));
   WlanSetProfile_function_ =
       reinterpret_cast<WlanSetProfileFunction>(
           ::GetProcAddress(wlan_api_library_, kWlanSetProfile));
 
   if (!WlanConnect_function_ ||
       !WlanCloseHandle_function_ ||
+      !WlanDeleteProfile_function_ ||
       !WlanDisconnect_function_ ||
       !WlanEnumInterfaces_function_ ||
       !WlanFreeMemory_function_ ||
       !WlanGetAvailableNetworkList_function_ ||
       !WlanGetProfile_function_ ||
       !WlanOpenHandle_function_ ||
       !WlanQueryInterface_function_ ||
       !WlanRegisterNotification_function_ ||
       !WlanScan_function_ ||
       !WlanSetProfile_function_) {
@@ skipping 152 matching lines @@
 
 DWORD WiFiServiceImpl::CloseClientHandle() {
   DWORD error = ERROR_SUCCESS;
   if (client_ != NULL) {
     error = WlanCloseHandle_function_(client_, NULL);
     client_ = NULL;
   }
   if (wlan_api_library_ != NULL) {
     WlanConnect_function_ = NULL;
     WlanCloseHandle_function_ = NULL;
+    WlanDeleteProfile_function_ = NULL;
     WlanDisconnect_function_ = NULL;
     WlanEnumInterfaces_function_ = NULL;
     WlanFreeMemory_function_ = NULL;
     WlanGetAvailableNetworkList_function_ = NULL;
     WlanGetNetworkBssList_function_ = NULL;
     WlanGetProfile_function_ = NULL;
     WlanOpenHandle_function_ = NULL;
     WlanRegisterNotification_function_ = NULL;
     WlanSaveTemporaryProfile_function_ = NULL;
     WlanScan_function_ = NULL;
@@ skipping 359 matching lines @@
       WLAN_CONNECTION_PARAMETERS wlan_params = {
           wlan_connection_mode_profile,
           profile_name.c_str(),
           NULL,
           desired_bss_list.get(),
           dot11_BSS_type_any,
           0};
       error = WlanConnect_function_(
           client_, &interface_guid_, &wlan_params, NULL);
     } else {
-      // TODO(mef): wlan_connection_mode_discovery_unsecure is not available on
-      // XP. If XP support is needed, then temporary profile will have to be
-      // created.
       WLAN_CONNECTION_PARAMETERS wlan_params = {
           wlan_connection_mode_discovery_unsecure,
           NULL,
           &ssid,
           desired_bss_list.get(),
           dot11_BSS_type_infrastructure,
           0};
       error = WlanConnect_function_(
           client_, &interface_guid_, &wlan_params, NULL);
     }
@@ skipping 62 matching lines @@
     *profile_xml = base::UTF16ToUTF8(str_profile_xml);
   }
   // Clean up.
   if (str_profile_xml != NULL) {
     WlanFreeMemory_function_(str_profile_xml);
   }
 
   return error;
 }
 
+DWORD WiFiServiceImpl::SetProfile(bool shared,
+                                  const std::string& profile_xml,
+                                  bool overwrite) {
+  DWORD error_code = ERROR_SUCCESS;
+
+  base::string16 profile_xml16(base::UTF8ToUTF16(profile_xml));
+  DWORD reason_code = 0u;
+
+  error_code = WlanSetProfile_function_(client_,
+                                        &interface_guid_,
+                                        shared ? 0 : WLAN_PROFILE_USER,
+                                        profile_xml16.c_str(),
+                                        NULL,
+                                        overwrite,
+                                        NULL,
+                                        &reason_code);
+  return error_code;
+}
+
 bool WiFiServiceImpl::HaveProfile(const std::string& network_guid) {
   DWORD error = ERROR_SUCCESS;
   std::string profile_xml;
   return GetProfile(network_guid, false, &profile_xml) == ERROR_SUCCESS;
 }
 
+
+DWORD WiFiServiceImpl::DeleteCreatedProfile(const std::string& network_guid) {
+  base::DictionaryValue* created_profile = NULL;
+  DWORD error_code = ERROR_SUCCESS;
+  // Check, whether this connection is using new created profile, and remove it.
+  if (created_profiles_.GetDictionaryWithoutPathExpansion(
+      network_guid, &created_profile)) {
+    // Connection has failed, so delete it.
+    base::string16 profile_name = ProfileNameFromGUID(network_guid);
+    error_code = WlanDeleteProfile_function_(client_,
+                                              &interface_guid_,
+                                              profile_name.c_str(),
+                                              NULL);
+    created_profiles_.RemoveWithoutPathExpansion(network_guid, NULL);
+  }
+  return error_code;
+}
+
+std::string WiFiServiceImpl::WpaEncryptionFromEncryptionType(
+    EncryptionType encryption_type) const {
+  if (encryption_type == kEncryptionTypeTKIP)
+    return kEncryptionTKIP;
+  return kEncryptionAES;
+}
+
 bool WiFiServiceImpl::AuthEncryptionFromSecurity(
     const std::string& security,
+    EncryptionType encryption_type,
     std::string* authentication,
     std::string* encryption,
     std::string* key_type) const {
   if (security == onc::wifi::kNone) {
     *authentication = kAuthenticationOpen;
     *encryption = kEncryptionNone;
   } else if (security == onc::wifi::kWEP_PSK) {
     *authentication = kAuthenticationOpen;
     *encryption = kEncryptionWEP;
     *key_type = kKeyTypeNetwork;
   } else if (security == onc::wifi::kWPA_PSK) {
     *authentication = kAuthenticationWpaPsk;
-    // TODO(mef): WAP |encryption| could be either |AES| or |TKIP|. It has to be
-    // determined and adjusted properly during |Connect|.
-    *encryption = kEncryptionAES;
+    *encryption = WpaEncryptionFromEncryptionType(encryption_type);
     *key_type = kKeyTypePassphrase;
   } else if (security == onc::wifi::kWPA2_PSK) {
     *authentication = kAuthenticationWpa2Psk;
-    // TODO(mef): WAP |encryption| could be either |AES| or |TKIP|. It has to be
-    // determined and adjusted properly during |Connect|.
-    *encryption = kEncryptionAES;
+    *encryption = WpaEncryptionFromEncryptionType(encryption_type);
     *key_type = kKeyTypePassphrase;
   } else {
     return false;
   }
   return true;
 }
 
 bool WiFiServiceImpl::CreateProfile(
     const NetworkProperties& network_properties,
+    EncryptionType encryption_type,
     std::string* profile_xml) {
   // Get authentication and encryption values from security.
   std::string authentication;
   std::string encryption;
   std::string key_type;
   bool valid = AuthEncryptionFromSecurity(network_properties.security,
+                                          encryption_type,
                                           &authentication,
                                           &encryption,
                                           &key_type);
   if (!valid)
     return valid;
 
   // Generate profile XML.
   XmlWriter xml_writer;
   xml_writer.StartWriting();
   xml_writer.StartElement("WLANProfile");
@@ skipping 53 matching lines @@
     NetworkGuidList changed_networks(1, network_guid);
     message_loop_proxy_->PostTask(
         FROM_HERE,
         base::Bind(networks_changed_observer_, changed_networks));
   }
 }
 
 WiFiService* WiFiService::Create() { return new WiFiServiceImpl(); }
 
 }  // namespace wifi