shill: wifi: disallow configuring Security property

All users configure security via SecurityClass, and we don't have any
meaning ascribed to doing anything different. For instance, if one were
to supply Security="rsn", we would save that value, but we wouldn't
treat the network any different -- we still would support connecting to
either WPA or RSN (WPA2) networks.

Remove this ambiguity by simply disallowing "Security" in
ConfigureService, ConfigureServiceForProfile, and FindMatchingService.
We can revisit if we ever have a UI story around differentiating PSK
variants.

I'd like to CHECK() this in the WiFiService constructor soon, to be more
robust about this, but that requires a lot more modifications to the
unit tests (coming soon).

BUG=b:157935328
TEST=unit tests; UI still can configure both hidden and visible PSK
     networks; various network/WiFi Autotests and Tast tests

Change-Id: Ibadb766be8b241f435c8610b4392b93a154bc88f
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform2/+/2238459
Tested-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Steven Bennetts <stevenjb@chromium.org>
Commit-Queue: Brian Norris <briannorris@chromium.org>
diff --git a/shill/doc/manager-api.txt b/shill/doc/manager-api.txt
index dedfbe1..dd6bb86 100644
--- a/shill/doc/manager-api.txt
+++ b/shill/doc/manager-api.txt
@@ -166,7 +166,7 @@
 
 			If a GUID property is specified in properties
 			it is used to find the service; otherwise Type,
-			Security, and type-specific properties such as
+			SecurityClass, and type-specific properties such as
 			WiFi.SSID are used to find any existing service.
 			If no service is located in memory a new one is
 			created with the supplied properties.
@@ -196,7 +196,7 @@
 			current service.  A matching service is found
 			by first looking for a service with matching
 			"GUID" property if specified, then by using
-			the "Mode", "SSID", and "Security" properties
+			the "Mode", "SSID", and "SecurityClass" properties
 			from |properties|.
 
 			If a matching service is found but its current
diff --git a/shill/manager_test.cc b/shill/manager_test.cc
index 0578ae4..62bedf6 100644
--- a/shill/manager_test.cc
+++ b/shill/manager_test.cc
@@ -1597,7 +1597,7 @@
 
   const vector<uint8_t> ssid;
   scoped_refptr<MockWiFiService> service(new NiceMock<MockWiFiService>(
-      manager(), wifi_provider_, ssid, "", "", false));
+      manager(), wifi_provider_, ssid, "", kSecurityNone, false));
 
   manager()->RegisterService(service);
   service->set_profile(GetEphemeralProfile(manager()));
@@ -1635,7 +1635,7 @@
 
   const vector<uint8_t> ssid;
   scoped_refptr<MockWiFiService> service(new NiceMock<MockWiFiService>(
-      manager(), wifi_provider_, ssid, "", "", false));
+      manager(), wifi_provider_, ssid, "", kSecurityNone, false));
 
   manager()->RegisterService(service);
   service->set_profile(profile1);
@@ -1674,7 +1674,7 @@
 
   const vector<uint8_t> ssid;
   scoped_refptr<MockWiFiService> service(new NiceMock<MockWiFiService>(
-      manager(), wifi_provider_, ssid, "", "", false));
+      manager(), wifi_provider_, ssid, "", kSecurityNone, false));
 
   manager()->RegisterService(service);
   service->set_profile(profile0);
@@ -1713,7 +1713,7 @@
 
   const vector<uint8_t> ssid;
   scoped_refptr<MockWiFiService> service(new NiceMock<MockWiFiService>(
-      manager(), wifi_provider_, ssid, "", "", false));
+      manager(), wifi_provider_, ssid, "", kSecurityNone, false));
 
   service->set_profile(profile1);
 
diff --git a/shill/wifi/wifi_provider.cc b/shill/wifi/wifi_provider.cc
index 3cab91f..72720dd 100644
--- a/shill/wifi/wifi_provider.cc
+++ b/shill/wifi/wifi_provider.cc
@@ -61,22 +61,18 @@
 const char kManagerErrorSSIDTooShort[] = "SSID is too short";
 const char kManagerErrorUnsupportedSecurityClass[] =
     "security class is unsupported";
-const char kManagerErrorUnsupportedSecurityMode[] =
-    "security mode is unsupported";
 const char kManagerErrorUnsupportedServiceMode[] =
     "service mode is unsupported";
-const char kManagerErrorArgumentConflict[] =
-    "provided arguments are inconsistent";
 
 // Retrieve a WiFi service's identifying properties from passed-in |args|.
 // Returns true if |args| are valid and populates |ssid|, |mode|,
-// |security| and |hidden_ssid|, if successful.  Otherwise, this function
+// |security_class| and |hidden_ssid|, if successful.  Otherwise, this function
 // returns false and populates |error| with the reason for failure.  It
 // is a fatal error if the "Type" parameter passed in |args| is not kWiFi.
 bool GetServiceParametersFromArgs(const KeyValueStore& args,
                                   vector<uint8_t>* ssid_bytes,
                                   string* mode,
-                                  string* security_method,
+                                  string* security_class,
                                   bool* hidden_ssid,
                                   Error* error) {
   CHECK_EQ(args.Lookup<string>(kTypeProperty, ""), kTypeWifi);
@@ -117,16 +113,13 @@
     return false;
   }
 
-  const string kDefaultSecurity = kSecurityNone;
-  if (args.Contains<string>(kSecurityProperty) &&
-      args.Contains<string>(kSecurityClassProperty) &&
-      args.Lookup<string>(kSecurityClassProperty, kDefaultSecurity) !=
-          args.Lookup<string>(kSecurityProperty, kDefaultSecurity)) {
+  if (args.Contains<string>(kSecurityProperty)) {
     Error::PopulateAndLog(FROM_HERE, error, Error::kInvalidArguments,
-                          kManagerErrorArgumentConflict);
+                          "Unexpected Security property");
     return false;
   }
 
+  const string kDefaultSecurity = kSecurityNone;
   if (args.Contains<string>(kSecurityClassProperty)) {
     string security_class_test =
         args.Lookup<string>(kSecurityClassProperty, kDefaultSecurity);
@@ -135,18 +128,9 @@
                             kManagerErrorUnsupportedSecurityClass);
       return false;
     }
-    *security_method = security_class_test;
-  } else if (args.Contains<string>(kSecurityProperty)) {
-    string security_method_test =
-        args.Lookup<string>(kSecurityProperty, kDefaultSecurity);
-    if (!WiFiService::IsValidSecurityMethod(security_method_test)) {
-      Error::PopulateAndLog(FROM_HERE, error, Error::kNotSupported,
-                            kManagerErrorUnsupportedSecurityMode);
-      return false;
-    }
-    *security_method = security_method_test;
+    *security_class = security_class_test;
   } else {
-    *security_method = kDefaultSecurity;
+    *security_class = kDefaultSecurity;
   }
 
   *ssid_bytes = ssid;
@@ -294,15 +278,15 @@
                                                Error* error) const {
   vector<uint8_t> ssid;
   string mode;
-  string security;
+  string security_class;
   bool hidden_ssid;
 
-  if (!GetServiceParametersFromArgs(args, &ssid, &mode, &security, &hidden_ssid,
-                                    error)) {
+  if (!GetServiceParametersFromArgs(args, &ssid, &mode, &security_class,
+                                    &hidden_ssid, error)) {
     return nullptr;
   }
 
-  WiFiServiceRefPtr service(FindService(ssid, mode, security));
+  WiFiServiceRefPtr service(FindService(ssid, mode, security_class));
   if (!service) {
     error->Populate(Error::kNotFound, "Matching service was not found");
   }
@@ -314,15 +298,16 @@
                                                    Error* error) {
   vector<uint8_t> ssid;
   string mode;
-  string security;
+  string security_class;
   bool hidden_ssid;
 
-  if (!GetServiceParametersFromArgs(args, &ssid, &mode, &security, &hidden_ssid,
-                                    error)) {
+  if (!GetServiceParametersFromArgs(args, &ssid, &mode, &security_class,
+                                    &hidden_ssid, error)) {
     return nullptr;
   }
 
-  return new WiFiService(manager_, this, ssid, mode, security, hidden_ssid);
+  return new WiFiService(manager_, this, ssid, mode, security_class,
+                         hidden_ssid);
 }
 
 ServiceRefPtr WiFiProvider::CreateTemporaryServiceFromProfile(
@@ -349,17 +334,17 @@
                                                Error* error) {
   vector<uint8_t> ssid_bytes;
   string mode;
-  string security_method;
+  string security_class;
   bool hidden_ssid;
 
-  if (!GetServiceParametersFromArgs(args, &ssid_bytes, &mode, &security_method,
+  if (!GetServiceParametersFromArgs(args, &ssid_bytes, &mode, &security_class,
                                     &hidden_ssid, error)) {
     return nullptr;
   }
 
-  WiFiServiceRefPtr service(FindService(ssid_bytes, mode, security_method));
+  WiFiServiceRefPtr service(FindService(ssid_bytes, mode, security_class));
   if (!service) {
-    service = AddService(ssid_bytes, mode, security_method, hidden_ssid);
+    service = AddService(ssid_bytes, mode, security_class, hidden_ssid);
   }
 
   return service;
@@ -474,10 +459,10 @@
 
 WiFiServiceRefPtr WiFiProvider::AddService(const vector<uint8_t>& ssid,
                                            const string& mode,
-                                           const string& security,
+                                           const string& security_class,
                                            bool is_hidden) {
   WiFiServiceRefPtr service =
-      new WiFiService(manager_, this, ssid, mode, security, is_hidden);
+      new WiFiService(manager_, this, ssid, mode, security_class, is_hidden);
 
   services_.push_back(service);
   manager_->RegisterService(service);
diff --git a/shill/wifi/wifi_provider.h b/shill/wifi/wifi_provider.h
index 31946e1..b3fb931 100644
--- a/shill/wifi/wifi_provider.h
+++ b/shill/wifi/wifi_provider.h
@@ -99,10 +99,12 @@
   // Add a service to the service_ vector and register it with the Manager.
   WiFiServiceRefPtr AddService(const std::vector<uint8_t>& ssid,
                                const std::string& mode,
-                               const std::string& security,
+                               const std::string& security_class,
                                bool is_hidden);
 
   // Find a service given its properties.
+  // |security| can be either a security class, or a security (security class
+  // is a subset of security).
   WiFiServiceRefPtr FindService(const std::vector<uint8_t>& ssid,
                                 const std::string& mode,
                                 const std::string& security) const;
diff --git a/shill/wifi/wifi_provider_test.cc b/shill/wifi/wifi_provider_test.cc
index ddbae56..2358019 100644
--- a/shill/wifi/wifi_provider_test.cc
+++ b/shill/wifi/wifi_provider_test.cc
@@ -819,10 +819,8 @@
   const string kHexSsid(base::HexEncode(kSSID.c_str(), kSSID.length()));
 
   KeyValueStore args;
-  args.Set<string>(kTypeProperty, kTypeWifi);
+  SetServiceParameters(nullptr, nullptr, kSecurityPsk, false, true, &args);
   args.Set<string>(kWifiHexSsid, kHexSsid);
-  args.Set<string>(kSecurityProperty, kSecurityPsk);
-  args.Set<bool>(kWifiHiddenSsid, false);
 
   Error error;
   WiFiServiceRefPtr service = GetWiFiService(args, &error);
@@ -841,13 +839,12 @@
   EXPECT_EQ(service, find_service);
 }
 
-TEST_F(WiFiProviderTest, GetServiceWithSecurityAndSecurityClassMismatched) {
+TEST_F(WiFiProviderTest, GetServiceUnexpectedSecurityProperty) {
   const string kSSID("bar");
   KeyValueStore args;
   args.Set<string>(kTypeProperty, kTypeWifi);
   args.Set<string>(kSSIDProperty, kSSID);
   args.Set<string>(kSecurityProperty, kSecurityRsn);
-  args.Set<string>(kSecurityClassProperty, kSecurityPsk);
   args.Set<bool>(kWifiHiddenSsid, false);
 
   Error error;
@@ -855,47 +852,16 @@
   EXPECT_CALL(manager_, RegisterService(_)).Times(0);
   service = GetWiFiService(args, &error);
   EXPECT_FALSE(error.IsSuccess());
+  EXPECT_EQ(Error::kInvalidArguments, error.type());
+  EXPECT_EQ("Unexpected Security property", error.message());
 }
 
-TEST_F(WiFiProviderTest, GetServiceWithSecurityAndSecurityClassMatching) {
+TEST_F(WiFiProviderTest, GetServiceBogusSecurityClass) {
   const string kSSID("bar");
   KeyValueStore args;
   args.Set<string>(kTypeProperty, kTypeWifi);
   args.Set<string>(kSSIDProperty, kSSID);
-  args.Set<string>(kSecurityProperty, kSecurityPsk);
-  args.Set<string>(kSecurityClassProperty, kSecurityPsk);
-  args.Set<bool>(kWifiHiddenSsid, false);
-
-  Error error;
-  WiFiServiceRefPtr service;
-  EXPECT_CALL(manager_, RegisterService(_));
-  service = GetWiFiService(args, &error);
-  EXPECT_TRUE(error.IsSuccess());
-}
-
-TEST_F(WiFiProviderTest,
-       GetServiceWithSecurityAndSecurityClassMatchingButInvalidClass) {
-  const string kSSID("bar");
-  KeyValueStore args;
-  args.Set<string>(kTypeProperty, kTypeWifi);
-  args.Set<string>(kSSIDProperty, kSSID);
-  args.Set<string>(kSecurityProperty, kSecurityRsn);
-  args.Set<string>(kSecurityClassProperty, kSecurityRsn);
-  args.Set<bool>(kWifiHiddenSsid, false);
-  EXPECT_CALL(manager_, RegisterService(_)).Times(0);
-
-  Error error;
-  WiFiServiceRefPtr service = GetWiFiService(args, &error);
-  Mock::VerifyAndClearExpectations(&manager_);
-  EXPECT_FALSE(error.IsSuccess());
-}
-
-TEST_F(WiFiProviderTest, GetServiceBadSecurity) {
-  const string kSSID("bar");
-  KeyValueStore args;
-  args.Set<string>(kTypeProperty, kTypeWifi);
-  args.Set<string>(kSSIDProperty, kSSID);
-  args.Set<string>(kSecurityProperty, "pig-80211");
+  args.Set<string>(kSecurityClassProperty, "rot-47");
   args.Set<bool>(kWifiHiddenSsid, false);
 
   Error error;
@@ -904,7 +870,23 @@
   service = GetWiFiService(args, &error);
   EXPECT_FALSE(error.IsSuccess());
   EXPECT_EQ(Error::kNotSupported, error.type());
-  EXPECT_EQ("security mode is unsupported", error.message());
+}
+
+TEST_F(WiFiProviderTest, GetServiceNonSecurityClass) {
+  const string kSSID("bar");
+  KeyValueStore args;
+  args.Set<string>(kTypeProperty, kTypeWifi);
+  args.Set<string>(kSSIDProperty, kSSID);
+  // Using a non-class as a class should be rejected.
+  args.Set<string>(kSecurityClassProperty, kSecurityRsn);
+  args.Set<bool>(kWifiHiddenSsid, false);
+
+  Error error;
+  WiFiServiceRefPtr service;
+  EXPECT_CALL(manager_, RegisterService(_)).Times(0);
+  service = GetWiFiService(args, &error);
+  EXPECT_FALSE(error.IsSuccess());
+  EXPECT_EQ(Error::kNotSupported, error.type());
 }
 
 TEST_F(WiFiProviderTest, FindSimilarService) {
@@ -967,14 +949,13 @@
   EXPECT_TRUE(service1->HasOneRef());
 }
 
-TEST_F(WiFiProviderTest, FindServiceWPA) {
+TEST_F(WiFiProviderTest, FindServicePSK) {
   const string kSSID("an_ssid");
   Error error;
   EXPECT_CALL(manager_, RegisterService(_)).Times(1);
   KeyValueStore args;
-  SetServiceParameters(kSSID.c_str(), kModeManaged, nullptr, false, false,
+  SetServiceParameters(kSSID.c_str(), kModeManaged, kSecurityPsk, false, false,
                        &args);
-  args.Set<string>(kSecurityProperty, kSecurityRsn);
   WiFiServiceRefPtr service = GetWiFiService(args, &error);
   ASSERT_NE(nullptr, service);
   const vector<uint8_t> ssid_bytes(kSSID.begin(), kSSID.end());
diff --git a/shill/wifi/wifi_service.h b/shill/wifi/wifi_service.h
index e3b7172..70c0f74 100644
--- a/shill/wifi/wifi_service.h
+++ b/shill/wifi/wifi_service.h
@@ -184,9 +184,7 @@
   FRIEND_TEST(WiFiServiceTest, ConnectTaskDynamicWEP);
   FRIEND_TEST(WiFiServiceTest, ConnectTaskPSK);
   FRIEND_TEST(WiFiServiceTest, ConnectTaskRawPMK);
-  FRIEND_TEST(WiFiServiceTest, ConnectTaskRSN);
   FRIEND_TEST(WiFiServiceTest, ConnectTaskWEP);
-  FRIEND_TEST(WiFiServiceTest, ConnectTaskWPA);
   FRIEND_TEST(WiFiServiceTest, ConnectTaskFT);
   FRIEND_TEST(WiFiServiceTest, GetTethering);
   FRIEND_TEST(WiFiServiceTest, IsAutoConnectable);
diff --git a/shill/wifi/wifi_service_test.cc b/shill/wifi/wifi_service_test.cc
index e0f90ad..7baf04e 100644
--- a/shill/wifi/wifi_service_test.cc
+++ b/shill/wifi/wifi_service_test.cc
@@ -77,18 +77,18 @@
     service->eap_.reset(eap);  // Passes ownership.
     return eap;
   }
-  bool CheckConnectable(const string& security,
+  bool CheckConnectable(const string& security_class,
                         const char* passphrase,
                         bool is_1x_connectable) {
     Error error;
-    WiFiServiceRefPtr service = MakeSimpleService(security);
+    WiFiServiceRefPtr service = MakeSimpleService(security_class);
     if (passphrase)
       service->SetPassphrase(passphrase, &error);
     MockEapCredentials* eap = SetMockEap(service);
     EXPECT_CALL(*eap, IsConnectable())
         .WillRepeatedly(Return(is_1x_connectable));
     const string kKeyManagement8021x(WPASupplicant::kKeyManagementIeee8021X);
-    if (security == kSecurityWep && is_1x_connectable) {
+    if (security_class == kSecurityWep && is_1x_connectable) {
       EXPECT_CALL(*eap, key_management())
           .WillRepeatedly(ReturnRef(kKeyManagement8021x));
     }
@@ -122,9 +122,9 @@
         nullptr, wifi, ssid, bssid, WPASupplicant::kNetworkModeInfrastructure,
         frequency, signal_dbm);
   }
-  WiFiServiceRefPtr MakeSimpleService(const string& security) {
+  WiFiServiceRefPtr MakeSimpleService(const string& security_class) {
     return new WiFiService(manager(), &provider_, simple_ssid_, kModeManaged,
-                           security, false);
+                           security_class, false);
   }
   WiFiServiceRefPtr MakeGenericService() {
     return MakeSimpleService(kSecurityWep);
@@ -135,8 +135,8 @@
   void SetWiFiForService(WiFiServiceRefPtr service, WiFiRefPtr wifi) {
     service->wifi_ = wifi;
   }
-  WiFiServiceRefPtr MakeServiceWithWiFi(const string& security) {
-    WiFiServiceRefPtr service = MakeSimpleService(security);
+  WiFiServiceRefPtr MakeServiceWithWiFi(const string& security_class) {
+    WiFiServiceRefPtr service = MakeSimpleService(security_class);
     SetWiFiForService(service, wifi_);
     scoped_refptr<MockProfile> mock_profile(
         new NiceMock<MockProfile>(manager()));
@@ -154,9 +154,9 @@
   ServiceMockAdaptor* GetAdaptor(WiFiService* service) {
     return static_cast<ServiceMockAdaptor*>(service->adaptor());
   }
-  Error::Type TestConfigurePassphrase(const string& security,
+  Error::Type TestConfigurePassphrase(const string& security_class,
                                       const char* passphrase) {
-    WiFiServiceRefPtr service = MakeSimpleService(security);
+    WiFiServiceRefPtr service = MakeSimpleService(security_class);
     KeyValueStore args;
     if (passphrase) {
       args.Set<string>(kPassphraseProperty, passphrase);
@@ -328,7 +328,7 @@
 // Make sure the passphrase is registered as a write only property
 // by reading and comparing all string properties returned on the store.
 TEST_F(WiFiServiceTest, PassphraseWriteOnly) {
-  WiFiServiceRefPtr wifi_service = MakeSimpleService(kSecurityWpa);
+  WiFiServiceRefPtr wifi_service = MakeSimpleService(kSecurityPsk);
   ReadablePropertyConstIterator<string> it =
       (wifi_service->store()).GetStringPropertiesIter();
   for (; !it.AtEnd(); it.Advance())
@@ -388,26 +388,6 @@
   wifi_service->Connect(nullptr, "in test");
 }
 
-TEST_F(WiFiServiceTest, ConnectTaskWPA) {
-  WiFiServiceRefPtr wifi_service = MakeServiceWithWiFi(kSecurityWpa);
-  EXPECT_CALL(*wifi(), ConnectTo(wifi_service.get(), _));
-  Error error;
-  wifi_service->SetPassphrase("0:mumblemumblem", &error);
-  wifi_service->Connect(nullptr, "in test");
-  EXPECT_THAT(wifi_service->GetSupplicantConfigurationParameters(),
-              PSKSecurityArgs());
-}
-
-TEST_F(WiFiServiceTest, ConnectTaskRSN) {
-  WiFiServiceRefPtr wifi_service = MakeServiceWithWiFi(kSecurityRsn);
-  EXPECT_CALL(*wifi(), ConnectTo(wifi_service.get(), _));
-  Error error;
-  wifi_service->SetPassphrase("0:mumblemumblem", &error);
-  wifi_service->Connect(nullptr, "in test");
-  EXPECT_THAT(wifi_service->GetSupplicantConfigurationParameters(),
-              PSKSecurityArgs());
-}
-
 TEST_F(WiFiServiceTest, ConnectConditions) {
   Error error;
   WiFiServiceRefPtr wifi_service = MakeServiceWithWiFi(kSecurityNone);
@@ -546,7 +526,7 @@
 
 TEST_F(WiFiServiceTest, ConnectTaskFT) {
   {
-    WiFiServiceRefPtr wifi_service = MakeServiceWithWiFi(kSecurityWpa);
+    WiFiServiceRefPtr wifi_service = MakeServiceWithWiFi(kSecurityPsk);
 
     manager()->ft_enabled_ = false;
     wifi_service->ft_enabled_ = false;
@@ -597,7 +577,7 @@
 }
 
 TEST_F(WiFiServiceTest, SetPassphraseResetHasEverConnected) {
-  WiFiServiceRefPtr wifi_service = MakeServiceWithWiFi(kSecurityRsn);
+  WiFiServiceRefPtr wifi_service = MakeServiceWithWiFi(kSecurityPsk);
   const string kPassphrase = "abcdefgh";
 
   Error error;
@@ -609,7 +589,7 @@
 }
 
 TEST_F(WiFiServiceTest, SetPassphraseRemovesCachedCredentials) {
-  WiFiServiceRefPtr wifi_service = MakeServiceWithWiFi(kSecurityRsn);
+  WiFiServiceRefPtr wifi_service = MakeServiceWithWiFi(kSecurityPsk);
 
   const string kPassphrase = "abcdefgh";
 
@@ -987,37 +967,37 @@
   EXPECT_EQ(
       Error::kSuccess,
       TestConfigurePassphrase(kSecurityWep, "0:0x0102030405060708090a0b0c0d"));
-  EXPECT_EQ(Error::kSuccess, TestConfigurePassphrase(kSecurityWpa, nullptr));
+  EXPECT_EQ(Error::kSuccess, TestConfigurePassphrase(kSecurityPsk, nullptr));
   EXPECT_EQ(Error::kSuccess,
-            TestConfigurePassphrase(kSecurityWpa, "secure password"));
+            TestConfigurePassphrase(kSecurityPsk, "secure password"));
   EXPECT_EQ(Error::kInvalidPassphrase,
-            TestConfigurePassphrase(kSecurityWpa, ""));
+            TestConfigurePassphrase(kSecurityPsk, ""));
   EXPECT_EQ(
       Error::kSuccess,
       TestConfigurePassphrase(
-          kSecurityWpa, string(IEEE_80211::kWPAAsciiMinLen, 'Z').c_str()));
+          kSecurityPsk, string(IEEE_80211::kWPAAsciiMinLen, 'Z').c_str()));
   EXPECT_EQ(
       Error::kSuccess,
       TestConfigurePassphrase(
-          kSecurityWpa, string(IEEE_80211::kWPAAsciiMaxLen, 'Z').c_str()));
+          kSecurityPsk, string(IEEE_80211::kWPAAsciiMaxLen, 'Z').c_str()));
   // subtle: invalid length for hex key, but valid as ascii passphrase
   EXPECT_EQ(Error::kSuccess,
             TestConfigurePassphrase(
-                kSecurityWpa, string(IEEE_80211::kWPAHexLen - 1, '1').c_str()));
+                kSecurityPsk, string(IEEE_80211::kWPAHexLen - 1, '1').c_str()));
   EXPECT_EQ(Error::kSuccess,
             TestConfigurePassphrase(
-                kSecurityWpa, string(IEEE_80211::kWPAHexLen, '1').c_str()));
+                kSecurityPsk, string(IEEE_80211::kWPAHexLen, '1').c_str()));
   EXPECT_EQ(
       Error::kInvalidPassphrase,
       TestConfigurePassphrase(
-          kSecurityWpa, string(IEEE_80211::kWPAAsciiMinLen - 1, 'Z').c_str()));
+          kSecurityPsk, string(IEEE_80211::kWPAAsciiMinLen - 1, 'Z').c_str()));
   EXPECT_EQ(
       Error::kInvalidPassphrase,
       TestConfigurePassphrase(
-          kSecurityWpa, string(IEEE_80211::kWPAAsciiMaxLen + 1, 'Z').c_str()));
+          kSecurityPsk, string(IEEE_80211::kWPAAsciiMaxLen + 1, 'Z').c_str()));
   EXPECT_EQ(Error::kInvalidPassphrase,
             TestConfigurePassphrase(
-                kSecurityWpa, string(IEEE_80211::kWPAHexLen + 1, '1').c_str()));
+                kSecurityPsk, string(IEEE_80211::kWPAHexLen + 1, '1').c_str()));
 }
 
 TEST_F(WiFiServiceTest, ConfigureRedundantProperties) {
@@ -1105,10 +1085,10 @@
   // A bad passphrase should not make a WEP network connectable.
   EXPECT_FALSE(CheckConnectable(kSecurityWep, "a", false));
 
-  // Similar to WEP, for WPA.
-  EXPECT_TRUE(CheckConnectable(kSecurityWpa, "abcdefgh", false));
-  EXPECT_FALSE(CheckConnectable(kSecurityWpa, nullptr, false));
-  EXPECT_FALSE(CheckConnectable(kSecurityWpa, "a", false));
+  // Similar to WEP, for PSK.
+  EXPECT_TRUE(CheckConnectable(kSecurityPsk, "abcdefgh", false));
+  EXPECT_FALSE(CheckConnectable(kSecurityPsk, nullptr, false));
+  EXPECT_FALSE(CheckConnectable(kSecurityPsk, "a", false));
 
   // 802.1x without connectable EAP credentials should NOT be connectable.
   EXPECT_FALSE(CheckConnectable(kSecurity8021x, nullptr, false));
@@ -1661,7 +1641,7 @@
 }
 
 TEST_F(WiFiServiceTest, SuspectedCredentialFailure) {
-  WiFiServiceRefPtr service = MakeSimpleService(kSecurityWpa);
+  WiFiServiceRefPtr service = MakeSimpleService(kSecurityPsk);
   EXPECT_FALSE(service->has_ever_connected());
   EXPECT_EQ(0, service->suspected_credential_failures_);
 
diff --git a/shill/wifi/wifi_test.cc b/shill/wifi/wifi_test.cc
index 4ea7866..003e14b 100644
--- a/shill/wifi/wifi_test.cc
+++ b/shill/wifi/wifi_test.cc
@@ -2860,7 +2860,7 @@
 }
 
 TEST_F(WiFiMainTest, SuspectCredentialsWPA) {
-  MockWiFiServiceRefPtr service = MakeMockService(kSecurityWpa);
+  MockWiFiServiceRefPtr service = MakeMockService(kSecurityPsk);
   ReportStateChanged(WPASupplicant::kInterfaceState4WayHandshake);
   EXPECT_CALL(*service, AddSuspectedCredentialFailure())
       .WillOnce(Return(false))
@@ -2955,8 +2955,8 @@
   EXPECT_FALSE(SuspectCredentials(service, nullptr));
 }
 
-TEST_F(WiFiMainTest, SuspectCredentialsYieldFailureWPA) {
-  MockWiFiServiceRefPtr service = MakeMockService(kSecurityWpa);
+TEST_F(WiFiMainTest, SuspectCredentialsYieldFailurePSK) {
+  MockWiFiServiceRefPtr service = MakeMockService(kSecurityPsk);
   SetPendingService(service);
   ReportStateChanged(WPASupplicant::kInterfaceState4WayHandshake);
 
@@ -3956,7 +3956,7 @@
   ScopedMockLog log;
   ScopeLogger::GetInstance()->EnableScopesByName("wifi");
   ScopeLogger::GetInstance()->set_verbose_level(1);
-  MockWiFiServiceRefPtr service = MakeMockService(kSecurityWpa);
+  MockWiFiServiceRefPtr service = MakeMockService(kSecurityPsk);
   SetPendingService(service);
   EXPECT_FALSE(wifi()->IsIdle());
   EXPECT_CALL(log, Log(_, _, _)).Times(AnyNumber());
@@ -3985,7 +3985,7 @@
 TEST_F(WiFiMainTest, InitiateScanInDarkResume_NotIdle) {
   const WiFi::FreqSet freqs;
   ScopedMockLog log;
-  MockWiFiServiceRefPtr service = MakeMockService(kSecurityWpa);
+  MockWiFiServiceRefPtr service = MakeMockService(kSecurityPsk);
   SetPendingService(service);
   manager()->set_suppress_autoconnect(false);
   EXPECT_FALSE(wifi()->IsIdle());