Disable encryption for HOTSPOT

PiperOrigin-RevId: 463773343

connections/implementation/bwu_manager.cc

@@ -18,6 +18,7 @@
 #include <memory>
 #include <string>
 #include <utility>
+#include <vector>
 
 #include "absl/functional/bind_front.h"
 #include "absl/time/time.h"
@@ -542,7 +543,8 @@ void BwuManager::OnIncomingConnection(
         // Use the introductory client information sent over to run the upgrade
         // protocol.
         RunUpgradeProtocol(mapped_client, endpoint_id,
-                           std::move(connection->channel));
+                           std::move(connection->channel),
+                           !introduction.supports_disabling_encryption());
       });
 }
 
@@ -558,7 +560,8 @@ void BwuManager::RunOnBwuManagerThread(const std::string& name,
 
 void BwuManager::RunUpgradeProtocol(
     ClientProxy* client, const std::string& endpoint_id,
-    std::unique_ptr<EndpointChannel> new_channel) {
+    std::unique_ptr<EndpointChannel> new_channel,
+    bool enable_encryption) {
   NEARBY_LOGS(INFO) << "RunUpgradeProtocol new channel @" << new_channel.get()
                     << " name: " << new_channel->GetName() << ", medium: "
                     << proto::connections::Medium_Name(
@@ -584,8 +587,8 @@ void BwuManager::RunUpgradeProtocol(
         proto::connections::PRIOR_ENDPOINT_CHANNEL);
     return;
   }
-  channel_manager_->ReplaceChannelForEndpoint(client, endpoint_id,
-                                              std::move(new_channel));
+  channel_manager_->ReplaceChannelForEndpoint(
+      client, endpoint_id, std::move(new_channel), enable_encryption);
 
   // Next, initiate a clean shutdown for the previous EndpointChannel used for
   // this endpoint by telling the remote device that it will not receive any
@@ -633,10 +636,10 @@ void BwuManager::ProcessBwuPathAvailableEvent(
   if (channel_manager_->isWifiLanConnected() &&
       (upgrade_medium == Medium::WIFI_HOTSPOT)) {
     NEARBY_LOGS(INFO)
-          << "Some endpoint is using WIFI_LAN and proposed upgrade medium is "
-             "WIFI_HOTSPOT. Don't do the BWU because connecting to "
-             "WIFI_HOTSPOT will destroy WIFI_LAN which will lead BWU fail and "
-             "other endpoint connection fail";
+        << "Some endpoint is using WIFI_LAN and proposed upgrade medium is "
+           "WIFI_HOTSPOT. Don't do the BWU because connecting to "
+           "WIFI_HOTSPOT will destroy WIFI_LAN which will lead BWU fail and "
+           "other endpoint connection fail";
     RunUpgradeFailedProtocol(client, endpoint_id, upgrade_path_info);
     return;
   }
@@ -719,7 +722,8 @@ void BwuManager::ProcessBwuPathAvailableEvent(
   }
 
   in_progress_upgrades_.emplace(endpoint_id, client);
-  RunUpgradeProtocol(client, endpoint_id, std::move(channel));
+  RunUpgradeProtocol(client, endpoint_id, std::move(channel),
+                     !upgrade_path_info.supports_disabling_encryption());
 }
 
 std::unique_ptr<EndpointChannel>
@@ -783,7 +787,9 @@ BwuManager::ProcessBwuPathAvailableEventInternal(
   // Write the requisite BANDWIDTH_UPGRADE_NEGOTIATION.CLIENT_INTRODUCTION as
   // the first OfflineFrame on this new EndpointChannel.
   if (!new_channel
-           ->Write(parser::ForBwuIntroduction(client->GetLocalEndpointId()))
+           ->Write(parser::ForBwuIntroduction(
+               client->GetLocalEndpointId(),
+               upgrade_path_info.supports_disabling_encryption()))
            .Ok()) {
     // This was never a fully EstablishedConnection, no need to provide a
     // closure reason.

connections/implementation/bwu_manager.h

@@ -18,6 +18,7 @@
 #include <functional>
 #include <memory>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "absl/container/flat_hash_map.h"
@@ -149,7 +150,8 @@ class BwuManager : public EndpointManager::FrameProcessor {
       std::unique_ptr<BwuHandler::IncomingSocketConnection> mutable_connection);
 
   void RunUpgradeProtocol(ClientProxy* client, const std::string& endpoint_id,
-                          std::unique_ptr<EndpointChannel> new_channel);
+                          std::unique_ptr<EndpointChannel> new_channel,
+                          bool enable_encryption);
   void RunUpgradeFailedProtocol(ClientProxy* client,
                                 const std::string& endpoint_id,
                                 const UpgradePathInfo& upgrade_path_info);

connections/implementation/bwu_manager_test.cc

@@ -686,7 +686,7 @@ TEST_F(BwuManagerTest, InitiateBwu_Revert_OnDisconnect_Hotspot) {
       BandwidthUpgradeNegotiationFrame::UPGRADE_PATH_AVAILABLE);
   auto* upgrade_path_info = sub_frame->mutable_upgrade_path_info();
   upgrade_path_info->set_supports_client_introduction_ack(false);
-
+  upgrade_path_info->set_supports_disabling_encryption(true);
   bwu_manager_->OnIncomingFrame(frame, std::string(kEndpointId1), &client_,
                                 Medium::BLUETOOTH);
   CountDownLatch latch(1);

connections/implementation/endpoint_channel_manager.cc

@@ -20,11 +20,9 @@
 
 #include "absl/time/time.h"
 #include "connections/implementation/offline_frames.h"
-#include "internal/platform/feature_flags.h"
 #include "internal/platform/logging.h"
 #include "internal/platform/mutex.h"
 #include "internal/platform/mutex_lock.h"
-#include "internal/platform/system_clock.h"
 
 namespace location {
 namespace nearby {
@@ -48,14 +46,15 @@ void EndpointChannelManager::RegisterChannelForEndpoint(
 
   NEARBY_LOGS(INFO) << "EndpointChannelManager registered channel of type "
                     << channel->GetType() << " to endpoint " << endpoint_id;
-  SetActiveEndpointChannel(client, endpoint_id, std::move(channel));
+  SetActiveEndpointChannel(client, endpoint_id, std::move(channel),
+                           true /* enable_encryption */);
 
   NEARBY_LOG(INFO, "Registered channel: id=%s", endpoint_id.c_str());
 }
 
 void EndpointChannelManager::ReplaceChannelForEndpoint(
     ClientProxy* client, const std::string& endpoint_id,
-    std::unique_ptr<EndpointChannel> channel) {
+    std::unique_ptr<EndpointChannel> channel, bool enable_encryption) {
   MutexLock lock(&mutex_);
 
   auto* endpoint = channel_state_.LookupEndpointData(endpoint_id);
@@ -64,8 +63,8 @@ void EndpointChannelManager::ReplaceChannelForEndpoint(
                          "trying to update: endpoint "
                       << endpoint_id;
   }
-
-  SetActiveEndpointChannel(client, endpoint_id, std::move(channel));
+  SetActiveEndpointChannel(client, endpoint_id, std::move(channel),
+                           enable_encryption);
 }
 
 bool EndpointChannelManager::EncryptChannelForEndpoint(
@@ -94,14 +93,15 @@ std::shared_ptr<EndpointChannel> EndpointChannelManager::GetChannelForEndpoint(
 
 void EndpointChannelManager::SetActiveEndpointChannel(
     ClientProxy* client, const std::string& endpoint_id,
-    std::unique_ptr<EndpointChannel> channel) {
+    std::unique_ptr<EndpointChannel> channel, bool enable_encryption) {
   // Update the channel first, then encrypt this new channel, if
   // crypto context is present.
   channel->SetAnalyticsRecorder(&client->GetAnalyticsRecorder(), endpoint_id);
   channel_state_.UpdateChannelForEndpoint(endpoint_id, std::move(channel));
 
   auto* endpoint = channel_state_.LookupEndpointData(endpoint_id);
-  if (endpoint->IsEncrypted()) channel_state_.EncryptChannel(endpoint);
+  if (endpoint->IsEncrypted() && enable_encryption)
+    channel_state_.EncryptChannel(endpoint);
 }
 
 int EndpointChannelManager::GetConnectedEndpointsCount() const {

connections/implementation/endpoint_channel_manager.h

@@ -22,7 +22,6 @@
 #include "absl/container/flat_hash_map.h"
 #include "connections/implementation/client_proxy.h"
 #include "connections/implementation/endpoint_channel.h"
-#include "internal/platform/logging.h"
 #include "internal/platform/mutex.h"
 
 namespace location {
@@ -62,7 +61,8 @@ class EndpointChannelManager final {
   // to the newly-provided EndpointChannel.
   void ReplaceChannelForEndpoint(ClientProxy* client,
                                  const std::string& endpoint_id,
-                                 std::unique_ptr<EndpointChannel> channel)
+                                 std::unique_ptr<EndpointChannel> channel,
+                                 bool enable_encryption)
       ABSL_LOCKS_EXCLUDED(mutex_);
 
   bool EncryptChannelForEndpoint(const std::string& endpoint_id,
@@ -162,7 +162,8 @@ class EndpointChannelManager final {
 
   void SetActiveEndpointChannel(ClientProxy* client,
                                 const std::string& endpoint_id,
-                                std::unique_ptr<EndpointChannel> channel)
+                                std::unique_ptr<EndpointChannel> channel,
+                                bool enable_encryption)
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(mutex_);
 
   mutable Mutex mutex_;

connections/implementation/endpoint_channel_manager_test.cc

@@ -14,19 +14,285 @@
 
 #include "connections/implementation/endpoint_channel_manager.h"
 
+#include <functional>
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "securegcm/d2d_connection_context_v1.h"
+#include "securegcm/ukey2_handshake.h"
 #include "gmock/gmock.h"
 #include "protobuf-matchers/protocol-buffer-matchers.h"
 #include "gtest/gtest.h"
+#include "absl/synchronization/mutex.h"
+#include "absl/time/time.h"
+#include "connections/implementation/base_endpoint_channel.h"
+#include "connections/implementation/encryption_runner.h"
+#include "internal/platform/count_down_latch.h"
+#include "internal/platform/exception.h"
+#include "internal/platform/input_stream.h"
+#include "internal/platform/logging.h"
+#include "internal/platform/multi_thread_executor.h"
+#include "internal/platform/output_stream.h"
+#include "internal/platform/pipe.h"
+#include "proto/connections_enums.pb.h"
 
 namespace location {
 namespace nearby {
 namespace connections {
+namespace {
 
-TEST(EndpointChannelManagerTest, ConstructorDestructorWorks) {
-  EndpointChannelManager mgr;
-  SUCCEED();
+using ::location::nearby::proto::connections::DisconnectionReason;
+using ::location::nearby::proto::connections::Medium;
+using EncryptionContext = BaseEndpointChannel::EncryptionContext;
+
+constexpr absl::string_view kEndpointId = "EndpointId";
+constexpr absl::string_view kMonitorA = "MonitorA";
+constexpr absl::string_view kMonitorB = "MonitorB";
+constexpr absl::string_view kPumpA = "PumpA";
+constexpr absl::string_view kPumpB = "PumpB";
+
+class MockEndpointChannel : public BaseEndpointChannel {
+ public:
+  explicit MockEndpointChannel(InputStream* input, OutputStream* output)
+      : BaseEndpointChannel("service_id", "channel", input, output) {}
+
+  MOCK_METHOD(Medium, GetMedium, (), (const override));
+  MOCK_METHOD(void, CloseImpl, (), (override));
+};
+
+std::function<void()> MakeDataPump(
+    absl::string_view label, InputStream* input, OutputStream* output,
+    std::function<void(const ByteArray&)> monitor = nullptr) {
+  return [label, input, output, monitor]() {
+    NEARBY_LOGS(INFO) << "streaming data through '" << label << "'";
+    while (true) {
+      auto read_response = input->Read(Pipe::kChunkSize);
+      if (!read_response.ok()) {
+        NEARBY_LOGS(INFO) << "Peer reader closed on '" << label << "'";
+        output->Close();
+        break;
+      }
+      if (monitor) {
+        monitor(read_response.result());
+      }
+      auto write_response = output->Write(read_response.result());
+      if (write_response.Raised()) {
+        NEARBY_LOGS(INFO) << "Peer writer closed on '" << label << "'";
+        input->Close();
+        break;
+      }
+    }
+    NEARBY_LOGS(INFO) << "streaming terminated on '" << label << "'";
+  };
 }
 
+std::function<void(const ByteArray&)> MakeDataMonitor(absl::string_view label,
+                                                      std::string* capture,
+                                                      absl::Mutex* mutex) {
+  return [label, capture, mutex](const ByteArray& input) mutable {
+    std::string s = std::string(input);
+    {
+      absl::MutexLock lock(mutex);
+      *capture += s;
+    }
+    NEARBY_LOGS(INFO) << "source='" << label << "'"
+                      << "; message='" << s << "'";
+  };
+}
+
+std::pair<std::unique_ptr<EncryptionContext>,
+          std::unique_ptr<EncryptionContext>>
+DoDhKeyExchange(BaseEndpointChannel* channel_a,
+                BaseEndpointChannel* channel_b) {
+  std::unique_ptr<EncryptionContext> context_a;
+  std::unique_ptr<EncryptionContext> context_b;
+  EncryptionRunner crypto_a;
+  EncryptionRunner crypto_b;
+  ClientProxy proxy_a;
+  ClientProxy proxy_b;
+  CountDownLatch latch(2);
+  crypto_a.StartClient(
+      &proxy_a, std::string(kEndpointId), channel_a,
+      {
+          .on_success_cb =
+              [&latch, &context_a](
+                  const std::string& endpoint_id,
+                  std::unique_ptr<securegcm::UKey2Handshake> ukey2,
+                  const std::string& auth_token,
+                  const ByteArray& raw_auth_token) {
+                NEARBY_LOGS(INFO) << "client-A side key negotiation done";
+                EXPECT_TRUE(ukey2->VerifyHandshake());
+                auto context = ukey2->ToConnectionContext();
+                EXPECT_NE(context, nullptr);
+                context_a = std::move(context);
+                latch.CountDown();
+              },
+          .on_failure_cb =
+              [&latch](const std::string& endpoint_id,
+                       EndpointChannel* channel) {
+                NEARBY_LOGS(INFO) << "client-A side key negotiation failed";
+                latch.CountDown();
+              },
+      });
+  crypto_b.StartServer(
+      &proxy_b, std::string(kEndpointId), channel_b,
+      {
+          .on_success_cb =
+              [&latch, &context_b](
+                  const std::string& endpoint_id,
+                  std::unique_ptr<securegcm::UKey2Handshake> ukey2,
+                  const std::string& auth_token,
+                  const ByteArray& raw_auth_token) {
+                NEARBY_LOGS(INFO) << "client-B side key negotiation done";
+                EXPECT_TRUE(ukey2->VerifyHandshake());
+                auto context = ukey2->ToConnectionContext();
+                EXPECT_NE(context, nullptr);
+                context_b = std::move(context);
+                latch.CountDown();
+              },
+          .on_failure_cb =
+              [&latch](const std::string& endpoint_id,
+                       EndpointChannel* channel) {
+                NEARBY_LOGS(INFO) << "client-B side key negotiation failed";
+                latch.CountDown();
+              },
+      });
+  EXPECT_TRUE(latch.Await(absl::Milliseconds(5000)).result());
+
+  return std::make_pair(std::move(context_a), std::move(context_b));
+}
+
+TEST(BaseEndpointChannelManagerTest, RegisterChannelEncryptedReadwrite) {
+  // Setup test communication environment.
+  absl::Mutex mutex;
+  std::string capture_a;
+  std::string capture_b;
+  ClientProxy proxy_a;
+  ClientProxy proxy_b;
+  Pipe client_a;  // Channel "a" writes to client "a", reads from server "a".
+  Pipe client_b;  // Channel "b" writes to client "b", reads from server "b".
+  Pipe server_a;  // Data pump "a" reads from client "a", writes to server "b".
+  Pipe server_b;  // Data pump "b" reads from client "b", writes to server "a".
+  auto channel_a = std::make_unique<MockEndpointChannel>(
+      &server_a.GetInputStream(), &client_a.GetOutputStream());
+  auto channel_b = std::make_unique<MockEndpointChannel>(
+      &server_b.GetInputStream(), &client_b.GetOutputStream());
+  auto channel_a_raw = channel_a.get();
+  auto channel_b_raw = channel_b.get();
+
+  ON_CALL(*channel_a_raw, GetMedium).WillByDefault([]() {
+    return Medium::BLUETOOTH;
+  });
+  ON_CALL(*channel_b_raw, GetMedium).WillByDefault([]() {
+    return Medium::BLUETOOTH;
+  });
+
+  MultiThreadExecutor executor(2);
+  executor.Execute(MakeDataPump(
+      kPumpA, &client_a.GetInputStream(), &server_b.GetOutputStream(),
+      MakeDataMonitor(kMonitorA, &capture_a, &mutex)));
+  executor.Execute(MakeDataPump(
+      kPumpB, &client_b.GetInputStream(), &server_a.GetOutputStream(),
+      MakeDataMonitor(kMonitorB, &capture_b, &mutex)));
+
+  // Run DH key exchange; setup encryption contexts for channels.
+  auto context = DoDhKeyExchange(channel_a.get(), channel_b.get());
+  ASSERT_NE(context.first, nullptr);
+  ASSERT_NE(context.second, nullptr);
+
+  EndpointChannelManager ecm_a;
+  ecm_a.EncryptChannelForEndpoint(std::string(kEndpointId),
+                                  std::move(context.first));
+  ecm_a.RegisterChannelForEndpoint(&proxy_a, std::string(kEndpointId),
+                                   std::move(channel_a));
+
+  EndpointChannelManager ecm_b;
+  ecm_b.EncryptChannelForEndpoint(std::string(kEndpointId),
+                                  std::move(context.second));
+  ecm_b.RegisterChannelForEndpoint(&proxy_b, std::string(kEndpointId),
+                                   std::move(channel_b));
+
+  EXPECT_EQ(channel_a_raw->GetType(), "ENCRYPTED_BLUETOOTH");
+  EXPECT_EQ(channel_b_raw->GetType(), "ENCRYPTED_BLUETOOTH");
+
+  ByteArray tx_message{"data message"};
+  channel_a_raw->Write(tx_message);
+  ByteArray rx_message = std::move(channel_b_raw->Read().result());
+
+  // Verify expectations.
+  EXPECT_EQ(rx_message, tx_message);
+  {
+    absl::MutexLock lock(&mutex);
+    std::string message{tx_message};
+    EXPECT_TRUE(capture_a.find(message) == std::string::npos &&
+                capture_b.find(message) == std::string::npos);
+  }
+
+  // Shutdown test environment.
+  channel_a_raw->Close(DisconnectionReason::LOCAL_DISCONNECTION);
+  channel_b_raw->Close(DisconnectionReason::REMOTE_DISCONNECTION);
+}
+
+TEST(BaseEndpointChannelManagerTest, ReplaceChannelNoEncrypted) {
+  // Setup test communication environment.
+  absl::Mutex mutex;
+  std::string capture_a;
+  std::string capture_b;
+  ClientProxy proxy_a;
+  ClientProxy proxy_b;
+  Pipe client_a;  // Channel "a" writes to client "a", reads from server "a".
+  Pipe client_b;  // Channel "b" writes to client "b", reads from server "b".
+  Pipe server_a;  // Data pump "a" reads from client "a", writes to server "b".
+  Pipe server_b;  // Data pump "b" reads from client "b", writes to server "a".
+  auto channel_a = std::make_unique<MockEndpointChannel>(
+      &server_a.GetInputStream(), &client_a.GetOutputStream());
+  auto channel_b = std::make_unique<MockEndpointChannel>(
+      &server_b.GetInputStream(), &client_b.GetOutputStream());
+  auto channel_a_raw = channel_a.get();
+  auto channel_b_raw = channel_b.get();
+
+  ON_CALL(*channel_a_raw, GetMedium).WillByDefault([]() {
+    return Medium::BLUETOOTH;
+  });
+  ON_CALL(*channel_b_raw, GetMedium).WillByDefault([]() {
+    return Medium::BLUETOOTH;
+  });
+
+  MultiThreadExecutor executor(2);
+  executor.Execute(MakeDataPump(
+      kPumpA, &client_a.GetInputStream(), &server_b.GetOutputStream(),
+      MakeDataMonitor(kMonitorA, &capture_a, &mutex)));
+  executor.Execute(MakeDataPump(
+      kPumpB, &client_b.GetInputStream(), &server_a.GetOutputStream(),
+      MakeDataMonitor(kMonitorB, &capture_b, &mutex)));
+
+  // Run DH key exchange; setup encryption contexts for channels.
+  auto context = DoDhKeyExchange(channel_a.get(), channel_b.get());
+  ASSERT_NE(context.first, nullptr);
+  ASSERT_NE(context.second, nullptr);
+
+  EndpointChannelManager ecm_a;
+  ecm_a.EncryptChannelForEndpoint(std::string(kEndpointId),
+                                  std::move(context.first));
+  ecm_a.ReplaceChannelForEndpoint(&proxy_a, std::string(kEndpointId),
+                                  std::move(channel_a), false);
+
+  EndpointChannelManager ecm_b;
+  ecm_b.EncryptChannelForEndpoint(std::string(kEndpointId),
+                                  std::move(context.second));
+  ecm_b.ReplaceChannelForEndpoint(&proxy_b, std::string(kEndpointId),
+                                  std::move(channel_b), false);
+
+  EXPECT_EQ(channel_a_raw->GetType(), "BLUETOOTH");
+  EXPECT_EQ(channel_b_raw->GetType(), "BLUETOOTH");
+
+  // Shutdown test environment.
+  channel_a_raw->Close(DisconnectionReason::LOCAL_DISCONNECTION);
+  channel_b_raw->Close(DisconnectionReason::REMOTE_DISCONNECTION);
+}
+
+}  // namespace
 }  // namespace connections
 }  // namespace nearby
 }  // namespace location

connections/implementation/fake_bwu_handler.h

@@ -15,8 +15,11 @@
 #ifndef NEARBY_CONNECTIONS_IMPLEMENTATION_FAKE_BWU_HANDLER_H_
 #define NEARBY_CONNECTIONS_IMPLEMENTATION_FAKE_BWU_HANDLER_H_
 
+#include <memory>
+#include <optional>
 #include <string>
 #include <utility>
+#include <vector>
 
 #include "connections/implementation/base_bwu_handler.h"
 #include "connections/implementation/bwu_manager.h"
@@ -40,8 +43,8 @@ class FakeBwuHandler : public BaseBwuHandler {
   // every method.
   struct InputData {
     ClientProxy* client = nullptr;
-    absl::optional<std::string> service_id;
-    absl::optional<std::string> endpoint_id;
+    std::optional<std::string> service_id;
+    std::optional<std::string> endpoint_id;
   };
 
   explicit FakeBwuHandler(Medium medium)
@@ -76,7 +79,8 @@ class FakeBwuHandler : public BaseBwuHandler {
     FakeEndpointChannel* upgraded_channel_raw = upgraded_channel.get();
     upgraded_channel->set_read_output(
         ExceptionOr<ByteArray>(parser::ForBwuIntroduction(
-            *handle_initialize_calls_[initialize_call_index].endpoint_id)));
+            *handle_initialize_calls_[initialize_call_index].endpoint_id,
+            false /* supports_disabling_encryption */)));
     auto connection = std::make_unique<IncomingSocketConnection>();
     connection->channel = std::move(upgraded_channel);
 

connections/implementation/offline_frames.cc

@@ -15,9 +15,10 @@
 #include "connections/implementation/offline_frames.h"
 
 #include <memory>
+#include <string>
 #include <utility>
+#include <vector>
 
-#include "connections/implementation/message_lite.h"
 #include "connections/implementation/offline_frames_validator.h"
 #include "connections/status.h"
 #include "internal/platform/byte_array.h"
@@ -323,7 +324,8 @@ ByteArray ForBwuSafeToClose() {
   return ToBytes(std::move(frame));
 }
 
-ByteArray ForBwuIntroduction(const std::string& endpoint_id) {
+ByteArray ForBwuIntroduction(const std::string& endpoint_id,
+                             bool supports_disabling_encryption) {
   OfflineFrame frame;
 
   frame.set_version(OfflineFrame::V1);
@@ -334,6 +336,8 @@ ByteArray ForBwuIntroduction(const std::string& endpoint_id) {
       BandwidthUpgradeNegotiationFrame::CLIENT_INTRODUCTION);
   auto* client_introduction = sub_frame->mutable_client_introduction();
   client_introduction->set_endpoint_id(endpoint_id);
+  client_introduction->set_supports_disabling_encryption(
+      supports_disabling_encryption);
 
   return ToBytes(std::move(frame));
 }

connections/implementation/offline_frames.h

@@ -16,6 +16,7 @@
 #define CORE_INTERNAL_OFFLINE_FRAMES_H_
 
 #include <cstdint>
+#include <string>
 #include <vector>
 
 #include "connections/implementation/proto/offline_wire_formats.pb.h"
@@ -54,7 +55,8 @@ ByteArray ForControlPayloadTransfer(
     const PayloadTransferFrame::ControlMessage& control);
 
 // Builds Bandwidth Upgrade [BWU] messages.
-ByteArray ForBwuIntroduction(const std::string& endpoint_id);
+ByteArray ForBwuIntroduction(const std::string& endpoint_id,
+                             bool supports_disabling_encryption);
 ByteArray ForBwuIntroductionAck();
 ByteArray ForBwuWifiHotspotPathAvailable(const std::string& ssid,
                                          const std::string& password,

connections/implementation/offline_frames_test.cc

@@ -16,6 +16,7 @@
 
 #include <array>
 #include <memory>
+#include <string>
 #include <utility>
 #include <vector>
 
@@ -372,10 +373,14 @@ TEST(OfflineFramesTest, CanGenerateBwuIntroduction) {
       type: BANDWIDTH_UPGRADE_NEGOTIATION
       bandwidth_upgrade_negotiation: <
         event_type: CLIENT_INTRODUCTION
-        client_introduction: < endpoint_id: "ABC" >
+        client_introduction: < 
+          endpoint_id: "ABC"
+          supports_disabling_encryption: false
+        >
       >
     >)pb";
-  ByteArray bytes = ForBwuIntroduction(std::string(kEndpointId));
+  ByteArray bytes = ForBwuIntroduction(
+      std::string(kEndpointId), false /* supports_disabling_encryption */);
   auto response = FromBytes(bytes);
   ASSERT_TRUE(response.ok());
   OfflineFrame message = FromBytes(bytes).result();

connections/implementation/wifi_hotspot_bwu_handler.cc

@@ -81,8 +81,11 @@ ByteArray WifiHotspotBwuHandler::HandleInitializeUpgradedMediumForEndpoint(
                     << ",  Password:" << password << ",  Port:" << port
                     << ",  Gateway:" << gateway;
 
-  return parser::ForBwuWifiHotspotPathAvailable(ssid, password, port, gateway,
-                                                false);
+  bool disabling_encryption =
+      (client->GetAdvertisingOptions().strategy == Strategy::kP2pPointToPoint);
+  return parser::ForBwuWifiHotspotPathAvailable(
+      ssid, password, port, gateway,
+      /* supports_disabling_encryption */ disabling_encryption);
 }
 
 void WifiHotspotBwuHandler::HandleRevertInitiatorStateForService(