[PATCH] PR: Use DH group 19 for OOB and allow multiple pairwise ciphers on responder

[Emily Xia]

According to the P2P Proximity Ranging specification D1.8, unauthenticated
mode PASN with DH group 19 is the mandatory baseline supported by all
devices.

For peers discovered via Out-of-Band (OOB) mechanism, peer capabilities
in dev->pr_caps are not known in advance, so defaulting to DH group 19
and CCMP ensures spec compliance and cross-device interoperability.

Additionally, on the responder side, set pasn->rsn_pairwise to accept
both WPA_CIPHER_CCMP and WPA_CIPHER_GCMP_256 so that the responder does
not reject an initiator using CCMP (e.g. in OOB mode) with
WLAN_STATUS_INVALID_RSNE (72) even if DH group 20 is locally supported.

Signed-off-by: Emily Xia <xiayucheng at google.com>
---
 src/common/proximity_ranging.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/common/proximity_ranging.c b/src/common/proximity_ranging.c
index 9e654fb76..ebd48b013 100644
--- a/src/common/proximity_ranging.c
+++ b/src/common/proximity_ranging.c
@@ -1829,8 +1829,10 @@ static int pr_pasn_initialize(struct pr_data *pr, struct pr_device *dev,
 
 	/* As specified in Proximity Ranging Implementation Considerations for
 	 * P2P Operation D1.8, EDCA based ranging is only supported with
-	 * unauthenticated mode PASN with DH group 19. */
-	if (((pr->cfg->pasn_type & 0xc) && (dev->pr_caps.pasn_type & 0xc)) &&
+	 * unauthenticated mode PASN with DH group 19. Also default to group 19
+	 * for OOB discovery where peer capabilities are not known in advance. */
+	if (dev->discovery_type != PR_DISCOVERY_TYPE_OOB &&
+	    ((pr->cfg->pasn_type & 0xc) && (dev->pr_caps.pasn_type & 0xc)) &&
 	    ranging_type != PR_EDCA_BASED_RANGING) {
 		pasn->group = 20;
 		pasn->cipher = WPA_CIPHER_GCMP_256;
@@ -1886,7 +1888,11 @@ static int pr_pasn_initialize(struct pr_data *pr, struct pr_device *dev,
 		pasn->akmp = WPA_KEY_MGMT_PASN;
 	}
 
-	pasn->rsn_pairwise = pasn->cipher;
+	if (dev->discovery_type == PR_DISCOVERY_TYPE_OOB &&
+	    dev->pasn_role == PR_ROLE_PASN_RESPONDER)
+		pasn->rsn_pairwise = WPA_CIPHER_CCMP | WPA_CIPHER_GCMP_256;
+	else
+		pasn->rsn_pairwise = pasn->cipher;
 	pasn->wpa_key_mgmt = pasn->akmp;
 
 	rsnxe = pr_pasn_generate_rsnxe(pr, pasn->akmp);
-- 
2.55.0.737.g08866a6d13-goog