Bluetooth: Fix RFCOMM usage of in-kernel L2CAP sockets

[safe/jmp/linux-2.6] / net / bluetooth / rfcomm / core.c

diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index db83f92..1d0fb0f 100644 (file)
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -46,7 +46,7 @@
 #include <net/bluetooth/l2cap.h>
 #include <net/bluetooth/rfcomm.h>
 
-#define VERSION "1.10"
+#define VERSION "1.11"
 
 static int disable_cfc = 0;
 static int channel_mtu = -1;
@@ -226,8 +226,22 @@ static int rfcomm_l2sock_create(struct socket **sock)
 static inline int rfcomm_check_security(struct rfcomm_dlc *d)
 {
        struct sock *sk = d->session->sock->sk;
+       __u8 auth_type;
 
-       return hci_conn_security(l2cap_pi(sk)->conn->hcon, d->sec_level);
+       switch (d->sec_level) {
+       case BT_SECURITY_HIGH:
+               auth_type = HCI_AT_GENERAL_BONDING_MITM;
+               break;
+       case BT_SECURITY_MEDIUM:
+               auth_type = HCI_AT_GENERAL_BONDING;
+               break;
+       default:
+               auth_type = HCI_AT_NO_BONDING;
+               break;
+       }
+
+       return hci_conn_security(l2cap_pi(sk)->conn->hcon, d->sec_level,
+                                                               auth_type);
 }
 
 /* ---- RFCOMM DLCs ---- */
@@ -434,6 +448,7 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
                break;
 
        case BT_OPEN:
+       case BT_CONNECT2:
                if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                        set_bit(RFCOMM_AUTH_REJECT, &d->flags);
                        rfcomm_schedule(RFCOMM_SCHED_AUTH);
@@ -643,6 +658,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
        bacpy(&addr.l2_bdaddr, src);
        addr.l2_family = AF_BLUETOOTH;
        addr.l2_psm    = 0;
+       addr.l2_cid    = 0;
        *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
        if (*err < 0)
                goto failed;
@@ -664,6 +680,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
        bacpy(&addr.l2_bdaddr, dst);
        addr.l2_family = AF_BLUETOOTH;
        addr.l2_psm    = htobs(RFCOMM_PSM);
+       addr.l2_cid    = 0;
        *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
        if (*err == 0 || *err == -EINPROGRESS)
                return s;
@@ -1194,6 +1211,11 @@ static void rfcomm_check_accept(struct rfcomm_dlc *d)
                if (d->defer_setup) {
                        set_bit(RFCOMM_DEFER_SETUP, &d->flags);
                        rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
+
+                       rfcomm_dlc_lock(d);
+                       d->state = BT_CONNECT2;
+                       d->state_change(d, 0);
+                       rfcomm_dlc_unlock(d);
                } else
                        rfcomm_dlc_accept(d);
        } else {
@@ -1735,6 +1757,11 @@ static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
                                if (d->defer_setup) {
                                        set_bit(RFCOMM_DEFER_SETUP, &d->flags);
                                        rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
+
+                                       rfcomm_dlc_lock(d);
+                                       d->state = BT_CONNECT2;
+                                       d->state_change(d, 0);
+                                       rfcomm_dlc_unlock(d);
                                } else
                                        rfcomm_dlc_accept(d);
                        }
@@ -1749,6 +1776,9 @@ static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
                        continue;
                }
 
+               if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
+                       continue;
+
                if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
                        continue;
 
@@ -1891,6 +1921,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
        bacpy(&addr.l2_bdaddr, ba);
        addr.l2_family = AF_BLUETOOTH;
        addr.l2_psm    = htobs(RFCOMM_PSM);
+       addr.l2_cid    = 0;
        err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
        if (err < 0) {
                BT_ERR("Bind failed %d", err);
@@ -1979,12 +2010,23 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
        list_for_each_safe(p, n, &s->dlcs) {
                d = list_entry(p, struct rfcomm_dlc, list);
 
-               if (!status && encrypt == 0x00 &&
-                               d->sec_level == BT_SECURITY_HIGH &&
-                                       (d->state == BT_CONNECTED ||
-                                               d->state == BT_CONFIG)) {
-                       __rfcomm_dlc_close(d, ECONNREFUSED);
-                       continue;
+               if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
+                       rfcomm_dlc_clear_timer(d);
+                       if (status || encrypt == 0x00) {
+                               __rfcomm_dlc_close(d, ECONNREFUSED);
+                               continue;
+                       }
+               }
+
+               if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
+                       if (d->sec_level == BT_SECURITY_MEDIUM) {
+                               set_bit(RFCOMM_SEC_PENDING, &d->flags);
+                               rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
+                               continue;
+                       } else if (d->sec_level == BT_SECURITY_HIGH) {
+                               __rfcomm_dlc_close(d, ECONNREFUSED);
+                               continue;
+                       }
                }
 
                if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))