diff options
| author | Marcel Holtmann <marcel@holtmann.org> | 2014-03-19 21:10:25 (GMT) |
|---|---|---|
| committer | Johan Hedberg <johan.hedberg@intel.com> | 2014-03-19 21:30:32 (GMT) |
| commit | 40b552aa5a0bfa785bc7ddb5c2d7965b1e0bb08d (patch) | |
| tree | 3ea70beb7e49dd1e890efdc6a068756dd7e6d744 /net/bluetooth/hci_event.c | |
| parent | 4e7b2030c452e5d885d36d4f44ef33d6ceb9759a (diff) | |
| download | linux-40b552aa5a0bfa785bc7ddb5c2d7965b1e0bb08d.tar.xz | |
Bluetooth: Enforce strict Secure Connections Only mode security
In Secure Connections Only mode, it is required that Secure Connections
is used for pairing and that the link key is encrypted with AES-CCM using
a P-256 authenticated combination key. If this is not the case, then new
connection shall be refused or existing connections shall be dropped.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Diffstat (limited to 'net/bluetooth/hci_event.c')
| -rw-r--r-- | net/bluetooth/hci_event.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index e97f190..a6a3d32 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -2183,6 +2183,18 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb) if (!ev->status) conn->state = BT_CONNECTED; + /* In Secure Connections Only mode, do not allow any + * connections that are not encrypted with AES-CCM + * using a P-256 authenticated combination key. + */ + if (test_bit(HCI_SC_ONLY, &hdev->dev_flags) && + (!test_bit(HCI_CONN_AES_CCM, &conn->flags) || + conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) { + hci_proto_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE); + hci_conn_drop(conn); + goto unlock; + } + hci_proto_connect_cfm(conn, ev->status); hci_conn_drop(conn); } else |