~sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget!/translations/zh_CN/security/SCTPmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget!/translations/zh_TW/security/SCTPmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget!/translations/it_IT/security/SCTPmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget!/translations/ja_JP/security/SCTPmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget!/translations/ko_KR/security/SCTPmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hPortuguese (Brazilian)}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget!/translations/pt_BR/security/SCTPmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget!/translations/sp_SP/security/SCTPmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhh;/var/lib/git/docbuild/linux/Documentation/security/SCTP.rsthKubhsection)}(hhh](htitle)}(hSCTPh]hSCTP}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hSCTP LSM Supporth]hSCTP LSM Support}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hSecurity Hooksh]hSecurity Hooks}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhK ubh paragraph)}(hNFor security module support, three SCTP specific hooks have been implemented::h]hMFor security module support, three SCTP specific hooks have been implemented:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh literal_block)}(husecurity_sctp_assoc_request() security_sctp_bind_connect() security_sctp_sk_clone() security_sctp_assoc_established()h]husecurity_sctp_assoc_request() security_sctp_bind_connect() security_sctp_sk_clone() security_sctp_assoc_established()}hjsbah}(h]h ]h"]h$]h&]hhuh1jhhhKhhhhubj)}(h~The usage of these hooks are described below with the SELinux implementation described in the `SCTP SELinux Support`_ chapter.h](h^The usage of these hooks are described below with the SELinux implementation described in the }(hjhhhNhNubh reference)}(h`SCTP SELinux Support`_h]hSCTP SELinux Support}(hj)hhhNhNubah}(h]h ]h"]h$]h&]nameSCTP SELinux Supportrefidsctp-selinux-supportuh1j'hjresolvedKubh chapter.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hhh](h)}(hsecurity_sctp_assoc_request()h]hsecurity_sctp_assoc_request()}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjFhhhhhKubj)}(hPasses the ``@asoc`` and ``@chunk->skb`` of the association INIT packet to the security module. Returns 0 on success, error on failure. ::h](h Passes the }(hjWhhhNhNubhliteral)}(h ``@asoc``h]h@asoc}(hjahhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjWubh and }(hjWhhhNhNubj`)}(h``@chunk->skb``h]h @chunk->skb}(hjshhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjWubh_ of the association INIT packet to the security module. Returns 0 on success, error on failure.}(hjWhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjFhhubj)}(h^@asoc - pointer to sctp association structure. @skb - pointer to skbuff of association packet.h]h^@asoc - pointer to sctp association structure. @skb - pointer to skbuff of association packet.}hjsbah}(h]h ]h"]h$]h&]hhuh1jhhhKhjFhhubeh}(h]security-sctp-assoc-requestah ]h"]h$]security_sctp_assoc_request()ah&]uh1hhhhhhhhK referencedKubh)}(hhh](h)}(hsecurity_sctp_bind_connect()h]hsecurity_sctp_bind_connect()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK#ubj)}(hPasses one or more ipv4/ipv6 addresses to the security module for validation based on the ``@optname`` that will result in either a bind or connect service as shown in the permission check tables below. Returns 0 on success, error on failure. ::h](hZPasses one or more ipv4/ipv6 addresses to the security module for validation based on the }(hjhhhNhNubj`)}(h ``@optname``h]h@optname}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubh that will result in either a bind or connect service as shown in the permission check tables below. Returns 0 on success, error on failure.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK$hjhhubj)}(hX @sk - Pointer to sock structure. @optname - Name of the option to validate. @address - One or more ipv4 / ipv6 addresses. @addrlen - The total length of address(s). This is calculated on each ipv4 or ipv6 address using sizeof(struct sockaddr_in) or sizeof(struct sockaddr_in6). ------------------------------------------------------------------ | BIND Type Checks | | @optname | @address contains | |----------------------------|-----------------------------------| | SCTP_SOCKOPT_BINDX_ADD | One or more ipv4 / ipv6 addresses | | SCTP_PRIMARY_ADDR | Single ipv4 or ipv6 address | | SCTP_SET_PEER_PRIMARY_ADDR | Single ipv4 or ipv6 address | ------------------------------------------------------------------ ------------------------------------------------------------------ | CONNECT Type Checks | | @optname | @address contains | |----------------------------|-----------------------------------| | SCTP_SOCKOPT_CONNECTX | One or more ipv4 / ipv6 addresses | | SCTP_PARAM_ADD_IP | One or more ipv4 / ipv6 addresses | | SCTP_SENDMSG_CONNECT | Single ipv4 or ipv6 address | | SCTP_PARAM_SET_PRIMARY | Single ipv4 or ipv6 address | ------------------------------------------------------------------h]hX @sk - Pointer to sock structure. @optname - Name of the option to validate. @address - One or more ipv4 / ipv6 addresses. @addrlen - The total length of address(s). This is calculated on each ipv4 or ipv6 address using sizeof(struct sockaddr_in) or sizeof(struct sockaddr_in6). ------------------------------------------------------------------ | BIND Type Checks | | @optname | @address contains | |----------------------------|-----------------------------------| | SCTP_SOCKOPT_BINDX_ADD | One or more ipv4 / ipv6 addresses | | SCTP_PRIMARY_ADDR | Single ipv4 or ipv6 address | | SCTP_SET_PEER_PRIMARY_ADDR | Single ipv4 or ipv6 address | ------------------------------------------------------------------ ------------------------------------------------------------------ | CONNECT Type Checks | | @optname | @address contains | |----------------------------|-----------------------------------| | SCTP_SOCKOPT_CONNECTX | One or more ipv4 / ipv6 addresses | | SCTP_PARAM_ADD_IP | One or more ipv4 / ipv6 addresses | | SCTP_SENDMSG_CONNECT | Single ipv4 or ipv6 address | | SCTP_PARAM_SET_PRIMARY | Single ipv4 or ipv6 address | ------------------------------------------------------------------}hjsbah}(h]h ]h"]h$]h&]hhuh1jhhhK*hjhhubj)}(h5A summary of the ``@optname`` entries is as follows::h](hA summary of the }(hjhhhNhNubj`)}(h ``@optname``h]h@optname}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubh entries is as follows:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKDhjhhubj)}(hX SCTP_SOCKOPT_BINDX_ADD - Allows additional bind addresses to be associated after (optionally) calling bind(3). sctp_bindx(3) adds a set of bind addresses on a socket. SCTP_SOCKOPT_CONNECTX - Allows the allocation of multiple addresses for reaching a peer (multi-homed). sctp_connectx(3) initiates a connection on an SCTP socket using multiple destination addresses. SCTP_SENDMSG_CONNECT - Initiate a connection that is generated by a sendmsg(2) or sctp_sendmsg(3) on a new association. SCTP_PRIMARY_ADDR - Set local primary address. SCTP_SET_PEER_PRIMARY_ADDR - Request peer sets address as association primary. SCTP_PARAM_ADD_IP - These are used when Dynamic Address SCTP_PARAM_SET_PRIMARY - Reconfiguration is enabled as explained below.h]hX SCTP_SOCKOPT_BINDX_ADD - Allows additional bind addresses to be associated after (optionally) calling bind(3). sctp_bindx(3) adds a set of bind addresses on a socket. SCTP_SOCKOPT_CONNECTX - Allows the allocation of multiple addresses for reaching a peer (multi-homed). sctp_connectx(3) initiates a connection on an SCTP socket using multiple destination addresses. SCTP_SENDMSG_CONNECT - Initiate a connection that is generated by a sendmsg(2) or sctp_sendmsg(3) on a new association. SCTP_PRIMARY_ADDR - Set local primary address. SCTP_SET_PEER_PRIMARY_ADDR - Request peer sets address as association primary. SCTP_PARAM_ADD_IP - These are used when Dynamic Address SCTP_PARAM_SET_PRIMARY - Reconfiguration is enabled as explained below.}hjsbah}(h]h ]h"]h$]h&]hhuh1jhhhKFhjhhubj)}(hTo support Dynamic Address Reconfiguration the following parameters must be enabled on both endpoints (or use the appropriate **setsockopt**\(2))::h](h~To support Dynamic Address Reconfiguration the following parameters must be enabled on both endpoints (or use the appropriate }(hjhhhNhNubhstrong)}(h**setsockopt**h]h setsockopt}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh(2)):}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK_hjhhubj)}(hF/proc/sys/net/sctp/addip_enable /proc/sys/net/sctp/addip_noauth_enableh]hF/proc/sys/net/sctp/addip_enable /proc/sys/net/sctp/addip_noauth_enable}hj1sbah}(h]h ]h"]h$]h&]hhuh1jhhhKbhjhhubj)}(hzthen the following *_PARAM_*'s are sent to the peer in an ASCONF chunk when the corresponding ``@optname``'s are present::h](hthen the following }(hj?hhhNhNubhemphasis)}(h *_PARAM_*h]h_PARAM_}(hjIhhhNhNubah}(h]h ]h"]h$]h&]uh1jGhj?ubhD’s are sent to the peer in an ASCONF chunk when the corresponding }(hj?hhhNhNubj`)}(h ``@optname``h]h@optname}(hj[hhhNhNubah}(h]h ]h"]h$]h&]uh1j_hj?ubh’s are present:}(hj?hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKehjhhubj)}(h @optname ASCONF Parameter ---------- ------------------ SCTP_SOCKOPT_BINDX_ADD -> SCTP_PARAM_ADD_IP SCTP_SET_PEER_PRIMARY_ADDR -> SCTP_PARAM_SET_PRIMARYh]h @optname ASCONF Parameter ---------- ------------------ SCTP_SOCKOPT_BINDX_ADD -> SCTP_PARAM_ADD_IP SCTP_SET_PEER_PRIMARY_ADDR -> SCTP_PARAM_SET_PRIMARY}hjssbah}(h]h ]h"]h$]h&]hhuh1jhhhKhhjhhubeh}(h]security-sctp-bind-connectah ]h"]h$]security_sctp_bind_connect()ah&]uh1hhhhhhhhK#jKubh)}(hhh](h)}(hsecurity_sctp_sk_clone()h]hsecurity_sctp_sk_clone()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKoubj)}(hCalled whenever a new socket is created by **accept**\(2) (i.e. a TCP style socket) or when a socket is 'peeled off' e.g userspace calls **sctp_peeloff**\(3). ::h](h+Called whenever a new socket is created by }(hjhhhNhNubj)}(h **accept**h]haccept}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhX(2) (i.e. a TCP style socket) or when a socket is ‘peeled off’ e.g userspace calls }(hjhhhNhNubj)}(h**sctp_peeloff**h]h sctp_peeloff}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh(3).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKphjhhubj)}(h@asoc - pointer to current sctp association structure. @sk - pointer to current sock structure. @newsk - pointer to new sock structure.h]h@asoc - pointer to current sctp association structure. @sk - pointer to current sock structure. @newsk - pointer to new sock structure.}hjsbah}(h]h ]h"]h$]h&]hhuh1jhhhKuhjhhubeh}(h]security-sctp-sk-cloneah ]h"]h$]security_sctp_sk_clone()ah&]uh1hhhhhhhhKojKubh)}(hhh](h)}(h!security_sctp_assoc_established()h]h!security_sctp_assoc_established()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK{ubj)}(hnCalled when a COOKIE ACK is received, and the peer secid will be saved into ``@asoc->peer_secid`` for client::h](hLCalled when a COOKIE ACK is received, and the peer secid will be saved into }(hjhhhNhNubj`)}(h``@asoc->peer_secid``h]h@asoc->peer_secid}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubh for client:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK|hjhhubj)}(ha@asoc - pointer to sctp association structure. @skb - pointer to skbuff of the COOKIE ACK packet.h]ha@asoc - pointer to sctp association structure. @skb - pointer to skbuff of the COOKIE ACK packet.}hjsbah}(h]h ]h"]h$]h&]hhuh1jhhhKhjhhubeh}(h]security-sctp-assoc-establishedah ]h"]h$]!security_sctp_assoc_established()ah&]uh1hhhhhhhhK{jKubeh}(h]security-hooksah ]h"]h$]security hooksah&]uh1hhhhhhhhK jKubh)}(hhh](h)}(h1Security Hooks used for Association Establishmenth]h1Security Hooks used for Association Establishment}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj1hhhhhKubj)}(hThe following diagram shows the use of ``security_sctp_bind_connect()``, ``security_sctp_assoc_request()``, ``security_sctp_assoc_established()`` when establishing an association. ::h](h'The following diagram shows the use of }(hjBhhhNhNubj`)}(h ``security_sctp_bind_connect()``h]hsecurity_sctp_bind_connect()}(hjJhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjBubh, }(hjBhhhNhNubj`)}(h!``security_sctp_assoc_request()``h]hsecurity_sctp_assoc_request()}(hj\hhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjBubh, }(hjBhhhNhNubj`)}(h%``security_sctp_assoc_established()``h]h!security_sctp_assoc_established()}(hjnhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjBubh" when establishing an association.}(hjBhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhj1hhubj)}(hX SCTP endpoint "A" SCTP endpoint "Z" ================= ================= sctp_sf_do_prm_asoc() Association setup can be initiated by a connect(2), sctp_connectx(3), sendmsg(2) or sctp_sendmsg(3). These will result in a call to security_sctp_bind_connect() to initiate an association to SCTP peer endpoint "Z". INIT ---------------------------------------------> sctp_sf_do_5_1B_init() Respond to an INIT chunk. SCTP peer endpoint "A" is asking for a temporary association. Call security_sctp_assoc_request() to set the peer label if first association. If not first association, check whether allowed, IF so send: <----------------------------------------------- INIT ACK | ELSE audit event and silently | discard the packet. | COOKIE ECHO ------------------------------------------> sctp_sf_do_5_1D_ce() Respond to an COOKIE ECHO chunk. Confirm the cookie and create a permanent association. Call security_sctp_assoc_request() to do the same as for INIT chunk Response. <------------------------------------------- COOKIE ACK | | sctp_sf_do_5_1E_ca | Call security_sctp_assoc_established() | to set the peer label. | | | | If SCTP_SOCKET_TCP or peeled off | socket security_sctp_sk_clone() is | called to clone the new socket. | | ESTABLISHED ESTABLISHED | | ------------------------------------------------------------------ | Association Established | ------------------------------------------------------------------h]hX SCTP endpoint "A" SCTP endpoint "Z" ================= ================= sctp_sf_do_prm_asoc() Association setup can be initiated by a connect(2), sctp_connectx(3), sendmsg(2) or sctp_sendmsg(3). These will result in a call to security_sctp_bind_connect() to initiate an association to SCTP peer endpoint "Z". INIT ---------------------------------------------> sctp_sf_do_5_1B_init() Respond to an INIT chunk. SCTP peer endpoint "A" is asking for a temporary association. Call security_sctp_assoc_request() to set the peer label if first association. If not first association, check whether allowed, IF so send: <----------------------------------------------- INIT ACK | ELSE audit event and silently | discard the packet. | COOKIE ECHO ------------------------------------------> sctp_sf_do_5_1D_ce() Respond to an COOKIE ECHO chunk. Confirm the cookie and create a permanent association. Call security_sctp_assoc_request() to do the same as for INIT chunk Response. <------------------------------------------- COOKIE ACK | | sctp_sf_do_5_1E_ca | Call security_sctp_assoc_established() | to set the peer label. | | | | If SCTP_SOCKET_TCP or peeled off | socket security_sctp_sk_clone() is | called to clone the new socket. | | ESTABLISHED ESTABLISHED | | ------------------------------------------------------------------ | Association Established | ------------------------------------------------------------------}hjsbah}(h]h ]h"]h$]h&]hhuh1jhhhKhj1hhubeh}(h]1security-hooks-used-for-association-establishmentah ]h"]1security hooks used for association establishmentah$]h&]uh1hhhhhhhhKubeh}(h]sctp-lsm-supportah ]h"]sctp lsm supportah$]h&]uh1hhhhhhhhKjKubh)}(hhh](h)}(hSCTP SELinux Supporth]hSCTP SELinux Support}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(hSecurity Hooksh]hSecurity Hooks}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubj)}(h}The `SCTP LSM Support`_ chapter above describes the following SCTP security hooks with the SELinux specifics expanded below::h](hThe }(hjhhhNhNubj()}(h`SCTP LSM Support`_h]hSCTP LSM Support}(hjhhhNhNubah}(h]h ]h"]h$]h&]nameSCTP LSM Supportj9juh1j'hjj;Kubhe chapter above describes the following SCTP security hooks with the SELinux specifics expanded below:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj)}(husecurity_sctp_assoc_request() security_sctp_bind_connect() security_sctp_sk_clone() security_sctp_assoc_established()h]husecurity_sctp_assoc_request() security_sctp_bind_connect() security_sctp_sk_clone() security_sctp_assoc_established()}hjsbah}(h]h ]h"]h$]h&]hhuh1jhhhKhjhhubh)}(hhh](h)}(hsecurity_sctp_assoc_request()h]hsecurity_sctp_assoc_request()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubj)}(hPasses the ``@asoc`` and ``@chunk->skb`` of the association INIT packet to the security module. Returns 0 on success, error on failure. ::h](h Passes the }(hjhhhNhNubj`)}(h ``@asoc``h]h@asoc}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubh and }(hjhhhNhNubj`)}(h``@chunk->skb``h]h @chunk->skb}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubh_ of the association INIT packet to the security module. Returns 0 on success, error on failure.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj)}(h^@asoc - pointer to sctp association structure. @skb - pointer to skbuff of association packet.h]h^@asoc - pointer to sctp association structure. @skb - pointer to skbuff of association packet.}hj9sbah}(h]h ]h"]h$]h&]hhuh1jhhhKhjhhubhdefinition_list)}(hhh]hdefinition_list_item)}(hXThe security module performs the following operations: IF this is the first association on ``@asoc->base.sk``, then set the peer sid to that in ``@skb``. This will ensure there is only one peer sid assigned to ``@asoc->base.sk`` that may support multiple associations. ELSE validate the ``@asoc->base.sk peer_sid`` against the ``@skb peer sid`` to determine whether the association should be allowed or denied. Set the sctp ``@asoc sid`` to socket's sid (from ``asoc->base.sk``) with MLS portion taken from ``@skb peer sid``. This will be used by SCTP TCP style sockets and peeled off connections as they cause a new socket to be generated. If IP security options are configured (CIPSO/CALIPSO), then the ip options are set on the socket. h](hterm)}(h6The security module performs the following operations:h]h6The security module performs the following operations:}(hjThhhNhNubah}(h]h ]h"]h$]h&]uh1jRhhhKhjNubh definition)}(hhh](j)}(hIF this is the first association on ``@asoc->base.sk``, then set the peer sid to that in ``@skb``. This will ensure there is only one peer sid assigned to ``@asoc->base.sk`` that may support multiple associations.h](h$IF this is the first association on }(hjghhhNhNubj`)}(h``@asoc->base.sk``h]h@asoc->base.sk}(hjohhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjgubh#, then set the peer sid to that in }(hjghhhNhNubj`)}(h``@skb``h]h@skb}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjgubh:. This will ensure there is only one peer sid assigned to }(hjghhhNhNubj`)}(h``@asoc->base.sk``h]h@asoc->base.sk}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjgubh( that may support multiple associations.}(hjghhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjdubj)}(hELSE validate the ``@asoc->base.sk peer_sid`` against the ``@skb peer sid`` to determine whether the association should be allowed or denied.h](hELSE validate the }(hjhhhNhNubj`)}(h``@asoc->base.sk peer_sid``h]h@asoc->base.sk peer_sid}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubh against the }(hjhhhNhNubj`)}(h``@skb peer sid``h]h @skb peer sid}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubhB to determine whether the association should be allowed or denied.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjdubj)}(hSet the sctp ``@asoc sid`` to socket's sid (from ``asoc->base.sk``) with MLS portion taken from ``@skb peer sid``. This will be used by SCTP TCP style sockets and peeled off connections as they cause a new socket to be generated.h](h Set the sctp }(hjhhhNhNubj`)}(h ``@asoc sid``h]h @asoc sid}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubh to socket’s sid (from }(hjhhhNhNubj`)}(h``asoc->base.sk``h]h asoc->base.sk}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubh) with MLS portion taken from }(hjhhhNhNubj`)}(h``@skb peer sid``h]h @skb peer sid}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubht. This will be used by SCTP TCP style sockets and peeled off connections as they cause a new socket to be generated.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjdubj)}(haIf IP security options are configured (CIPSO/CALIPSO), then the ip options are set on the socket.h]haIf IP security options are configured (CIPSO/CALIPSO), then the ip options are set on the socket.}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjdubeh}(h]h ]h"]h$]h&]uh1jbhjNubeh}(h]h ]h"]h$]h&]uh1jLhhhKhjIubah}(h]h ]h"]h$]h&]uh1jGhjhhhhhNubeh}(h]id2ah ]h"]h$]jah&]uh1hhjhhhhhKjKubh)}(hhh](h)}(hsecurity_sctp_bind_connect()h]hsecurity_sctp_bind_connect()}(hjKhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjHhhhhhKubj)}(hZChecks permissions required for ipv4/ipv6 addresses based on the ``@optname`` as follows::h](hAChecks permissions required for ipv4/ipv6 addresses based on the }(hjYhhhNhNubj`)}(h ``@optname``h]h@optname}(hjahhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjYubh as follows:}(hjYhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjHhhubj)}(hXs------------------------------------------------------------------ | BIND Permission Checks | | @optname | @address contains | |----------------------------|-----------------------------------| | SCTP_SOCKOPT_BINDX_ADD | One or more ipv4 / ipv6 addresses | | SCTP_PRIMARY_ADDR | Single ipv4 or ipv6 address | | SCTP_SET_PEER_PRIMARY_ADDR | Single ipv4 or ipv6 address | ------------------------------------------------------------------ ------------------------------------------------------------------ | CONNECT Permission Checks | | @optname | @address contains | |----------------------------|-----------------------------------| | SCTP_SOCKOPT_CONNECTX | One or more ipv4 / ipv6 addresses | | SCTP_PARAM_ADD_IP | One or more ipv4 / ipv6 addresses | | SCTP_SENDMSG_CONNECT | Single ipv4 or ipv6 address | | SCTP_PARAM_SET_PRIMARY | Single ipv4 or ipv6 address | ------------------------------------------------------------------h]hXs------------------------------------------------------------------ | BIND Permission Checks | | @optname | @address contains | |----------------------------|-----------------------------------| | SCTP_SOCKOPT_BINDX_ADD | One or more ipv4 / ipv6 addresses | | SCTP_PRIMARY_ADDR | Single ipv4 or ipv6 address | | SCTP_SET_PEER_PRIMARY_ADDR | Single ipv4 or ipv6 address | ------------------------------------------------------------------ ------------------------------------------------------------------ | CONNECT Permission Checks | | @optname | @address contains | |----------------------------|-----------------------------------| | SCTP_SOCKOPT_CONNECTX | One or more ipv4 / ipv6 addresses | | SCTP_PARAM_ADD_IP | One or more ipv4 / ipv6 addresses | | SCTP_SENDMSG_CONNECT | Single ipv4 or ipv6 address | | SCTP_PARAM_SET_PRIMARY | Single ipv4 or ipv6 address | ------------------------------------------------------------------}hjysbah}(h]h ]h"]h$]h&]hhuh1jhhhKhjHhhubj)}(h`SCTP LSM Support`_ gives a summary of the ``@optname`` entries and also describes ASCONF chunk processing when Dynamic Address Reconfiguration is enabled.h](j()}(h`SCTP LSM Support`_h]hSCTP LSM Support}(hjhhhNhNubah}(h]h ]h"]h$]h&]nameSCTP LSM Supportj9juh1j'hjj;Kubh gives a summary of the }(hjhhhNhNubj`)}(h ``@optname``h]h@optname}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubhd entries and also describes ASCONF chunk processing when Dynamic Address Reconfiguration is enabled.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjHhhubeh}(h]id3ah ]h"]h$]jah&]uh1hhjhhhhhKjKubh)}(hhh](h)}(hsecurity_sctp_sk_clone()h]hsecurity_sctp_sk_clone()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubj)}(hX4Called whenever a new socket is created by **accept**\(2) (i.e. a TCP style socket) or when a socket is 'peeled off' e.g userspace calls **sctp_peeloff**\(3). ``security_sctp_sk_clone()`` will set the new sockets sid and peer sid to that contained in the ``@asoc sid`` and ``@asoc peer sid`` respectively. ::h](h+Called whenever a new socket is created by }(hjhhhNhNubj)}(h **accept**h]haccept}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhX(2) (i.e. a TCP style socket) or when a socket is ‘peeled off’ e.g userspace calls }(hjhhhNhNubj)}(h**sctp_peeloff**h]h sctp_peeloff}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh(3). }(hjhhhNhNubj`)}(h``security_sctp_sk_clone()``h]hsecurity_sctp_sk_clone()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubhD will set the new sockets sid and peer sid to that contained in the }(hjhhhNhNubj`)}(h ``@asoc sid``h]h @asoc sid}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubh and }(hjhhhNhNubj`)}(h``@asoc peer sid``h]h@asoc peer sid}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubh respectively.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj)}(h@asoc - pointer to current sctp association structure. @sk - pointer to current sock structure. @newsk - pointer to new sock structure.h]h@asoc - pointer to current sctp association structure. @sk - pointer to current sock structure. @newsk - pointer to new sock structure.}hj7sbah}(h]h ]h"]h$]h&]hhuh1jhhhM hjhhubeh}(h]id4ah ]h"]h$]jah&]uh1hhjhhhhhMjKubh)}(hhh](h)}(h!security_sctp_assoc_established()h]h!security_sctp_assoc_established()}(hjOhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjLhhhhhMubj)}(hbCalled when a COOKIE ACK is received where it sets the connection's peer sid to that in ``@skb``::h](hZCalled when a COOKIE ACK is received where it sets the connection’s peer sid to that in }(hj]hhhNhNubj`)}(h``@skb``h]h@skb}(hjehhhNhNubah}(h]h ]h"]h$]h&]uh1j_hj]ubh:}(hj]hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMhjLhhubj)}(ha@asoc - pointer to sctp association structure. @skb - pointer to skbuff of the COOKIE ACK packet.h]ha@asoc - pointer to sctp association structure. @skb - pointer to skbuff of the COOKIE ACK packet.}hj}sbah}(h]h ]h"]h$]h&]hhuh1jhhhMhjLhhubeh}(h]id5ah ]h"]h$]j'ah&]uh1hhjhhhhhMjKubeh}(h]id1ah ]h"]h$]j/ah&]uh1hhjhhhhhKjKubh)}(hhh](h)}(hPolicy Statementsh]hPolicy Statements}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubj)}(hUThe following class and permissions to support SCTP are available within the kernel::h]hTThe following class and permissions to support SCTP are available within the kernel:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj)}(h/class sctp_socket inherits socket { node_bind }h]h/class sctp_socket inherits socket { node_bind }}hjsbah}(h]h ]h"]h$]h&]hhuh1jhhhMhjhhubj)}(h5whenever the following policy capability is enabled::h]h4whenever the following policy capability is enabled:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM hjhhubj)}(h policycap extended_socket_class;h]h policycap extended_socket_class;}hjsbah}(h]h ]h"]h$]h&]hhuh1jhhhM"hjhhubj)}(hSELinux SCTP support adds the ``name_connect`` permission for connecting to a specific port type and the ``association`` permission that is explained in the section below.h](hSELinux SCTP support adds the }(hjhhhNhNubj`)}(h``name_connect``h]h name_connect}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubh; permission for connecting to a specific port type and the }(hjhhhNhNubj`)}(h``association``h]h association}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j_hjubh3 permission that is explained in the section below.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM$hjhhubj)}(huIf userspace tools have been updated, SCTP will support the ``portcon`` statement as shown in the following example::h](h