<!DOCTYPE html>
<html lang="en" data-content_root="../">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>SCTP — The Linux Kernel documentation</title>
<link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=fa44fd50" />
<link rel="stylesheet" type="text/css" href="../_static/alabaster.css?v=3918102e" />
<script src="../_static/documentation_options.js?v=5929fcd5"></script>
<script src="../_static/doctools.js?v=9bcbadda"></script>
<script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
<link rel="index" title="Index" href="../genindex.html" />
<link rel="search" title="Search" href="../search.html" />
<link rel="next" title="Kernel Self-Protection" href="self-protection.html" />
<link rel="prev" title="Linux Secure Attention Key (SAK) handling" href="sak.html" />
<link rel="stylesheet" href="../_static/custom.css" type="text/css" />
</head><body>
<div class="document">
<div class="sphinxsidebar" role="navigation" aria-label="Main">
<div class="sphinxsidebarwrapper">
<p class="logo"><a href="../index.html">
<img class="logo" src="../_static/logo.svg" alt="Logo of The Linux Kernel"/>
</a></p>
<h1 class="logo"><a href="../index.html">The Linux Kernel</a></h1>
<p class="blurb">6.18.50</p>
<search id="searchbox" style="display: none" role="search">
<h3 id="searchlabel">Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="../search.html" method="get">
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
<input type="submit" value="Go" />
</form>
</div>
</search>
<script>document.getElementById('searchbox').style.display = "block"</script>
<p>
<h3 class="kernel-toc-contents">Contents</h3>
<input type="checkbox" class="kernel-toc-toggle" id = "kernel-toc-toggle" checked>
<label class="kernel-toc-title" for="kernel-toc-toggle"></label>
<div class="kerneltoc" id="kerneltoc">
<ul>
<li class="toctree-l1"><a class="reference internal" href="../process/development-process.html">Development process</a></li>
<li class="toctree-l1"><a class="reference internal" href="../process/submitting-patches.html">Submitting patches</a></li>
<li class="toctree-l1"><a class="reference internal" href="../process/code-of-conduct.html">Code of conduct</a></li>
<li class="toctree-l1"><a class="reference internal" href="../maintainer/index.html">Maintainer handbook</a></li>
<li class="toctree-l1"><a class="reference internal" href="../process/index.html">All development-process docs</a></li>
</ul>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../core-api/index.html">Core API</a></li>
<li class="toctree-l1"><a class="reference internal" href="../driver-api/index.html">Driver APIs</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="../subsystem-apis.html">Subsystems</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="../subsystem-apis.html#core-subsystems">Core subsystems</a></li>
<li class="toctree-l2"><a class="reference internal" href="../subsystem-apis.html#human-interfaces">Human interfaces</a></li>
<li class="toctree-l2"><a class="reference internal" href="../subsystem-apis.html#networking-interfaces">Networking interfaces</a></li>
<li class="toctree-l2"><a class="reference internal" href="../subsystem-apis.html#storage-interfaces">Storage interfaces</a></li>
<li class="toctree-l2 current"><a class="reference internal" href="../subsystem-apis.html#other-subsystems">Other subsystems</a><ul class="current">
<li class="toctree-l3"><a class="reference internal" href="../accounting/index.html">Accounting</a></li>
<li class="toctree-l3"><a class="reference internal" href="../cpu-freq/index.html">CPUFreq - CPU frequency and voltage scaling code in the Linux(TM) kernel</a></li>
<li class="toctree-l3"><a class="reference internal" href="../edac/index.html">EDAC Subsystem</a></li>
<li class="toctree-l3"><a class="reference internal" href="../fpga/index.html">FPGA</a></li>
<li class="toctree-l3"><a class="reference internal" href="../i2c/index.html">I2C/SMBus Subsystem</a></li>
<li class="toctree-l3"><a class="reference internal" href="../iio/index.html">Industrial I/O</a></li>
<li class="toctree-l3"><a class="reference internal" href="../pcmcia/index.html">PCMCIA</a></li>
<li class="toctree-l3"><a class="reference internal" href="../spi/index.html">Serial Peripheral Interface (SPI)</a></li>
<li class="toctree-l3"><a class="reference internal" href="../w1/index.html">1-Wire Subsystem</a></li>
<li class="toctree-l3"><a class="reference internal" href="../watchdog/index.html">Watchdog Support</a></li>
<li class="toctree-l3"><a class="reference internal" href="../virt/index.html">Virtualization Support</a></li>
<li class="toctree-l3"><a class="reference internal" href="../hwmon/index.html">Hardware Monitoring</a></li>
<li class="toctree-l3"><a class="reference internal" href="../accel/index.html">Compute Accelerators</a></li>
<li class="toctree-l3 current"><a class="reference internal" href="index.html">Security Documentation</a></li>
<li class="toctree-l3"><a class="reference internal" href="../crypto/index.html">Crypto API</a></li>
<li class="toctree-l3"><a class="reference internal" href="../bpf/index.html">BPF Documentation</a></li>
<li class="toctree-l3"><a class="reference internal" href="../usb/index.html">USB support</a></li>
<li class="toctree-l3"><a class="reference internal" href="../PCI/index.html">PCI Bus Subsystem</a></li>
<li class="toctree-l3"><a class="reference internal" href="../misc-devices/index.html">Assorted Miscellaneous Devices Documentation</a></li>
<li class="toctree-l3"><a class="reference internal" href="../peci/index.html">PECI Subsystem</a></li>
<li class="toctree-l3"><a class="reference internal" href="../wmi/index.html">WMI Subsystem</a></li>
<li class="toctree-l3"><a class="reference internal" href="../tee/index.html">TEE Subsystem</a></li>
</ul>
</li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../locking/index.html">Locking</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../process/license-rules.html">Licensing rules</a></li>
<li class="toctree-l1"><a class="reference internal" href="../doc-guide/index.html">Writing documentation</a></li>
<li class="toctree-l1"><a class="reference internal" href="../dev-tools/index.html">Development tools</a></li>
<li class="toctree-l1"><a class="reference internal" href="../dev-tools/testing-overview.html">Testing guide</a></li>
<li class="toctree-l1"><a class="reference internal" href="../kernel-hacking/index.html">Hacking guide</a></li>
<li class="toctree-l1"><a class="reference internal" href="../trace/index.html">Tracing</a></li>
<li class="toctree-l1"><a class="reference internal" href="../fault-injection/index.html">Fault injection</a></li>
<li class="toctree-l1"><a class="reference internal" href="../livepatch/index.html">Livepatching</a></li>
<li class="toctree-l1"><a class="reference internal" href="../rust/index.html">Rust</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../admin-guide/index.html">Administration</a></li>
<li class="toctree-l1"><a class="reference internal" href="../kbuild/index.html">Build system</a></li>
<li class="toctree-l1"><a class="reference internal" href="../admin-guide/reporting-issues.html">Reporting issues</a></li>
<li class="toctree-l1"><a class="reference internal" href="../tools/index.html">Userspace tools</a></li>
<li class="toctree-l1"><a class="reference internal" href="../userspace-api/index.html">Userspace API</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../firmware-guide/index.html">Firmware</a></li>
<li class="toctree-l1"><a class="reference internal" href="../devicetree/index.html">Firmware and Devicetree</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../arch/index.html">CPU architectures</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../staging/index.html">Unsorted documentation</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../translations/index.html">Translations</a></li>
</ul>
</div>
<script type="text/javascript"> <!--
var sbar = document.getElementsByClassName("sphinxsidebar")[0];
let currents = document.getElementsByClassName("current")
if (currents.length) {
sbar.scrollTop = currents[currents.length - 1].offsetTop;
}
--> </script>
<div role="note" aria-label="source link">
<h3>This Page</h3>
<ul class="this-page-menu">
<li><a href="../_sources/security/SCTP.rst.txt"
rel="nofollow">Show Source</a></li>
</ul>
</div>
</div>
</div>
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<section id="sctp">
<h1>SCTP<a class="headerlink" href="#sctp" title="Link to this heading">¶</a></h1>
<section id="sctp-lsm-support">
<h2>SCTP LSM Support<a class="headerlink" href="#sctp-lsm-support" title="Link to this heading">¶</a></h2>
<section id="security-hooks">
<h3>Security Hooks<a class="headerlink" href="#security-hooks" title="Link to this heading">¶</a></h3>
<p>For security module support, three SCTP specific hooks have been implemented:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>security_sctp_assoc_request()
security_sctp_bind_connect()
security_sctp_sk_clone()
security_sctp_assoc_established()
</pre></div>
</div>
<p>The usage of these hooks are described below with the SELinux implementation
described in the <a class="reference internal" href="#sctp-selinux-support">SCTP SELinux Support</a> chapter.</p>
<section id="security-sctp-assoc-request">
<h4>security_sctp_assoc_request()<a class="headerlink" href="#security-sctp-assoc-request" title="Link to this heading">¶</a></h4>
<p>Passes the <code class="docutils literal notranslate"><span class="pre">@asoc</span></code> and <code class="docutils literal notranslate"><span class="pre">@chunk->skb</span></code> of the association INIT packet to the
security module. Returns 0 on success, error on failure.</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>@asoc - pointer to sctp association structure.
@skb - pointer to skbuff of association packet.
</pre></div>
</div>
</section>
<section id="security-sctp-bind-connect">
<h4>security_sctp_bind_connect()<a class="headerlink" href="#security-sctp-bind-connect" title="Link to this heading">¶</a></h4>
<p>Passes one or more ipv4/ipv6 addresses to the security module for validation
based on the <code class="docutils literal notranslate"><span class="pre">@optname</span></code> that will result in either a bind or connect
service as shown in the permission check tables below.
Returns 0 on success, error on failure.</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span> @sk - Pointer to sock structure.
@optname - Name of the option to validate.
@address - One or more ipv4 / ipv6 addresses.
@addrlen - The total length of address(s). This is calculated on each
ipv4 or ipv6 address using sizeof(struct sockaddr_in) or
sizeof(struct sockaddr_in6).
------------------------------------------------------------------
| BIND Type Checks |
| @optname | @address contains |
|----------------------------|-----------------------------------|
| SCTP_SOCKOPT_BINDX_ADD | One or more ipv4 / ipv6 addresses |
| SCTP_PRIMARY_ADDR | Single ipv4 or ipv6 address |
| SCTP_SET_PEER_PRIMARY_ADDR | Single ipv4 or ipv6 address |
------------------------------------------------------------------
------------------------------------------------------------------
| CONNECT Type Checks |
| @optname | @address contains |
|----------------------------|-----------------------------------|
| SCTP_SOCKOPT_CONNECTX | One or more ipv4 / ipv6 addresses |
| SCTP_PARAM_ADD_IP | One or more ipv4 / ipv6 addresses |
| SCTP_SENDMSG_CONNECT | Single ipv4 or ipv6 address |
| SCTP_PARAM_SET_PRIMARY | Single ipv4 or ipv6 address |
------------------------------------------------------------------
</pre></div>
</div>
<p>A summary of the <code class="docutils literal notranslate"><span class="pre">@optname</span></code> entries is as follows:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>SCTP_SOCKOPT_BINDX_ADD - Allows additional bind addresses to be
associated after (optionally) calling
bind(3).
sctp_bindx(3) adds a set of bind
addresses on a socket.
SCTP_SOCKOPT_CONNECTX - Allows the allocation of multiple
addresses for reaching a peer
(multi-homed).
sctp_connectx(3) initiates a connection
on an SCTP socket using multiple
destination addresses.
SCTP_SENDMSG_CONNECT - Initiate a connection that is generated by a
sendmsg(2) or sctp_sendmsg(3) on a new association.
SCTP_PRIMARY_ADDR - Set local primary address.
SCTP_SET_PEER_PRIMARY_ADDR - Request peer sets address as
association primary.
SCTP_PARAM_ADD_IP - These are used when Dynamic Address
SCTP_PARAM_SET_PRIMARY - Reconfiguration is enabled as explained below.
</pre></div>
</div>
<p>To support Dynamic Address Reconfiguration the following parameters must be
enabled on both endpoints (or use the appropriate <strong>setsockopt</strong>(2)):</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>/proc/sys/net/sctp/addip_enable
/proc/sys/net/sctp/addip_noauth_enable
</pre></div>
</div>
<p>then the following <em>_PARAM_</em>’s are sent to the peer in an
ASCONF chunk when the corresponding <code class="docutils literal notranslate"><span class="pre">@optname</span></code>’s are present:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span> @optname ASCONF Parameter
---------- ------------------
SCTP_SOCKOPT_BINDX_ADD -> SCTP_PARAM_ADD_IP
SCTP_SET_PEER_PRIMARY_ADDR -> SCTP_PARAM_SET_PRIMARY
</pre></div>
</div>
</section>
<section id="security-sctp-sk-clone">
<h4>security_sctp_sk_clone()<a class="headerlink" href="#security-sctp-sk-clone" title="Link to this heading">¶</a></h4>
<p>Called whenever a new socket is created by <strong>accept</strong>(2)
(i.e. a TCP style socket) or when a socket is ‘peeled off’ e.g userspace
calls <strong>sctp_peeloff</strong>(3).</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>@asoc - pointer to current sctp association structure.
@sk - pointer to current sock structure.
@newsk - pointer to new sock structure.
</pre></div>
</div>
</section>
<section id="security-sctp-assoc-established">
<h4>security_sctp_assoc_established()<a class="headerlink" href="#security-sctp-assoc-established" title="Link to this heading">¶</a></h4>
<p>Called when a COOKIE ACK is received, and the peer secid will be
saved into <code class="docutils literal notranslate"><span class="pre">@asoc->peer_secid</span></code> for client:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>@asoc - pointer to sctp association structure.
@skb - pointer to skbuff of the COOKIE ACK packet.
</pre></div>
</div>
</section>
</section>
<section id="security-hooks-used-for-association-establishment">
<h3>Security Hooks used for Association Establishment<a class="headerlink" href="#security-hooks-used-for-association-establishment" title="Link to this heading">¶</a></h3>
<p>The following diagram shows the use of <code class="docutils literal notranslate"><span class="pre">security_sctp_bind_connect()</span></code>,
<code class="docutils literal notranslate"><span class="pre">security_sctp_assoc_request()</span></code>, <code class="docutils literal notranslate"><span class="pre">security_sctp_assoc_established()</span></code> when
establishing an association.</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span> SCTP endpoint "A" SCTP endpoint "Z"
================= =================
sctp_sf_do_prm_asoc()
Association setup can be initiated
by a connect(2), sctp_connectx(3),
sendmsg(2) or sctp_sendmsg(3).
These will result in a call to
security_sctp_bind_connect() to
initiate an association to
SCTP peer endpoint "Z".
INIT --------------------------------------------->
sctp_sf_do_5_1B_init()
Respond to an INIT chunk.
SCTP peer endpoint "A" is asking
for a temporary association.
Call security_sctp_assoc_request()
to set the peer label if first
association.
If not first association, check
whether allowed, IF so send:
<----------------------------------------------- INIT ACK
| ELSE audit event and silently
| discard the packet.
|
COOKIE ECHO ------------------------------------------>
sctp_sf_do_5_1D_ce()
Respond to an COOKIE ECHO chunk.
Confirm the cookie and create a
permanent association.
Call security_sctp_assoc_request() to
do the same as for INIT chunk Response.
<------------------------------------------- COOKIE ACK
| |
sctp_sf_do_5_1E_ca |
Call security_sctp_assoc_established() |
to set the peer label. |
| |
| If SCTP_SOCKET_TCP or peeled off
| socket security_sctp_sk_clone() is
| called to clone the new socket.
| |
ESTABLISHED ESTABLISHED
| |
------------------------------------------------------------------
| Association Established |
------------------------------------------------------------------
</pre></div>
</div>
</section>
</section>
<section id="sctp-selinux-support">
<h2>SCTP SELinux Support<a class="headerlink" href="#sctp-selinux-support" title="Link to this heading">¶</a></h2>
<section id="id1">
<h3>Security Hooks<a class="headerlink" href="#id1" title="Link to this heading">¶</a></h3>
<p>The <a class="reference internal" href="#sctp-lsm-support">SCTP LSM Support</a> chapter above describes the following SCTP security
hooks with the SELinux specifics expanded below:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>security_sctp_assoc_request()
security_sctp_bind_connect()
security_sctp_sk_clone()
security_sctp_assoc_established()
</pre></div>
</div>
<section id="id2">
<h4>security_sctp_assoc_request()<a class="headerlink" href="#id2" title="Link to this heading">¶</a></h4>
<p>Passes the <code class="docutils literal notranslate"><span class="pre">@asoc</span></code> and <code class="docutils literal notranslate"><span class="pre">@chunk->skb</span></code> of the association INIT packet to the
security module. Returns 0 on success, error on failure.</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>@asoc - pointer to sctp association structure.
@skb - pointer to skbuff of association packet.
</pre></div>
</div>
<dl>
<dt>The security module performs the following operations:</dt><dd><p>IF this is the first association on <code class="docutils literal notranslate"><span class="pre">@asoc->base.sk</span></code>, then set the peer
sid to that in <code class="docutils literal notranslate"><span class="pre">@skb</span></code>. This will ensure there is only one peer sid
assigned to <code class="docutils literal notranslate"><span class="pre">@asoc->base.sk</span></code> that may support multiple associations.</p>
<p>ELSE validate the <code class="docutils literal notranslate"><span class="pre">@asoc->base.sk</span> <span class="pre">peer_sid</span></code> against the <code class="docutils literal notranslate"><span class="pre">@skb</span> <span class="pre">peer</span> <span class="pre">sid</span></code>
to determine whether the association should be allowed or denied.</p>
<p>Set the sctp <code class="docutils literal notranslate"><span class="pre">@asoc</span> <span class="pre">sid</span></code> to socket’s sid (from <code class="docutils literal notranslate"><span class="pre">asoc->base.sk</span></code>) with
MLS portion taken from <code class="docutils literal notranslate"><span class="pre">@skb</span> <span class="pre">peer</span> <span class="pre">sid</span></code>. This will be used by SCTP
TCP style sockets and peeled off connections as they cause a new socket
to be generated.</p>
<p>If IP security options are configured (CIPSO/CALIPSO), then the ip
options are set on the socket.</p>
</dd>
</dl>
</section>
<section id="id3">
<h4>security_sctp_bind_connect()<a class="headerlink" href="#id3" title="Link to this heading">¶</a></h4>
<p>Checks permissions required for ipv4/ipv6 addresses based on the <code class="docutils literal notranslate"><span class="pre">@optname</span></code>
as follows:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>------------------------------------------------------------------
| BIND Permission Checks |
| @optname | @address contains |
|----------------------------|-----------------------------------|
| SCTP_SOCKOPT_BINDX_ADD | One or more ipv4 / ipv6 addresses |
| SCTP_PRIMARY_ADDR | Single ipv4 or ipv6 address |
| SCTP_SET_PEER_PRIMARY_ADDR | Single ipv4 or ipv6 address |
------------------------------------------------------------------
------------------------------------------------------------------
| CONNECT Permission Checks |
| @optname | @address contains |
|----------------------------|-----------------------------------|
| SCTP_SOCKOPT_CONNECTX | One or more ipv4 / ipv6 addresses |
| SCTP_PARAM_ADD_IP | One or more ipv4 / ipv6 addresses |
| SCTP_SENDMSG_CONNECT | Single ipv4 or ipv6 address |
| SCTP_PARAM_SET_PRIMARY | Single ipv4 or ipv6 address |
------------------------------------------------------------------
</pre></div>
</div>
<p><a class="reference internal" href="#sctp-lsm-support">SCTP LSM Support</a> gives a summary of the <code class="docutils literal notranslate"><span class="pre">@optname</span></code>
entries and also describes ASCONF chunk processing when Dynamic Address
Reconfiguration is enabled.</p>
</section>
<section id="id4">
<h4>security_sctp_sk_clone()<a class="headerlink" href="#id4" title="Link to this heading">¶</a></h4>
<p>Called whenever a new socket is created by <strong>accept</strong>(2) (i.e. a TCP style
socket) or when a socket is ‘peeled off’ e.g userspace calls
<strong>sctp_peeloff</strong>(3). <code class="docutils literal notranslate"><span class="pre">security_sctp_sk_clone()</span></code> will set the new
sockets sid and peer sid to that contained in the <code class="docutils literal notranslate"><span class="pre">@asoc</span> <span class="pre">sid</span></code> and
<code class="docutils literal notranslate"><span class="pre">@asoc</span> <span class="pre">peer</span> <span class="pre">sid</span></code> respectively.</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>@asoc - pointer to current sctp association structure.
@sk - pointer to current sock structure.
@newsk - pointer to new sock structure.
</pre></div>
</div>
</section>
<section id="id5">
<h4>security_sctp_assoc_established()<a class="headerlink" href="#id5" title="Link to this heading">¶</a></h4>
<p>Called when a COOKIE ACK is received where it sets the connection’s peer sid
to that in <code class="docutils literal notranslate"><span class="pre">@skb</span></code>:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>@asoc - pointer to sctp association structure.
@skb - pointer to skbuff of the COOKIE ACK packet.
</pre></div>
</div>
</section>
</section>
<section id="policy-statements">
<h3>Policy Statements<a class="headerlink" href="#policy-statements" title="Link to this heading">¶</a></h3>
<p>The following class and permissions to support SCTP are available within the
kernel:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>class sctp_socket inherits socket { node_bind }
</pre></div>
</div>
<p>whenever the following policy capability is enabled:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>policycap extended_socket_class;
</pre></div>
</div>
<p>SELinux SCTP support adds the <code class="docutils literal notranslate"><span class="pre">name_connect</span></code> permission for connecting
to a specific port type and the <code class="docutils literal notranslate"><span class="pre">association</span></code> permission that is explained
in the section below.</p>
<p>If userspace tools have been updated, SCTP will support the <code class="docutils literal notranslate"><span class="pre">portcon</span></code>
statement as shown in the following example:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>portcon sctp 1024-1036 system_u:object_r:sctp_ports_t:s0
</pre></div>
</div>
</section>
<section id="sctp-peer-labeling">
<h3>SCTP Peer Labeling<a class="headerlink" href="#sctp-peer-labeling" title="Link to this heading">¶</a></h3>
<p>An SCTP socket will only have one peer label assigned to it. This will be
assigned during the establishment of the first association. Any further
associations on this socket will have their packet peer label compared to
the sockets peer label, and only if they are different will the
<code class="docutils literal notranslate"><span class="pre">association</span></code> permission be validated. This is validated by checking the
socket peer sid against the received packets peer sid to determine whether
the association should be allowed or denied.</p>
<dl>
<dt>NOTES:</dt><dd><ol class="arabic">
<li><p>If peer labeling is not enabled, then the peer context will always be
<code class="docutils literal notranslate"><span class="pre">SECINITSID_UNLABELED</span></code> (<code class="docutils literal notranslate"><span class="pre">unlabeled_t</span></code> in Reference Policy).</p></li>
<li><p>As SCTP can support more than one transport address per endpoint
(multi-homing) on a single socket, it is possible to configure policy
and NetLabel to provide different peer labels for each of these. As the
socket peer label is determined by the first associations transport
address, it is recommended that all peer labels are consistent.</p></li>
<li><p><strong>getpeercon</strong>(3) may be used by userspace to retrieve the sockets peer
context.</p></li>
<li><p>While not SCTP specific, be aware when using NetLabel that if a label
is assigned to a specific interface, and that interface ‘goes down’,
then the NetLabel service will remove the entry. Therefore ensure that
the network startup scripts call <strong>netlabelctl</strong>(8) to set the required
label (see <strong>netlabel-config</strong>(8) helper script for details).</p></li>
<li><p>The NetLabel SCTP peer labeling rules apply as discussed in the following
set of posts tagged “netlabel” at: <a class="reference external" href="https://www.paul-moore.com/blog/t">https://www.paul-moore.com/blog/t</a>.</p></li>
<li><p>CIPSO is only supported for IPv4 addressing: <code class="docutils literal notranslate"><span class="pre">socket(AF_INET,</span> <span class="pre">...)</span></code>
CALIPSO is only supported for IPv6 addressing: <code class="docutils literal notranslate"><span class="pre">socket(AF_INET6,</span> <span class="pre">...)</span></code></p>
<dl class="simple">
<dt>Note the following when testing CIPSO/CALIPSO:</dt><dd><ol class="loweralpha simple">
<li><p>CIPSO will send an ICMP packet if an SCTP packet cannot be
delivered because of an invalid label.</p></li>
<li><p>CALIPSO does not send an ICMP packet, just silently discards it.</p></li>
</ol>
</dd>
</dl>
</li>
<li><p>IPSEC is not supported as RFC 3554 - sctp/ipsec support has not been
implemented in userspace (<strong>racoon</strong>(8) or <strong>ipsec_pluto</strong>(8)),
although the kernel supports SCTP/IPSEC.</p></li>
</ol>
</dd>
</dl>
</section>
</section>
</section>
</div>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="footer">
©The kernel development community.
|
Powered by <a href="https://www.sphinx-doc.org/">Sphinx 8.1.3</a>
& <a href="https://alabaster.readthedocs.io">Alabaster 0.7.16</a>
|
<a href="../_sources/security/SCTP.rst.txt"
rel="nofollow">Page source</a>
</div>
</body>
</html>