SCTP.rst 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343
  1. .. SPDX-License-Identifier: GPL-2.0
  2. ====
  3. SCTP
  4. ====
  5. SCTP LSM Support
  6. ================
  7. Security Hooks
  8. --------------
  9. For security module support, three SCTP specific hooks have been implemented::
  10. security_sctp_assoc_request()
  11. security_sctp_bind_connect()
  12. security_sctp_sk_clone()
  13. Also the following security hook has been utilised::
  14. security_inet_conn_established()
  15. The usage of these hooks are described below with the SELinux implementation
  16. described in the `SCTP SELinux Support`_ chapter.
  17. security_sctp_assoc_request()
  18. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  19. Passes the ``@ep`` and ``@chunk->skb`` of the association INIT packet to the
  20. security module. Returns 0 on success, error on failure.
  21. ::
  22. @ep - pointer to sctp endpoint structure.
  23. @skb - pointer to skbuff of association packet.
  24. security_sctp_bind_connect()
  25. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  26. Passes one or more ipv4/ipv6 addresses to the security module for validation
  27. based on the ``@optname`` that will result in either a bind or connect
  28. service as shown in the permission check tables below.
  29. Returns 0 on success, error on failure.
  30. ::
  31. @sk - Pointer to sock structure.
  32. @optname - Name of the option to validate.
  33. @address - One or more ipv4 / ipv6 addresses.
  34. @addrlen - The total length of address(s). This is calculated on each
  35. ipv4 or ipv6 address using sizeof(struct sockaddr_in) or
  36. sizeof(struct sockaddr_in6).
  37. ------------------------------------------------------------------
  38. | BIND Type Checks |
  39. | @optname | @address contains |
  40. |----------------------------|-----------------------------------|
  41. | SCTP_SOCKOPT_BINDX_ADD | One or more ipv4 / ipv6 addresses |
  42. | SCTP_PRIMARY_ADDR | Single ipv4 or ipv6 address |
  43. | SCTP_SET_PEER_PRIMARY_ADDR | Single ipv4 or ipv6 address |
  44. ------------------------------------------------------------------
  45. ------------------------------------------------------------------
  46. | CONNECT Type Checks |
  47. | @optname | @address contains |
  48. |----------------------------|-----------------------------------|
  49. | SCTP_SOCKOPT_CONNECTX | One or more ipv4 / ipv6 addresses |
  50. | SCTP_PARAM_ADD_IP | One or more ipv4 / ipv6 addresses |
  51. | SCTP_SENDMSG_CONNECT | Single ipv4 or ipv6 address |
  52. | SCTP_PARAM_SET_PRIMARY | Single ipv4 or ipv6 address |
  53. ------------------------------------------------------------------
  54. A summary of the ``@optname`` entries is as follows::
  55. SCTP_SOCKOPT_BINDX_ADD - Allows additional bind addresses to be
  56. associated after (optionally) calling
  57. bind(3).
  58. sctp_bindx(3) adds a set of bind
  59. addresses on a socket.
  60. SCTP_SOCKOPT_CONNECTX - Allows the allocation of multiple
  61. addresses for reaching a peer
  62. (multi-homed).
  63. sctp_connectx(3) initiates a connection
  64. on an SCTP socket using multiple
  65. destination addresses.
  66. SCTP_SENDMSG_CONNECT - Initiate a connection that is generated by a
  67. sendmsg(2) or sctp_sendmsg(3) on a new asociation.
  68. SCTP_PRIMARY_ADDR - Set local primary address.
  69. SCTP_SET_PEER_PRIMARY_ADDR - Request peer sets address as
  70. association primary.
  71. SCTP_PARAM_ADD_IP - These are used when Dynamic Address
  72. SCTP_PARAM_SET_PRIMARY - Reconfiguration is enabled as explained below.
  73. To support Dynamic Address Reconfiguration the following parameters must be
  74. enabled on both endpoints (or use the appropriate **setsockopt**\(2))::
  75. /proc/sys/net/sctp/addip_enable
  76. /proc/sys/net/sctp/addip_noauth_enable
  77. then the following *_PARAM_*'s are sent to the peer in an
  78. ASCONF chunk when the corresponding ``@optname``'s are present::
  79. @optname ASCONF Parameter
  80. ---------- ------------------
  81. SCTP_SOCKOPT_BINDX_ADD -> SCTP_PARAM_ADD_IP
  82. SCTP_SET_PEER_PRIMARY_ADDR -> SCTP_PARAM_SET_PRIMARY
  83. security_sctp_sk_clone()
  84. ~~~~~~~~~~~~~~~~~~~~~~~~
  85. Called whenever a new socket is created by **accept**\(2)
  86. (i.e. a TCP style socket) or when a socket is 'peeled off' e.g userspace
  87. calls **sctp_peeloff**\(3).
  88. ::
  89. @ep - pointer to current sctp endpoint structure.
  90. @sk - pointer to current sock structure.
  91. @sk - pointer to new sock structure.
  92. security_inet_conn_established()
  93. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  94. Called when a COOKIE ACK is received::
  95. @sk - pointer to sock structure.
  96. @skb - pointer to skbuff of the COOKIE ACK packet.
  97. Security Hooks used for Association Establishment
  98. -------------------------------------------------
  99. The following diagram shows the use of ``security_sctp_bind_connect()``,
  100. ``security_sctp_assoc_request()``, ``security_inet_conn_established()`` when
  101. establishing an association.
  102. ::
  103. SCTP endpoint "A" SCTP endpoint "Z"
  104. ================= =================
  105. sctp_sf_do_prm_asoc()
  106. Association setup can be initiated
  107. by a connect(2), sctp_connectx(3),
  108. sendmsg(2) or sctp_sendmsg(3).
  109. These will result in a call to
  110. security_sctp_bind_connect() to
  111. initiate an association to
  112. SCTP peer endpoint "Z".
  113. INIT --------------------------------------------->
  114. sctp_sf_do_5_1B_init()
  115. Respond to an INIT chunk.
  116. SCTP peer endpoint "A" is
  117. asking for an association. Call
  118. security_sctp_assoc_request()
  119. to set the peer label if first
  120. association.
  121. If not first association, check
  122. whether allowed, IF so send:
  123. <----------------------------------------------- INIT ACK
  124. | ELSE audit event and silently
  125. | discard the packet.
  126. |
  127. COOKIE ECHO ------------------------------------------>
  128. |
  129. |
  130. |
  131. <------------------------------------------- COOKIE ACK
  132. | |
  133. sctp_sf_do_5_1E_ca |
  134. Call security_inet_conn_established() |
  135. to set the peer label. |
  136. | |
  137. | If SCTP_SOCKET_TCP or peeled off
  138. | socket security_sctp_sk_clone() is
  139. | called to clone the new socket.
  140. | |
  141. ESTABLISHED ESTABLISHED
  142. | |
  143. ------------------------------------------------------------------
  144. | Association Established |
  145. ------------------------------------------------------------------
  146. SCTP SELinux Support
  147. ====================
  148. Security Hooks
  149. --------------
  150. The `SCTP LSM Support`_ chapter above describes the following SCTP security
  151. hooks with the SELinux specifics expanded below::
  152. security_sctp_assoc_request()
  153. security_sctp_bind_connect()
  154. security_sctp_sk_clone()
  155. security_inet_conn_established()
  156. security_sctp_assoc_request()
  157. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  158. Passes the ``@ep`` and ``@chunk->skb`` of the association INIT packet to the
  159. security module. Returns 0 on success, error on failure.
  160. ::
  161. @ep - pointer to sctp endpoint structure.
  162. @skb - pointer to skbuff of association packet.
  163. The security module performs the following operations:
  164. IF this is the first association on ``@ep->base.sk``, then set the peer
  165. sid to that in ``@skb``. This will ensure there is only one peer sid
  166. assigned to ``@ep->base.sk`` that may support multiple associations.
  167. ELSE validate the ``@ep->base.sk peer_sid`` against the ``@skb peer sid``
  168. to determine whether the association should be allowed or denied.
  169. Set the sctp ``@ep sid`` to socket's sid (from ``ep->base.sk``) with
  170. MLS portion taken from ``@skb peer sid``. This will be used by SCTP
  171. TCP style sockets and peeled off connections as they cause a new socket
  172. to be generated.
  173. If IP security options are configured (CIPSO/CALIPSO), then the ip
  174. options are set on the socket.
  175. security_sctp_bind_connect()
  176. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  177. Checks permissions required for ipv4/ipv6 addresses based on the ``@optname``
  178. as follows::
  179. ------------------------------------------------------------------
  180. | BIND Permission Checks |
  181. | @optname | @address contains |
  182. |----------------------------|-----------------------------------|
  183. | SCTP_SOCKOPT_BINDX_ADD | One or more ipv4 / ipv6 addresses |
  184. | SCTP_PRIMARY_ADDR | Single ipv4 or ipv6 address |
  185. | SCTP_SET_PEER_PRIMARY_ADDR | Single ipv4 or ipv6 address |
  186. ------------------------------------------------------------------
  187. ------------------------------------------------------------------
  188. | CONNECT Permission Checks |
  189. | @optname | @address contains |
  190. |----------------------------|-----------------------------------|
  191. | SCTP_SOCKOPT_CONNECTX | One or more ipv4 / ipv6 addresses |
  192. | SCTP_PARAM_ADD_IP | One or more ipv4 / ipv6 addresses |
  193. | SCTP_SENDMSG_CONNECT | Single ipv4 or ipv6 address |
  194. | SCTP_PARAM_SET_PRIMARY | Single ipv4 or ipv6 address |
  195. ------------------------------------------------------------------
  196. `SCTP LSM Support`_ gives a summary of the ``@optname``
  197. entries and also describes ASCONF chunk processing when Dynamic Address
  198. Reconfiguration is enabled.
  199. security_sctp_sk_clone()
  200. ~~~~~~~~~~~~~~~~~~~~~~~~
  201. Called whenever a new socket is created by **accept**\(2) (i.e. a TCP style
  202. socket) or when a socket is 'peeled off' e.g userspace calls
  203. **sctp_peeloff**\(3). ``security_sctp_sk_clone()`` will set the new
  204. sockets sid and peer sid to that contained in the ``@ep sid`` and
  205. ``@ep peer sid`` respectively.
  206. ::
  207. @ep - pointer to current sctp endpoint structure.
  208. @sk - pointer to current sock structure.
  209. @sk - pointer to new sock structure.
  210. security_inet_conn_established()
  211. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  212. Called when a COOKIE ACK is received where it sets the connection's peer sid
  213. to that in ``@skb``::
  214. @sk - pointer to sock structure.
  215. @skb - pointer to skbuff of the COOKIE ACK packet.
  216. Policy Statements
  217. -----------------
  218. The following class and permissions to support SCTP are available within the
  219. kernel::
  220. class sctp_socket inherits socket { node_bind }
  221. whenever the following policy capability is enabled::
  222. policycap extended_socket_class;
  223. SELinux SCTP support adds the ``name_connect`` permission for connecting
  224. to a specific port type and the ``association`` permission that is explained
  225. in the section below.
  226. If userspace tools have been updated, SCTP will support the ``portcon``
  227. statement as shown in the following example::
  228. portcon sctp 1024-1036 system_u:object_r:sctp_ports_t:s0
  229. SCTP Peer Labeling
  230. ------------------
  231. An SCTP socket will only have one peer label assigned to it. This will be
  232. assigned during the establishment of the first association. Any further
  233. associations on this socket will have their packet peer label compared to
  234. the sockets peer label, and only if they are different will the
  235. ``association`` permission be validated. This is validated by checking the
  236. socket peer sid against the received packets peer sid to determine whether
  237. the association should be allowed or denied.
  238. NOTES:
  239. 1) If peer labeling is not enabled, then the peer context will always be
  240. ``SECINITSID_UNLABELED`` (``unlabeled_t`` in Reference Policy).
  241. 2) As SCTP can support more than one transport address per endpoint
  242. (multi-homing) on a single socket, it is possible to configure policy
  243. and NetLabel to provide different peer labels for each of these. As the
  244. socket peer label is determined by the first associations transport
  245. address, it is recommended that all peer labels are consistent.
  246. 3) **getpeercon**\(3) may be used by userspace to retrieve the sockets peer
  247. context.
  248. 4) While not SCTP specific, be aware when using NetLabel that if a label
  249. is assigned to a specific interface, and that interface 'goes down',
  250. then the NetLabel service will remove the entry. Therefore ensure that
  251. the network startup scripts call **netlabelctl**\(8) to set the required
  252. label (see **netlabel-config**\(8) helper script for details).
  253. 5) The NetLabel SCTP peer labeling rules apply as discussed in the following
  254. set of posts tagged "netlabel" at: https://www.paul-moore.com/blog/t.
  255. 6) CIPSO is only supported for IPv4 addressing: ``socket(AF_INET, ...)``
  256. CALIPSO is only supported for IPv6 addressing: ``socket(AF_INET6, ...)``
  257. Note the following when testing CIPSO/CALIPSO:
  258. a) CIPSO will send an ICMP packet if an SCTP packet cannot be
  259. delivered because of an invalid label.
  260. b) CALIPSO does not send an ICMP packet, just silently discards it.
  261. 7) IPSEC is not supported as RFC 3554 - sctp/ipsec support has not been
  262. implemented in userspace (**racoon**\(8) or **ipsec_pluto**\(8)),
  263. although the kernel supports SCTP/IPSEC.