Documentation/security/SCTP.rst

1 .. SPDX-License-Identifier: GPL-2.0
11 --------------
26 Passes the ``@asoc`` and ``@chunk->skb`` of the association INIT packet to the
30     @asoc - pointer to sctp association structure.
31     @skb - pointer to skbuff of association packet.
36 Passes one or more ipv4/ipv6 addresses to the security module for validation
42     @sk      - Pointer to sock structure.
43     @optname - Name of the option to validate.
44     @address - One or more ipv4 / ipv6 addresses.
45     @addrlen - The total length of address(s). This is calculated on each
49   ------------------------------------------------------------------
52   |----------------------------|-----------------------------------|
53   | SCTP_SOCKOPT_BINDX_ADD     | One or more ipv4 / ipv6 addresses |
56   ------------------------------------------------------------------
58   ------------------------------------------------------------------
61   |----------------------------|-----------------------------------|
62   | SCTP_SOCKOPT_CONNECTX      | One or more ipv4 / ipv6 addresses |
63   | SCTP_PARAM_ADD_IP          | One or more ipv4 / ipv6 addresses |
66   ------------------------------------------------------------------
70     SCTP_SOCKOPT_BINDX_ADD - Allows additional bind addresses to be
74                              addresses on a socket.
76     SCTP_SOCKOPT_CONNECTX - Allows the allocation of multiple
77                             addresses for reaching a peer
78                             (multi-homed).
81                             destination addresses.
83     SCTP_SENDMSG_CONNECT  - Initiate a connection that is generated by a
86     SCTP_PRIMARY_ADDR     - Set local primary address.
88     SCTP_SET_PEER_PRIMARY_ADDR - Request peer sets address as
91     SCTP_PARAM_ADD_IP          - These are used when Dynamic Address
92     SCTP_PARAM_SET_PRIMARY     - Reconfiguration is enabled as explained below.
105          ----------                    ------------------
106     SCTP_SOCKOPT_BINDX_ADD     ->   SCTP_PARAM_ADD_IP
107     SCTP_SET_PEER_PRIMARY_ADDR ->   SCTP_PARAM_SET_PRIMARY
117     @asoc - pointer to current sctp association structure.
118     @sk - pointer to current sock structure.
119     @newsk - pointer to new sock structure.
125 saved into ``@asoc->peer_secid`` for client::
127     @asoc - pointer to sctp association structure.
128     @skb - pointer to skbuff of the COOKIE ACK packet.
132 -------------------------------------------------
149          INIT --------------------------------------------->
159           <----------------------------------------------- INIT ACK
163     COOKIE ECHO ------------------------------------------>
170           <------------------------------------------- COOKIE ACK
182     ------------------------------------------------------------------
184     ------------------------------------------------------------------
191 --------------
204 Passes the ``@asoc`` and ``@chunk->skb`` of the association INIT packet to the
208     @asoc - pointer to sctp association structure.
209     @skb - pointer to skbuff of association packet.
212      IF this is the first association on ``@asoc->base.sk``, then set the peer
214      assigned to ``@asoc->base.sk`` that may support multiple associations.
216      ELSE validate the ``@asoc->base.sk peer_sid`` against the ``@skb peer sid``
219      Set the sctp ``@asoc sid`` to socket's sid (from ``asoc->base.sk``) with
230 Checks permissions required for ipv4/ipv6 addresses based on the ``@optname``
233   ------------------------------------------------------------------
236   |----------------------------|-----------------------------------|
237   | SCTP_SOCKOPT_BINDX_ADD     | One or more ipv4 / ipv6 addresses |
240   ------------------------------------------------------------------
242   ------------------------------------------------------------------
245   |----------------------------|-----------------------------------|
246   | SCTP_SOCKOPT_CONNECTX      | One or more ipv4 / ipv6 addresses |
247   | SCTP_PARAM_ADD_IP          | One or more ipv4 / ipv6 addresses |
250   ------------------------------------------------------------------
267     @asoc - pointer to current sctp association structure.
268     @sk - pointer to current sock structure.
269     @newsk - pointer to new sock structure.
277     @asoc - pointer to sctp association structure.
278     @skb - pointer to skbuff of the COOKIE ACK packet.
282 -----------------
299     portcon sctp 1024-1036 system_u:object_r:sctp_ports_t:s0
303 ------------------
304 An SCTP socket will only have one peer label assigned to it. This will be
305 assigned during the establishment of the first association. Any further
317       (multi-homing) on a single socket, it is possible to configure policy
326       is assigned to a specific interface, and that interface 'goes down',
329       label (see **netlabel-config**\(8) helper script for details).
332       set of posts tagged "netlabel" at: https://www.paul-moore.com/blog/t.
342    7) IPSEC is not supported as RFC 3554 - sctp/ipsec support has not been