Skip to content

Commit 2277c7c

Browse files
Richard Hainespcmoore
Richard Haines
authored and
pcmoore
committed
sctp: Add LSM hooks
Add security hooks allowing security modules to exercise access control over SCTP. Signed-off-by: Richard Haines <richard_c_haines@btinternet.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
1 parent b7e10c2 commit 2277c7c

File tree

5 files changed

+102
-1
lines changed

5 files changed

+102
-1
lines changed

‎include/net/sctp/structs.h

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1318,6 +1318,16 @@ struct sctp_endpoint {
13181318
reconf_enable:1;
13191319

13201320
__u8 strreset_enable;
1321+
1322+
/* Security identifiers from incoming (INIT). These are set by
1323+
* security_sctp_assoc_request(). These will only be used by
1324+
* SCTP TCP type sockets and peeled off connections as they
1325+
* cause a new socket to be generated. security_sctp_sk_clone()
1326+
* will then plug these into the new socket.
1327+
*/
1328+
1329+
u32 secid;
1330+
u32 peer_secid;
13211331
};
13221332

13231333
/* Recover the outter endpoint structure. */

‎include/uapi/linux/sctp.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ typedef __s32 sctp_assoc_t;
126126
#define SCTP_STREAM_SCHEDULER 123
127127
#define SCTP_STREAM_SCHEDULER_VALUE 124
128128
#define SCTP_INTERLEAVING_SUPPORTED 125
129+
#define SCTP_SENDMSG_CONNECT 126
129130

130131
/* PR-SCTP policies */
131132
#define SCTP_PR_SCTP_NONE 0x0000

‎net/sctp/sm_make_chunk.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3071,6 +3071,12 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
30713071
if (af->is_any(&addr))
30723072
memcpy(&addr, &asconf->source, sizeof(addr));
30733073

3074+
if (security_sctp_bind_connect(asoc->ep->base.sk,
3075+
SCTP_PARAM_ADD_IP,
3076+
(struct sockaddr *)&addr,
3077+
af->sockaddr_len))
3078+
return SCTP_ERROR_REQ_REFUSED;
3079+
30743080
/* ADDIP 4.3 D9) If an endpoint receives an ADD IP address
30753081
* request and does not have the local resources to add this
30763082
* new address to the association, it MUST return an Error
@@ -3137,6 +3143,12 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
31373143
if (af->is_any(&addr))
31383144
memcpy(&addr.v4, sctp_source(asconf), sizeof(addr));
31393145

3146+
if (security_sctp_bind_connect(asoc->ep->base.sk,
3147+
SCTP_PARAM_SET_PRIMARY,
3148+
(struct sockaddr *)&addr,
3149+
af->sockaddr_len))
3150+
return SCTP_ERROR_REQ_REFUSED;
3151+
31403152
peer = sctp_assoc_lookup_paddr(asoc, &addr);
31413153
if (!peer)
31423154
return SCTP_ERROR_DNS_FAILED;

‎net/sctp/sm_statefuns.c

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -321,6 +321,11 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net,
321321
struct sctp_packet *packet;
322322
int len;
323323

324+
/* Update socket peer label if first association. */
325+
if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
326+
chunk->skb))
327+
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
328+
324329
/* 6.10 Bundling
325330
* An endpoint MUST NOT bundle INIT, INIT ACK or
326331
* SHUTDOWN COMPLETE with any other chunks.
@@ -908,6 +913,9 @@ enum sctp_disposition sctp_sf_do_5_1E_ca(struct net *net,
908913
*/
909914
sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());
910915

916+
/* Set peer label for connection. */
917+
security_inet_conn_established(ep->base.sk, chunk->skb);
918+
911919
/* RFC 2960 5.1 Normal Establishment of an Association
912920
*
913921
* E) Upon reception of the COOKIE ACK, endpoint "A" will move
@@ -1436,6 +1444,11 @@ static enum sctp_disposition sctp_sf_do_unexpected_init(
14361444
struct sctp_packet *packet;
14371445
int len;
14381446

1447+
/* Update socket peer label if first association. */
1448+
if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
1449+
chunk->skb))
1450+
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1451+
14391452
/* 6.10 Bundling
14401453
* An endpoint MUST NOT bundle INIT, INIT ACK or
14411454
* SHUTDOWN COMPLETE with any other chunks.
@@ -2106,6 +2119,11 @@ enum sctp_disposition sctp_sf_do_5_2_4_dupcook(
21062119
}
21072120
}
21082121

2122+
/* Update socket peer label if first association. */
2123+
if (security_sctp_assoc_request((struct sctp_endpoint *)ep,
2124+
chunk->skb))
2125+
return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
2126+
21092127
/* Set temp so that it won't be added into hashtable */
21102128
new_asoc->temp = 1;
21112129

‎net/sctp/socket.c

Lines changed: 61 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1043,6 +1043,12 @@ static int sctp_setsockopt_bindx(struct sock *sk,
10431043
/* Do the work. */
10441044
switch (op) {
10451045
case SCTP_BINDX_ADD_ADDR:
1046+
/* Allow security module to validate bindx addresses. */
1047+
err = security_sctp_bind_connect(sk, SCTP_SOCKOPT_BINDX_ADD,
1048+
(struct sockaddr *)kaddrs,
1049+
addrs_size);
1050+
if (err)
1051+
goto out;
10461052
err = sctp_bindx_add(sk, kaddrs, addrcnt);
10471053
if (err)
10481054
goto out;
@@ -1252,6 +1258,7 @@ static int __sctp_connect(struct sock *sk,
12521258

12531259
if (assoc_id)
12541260
*assoc_id = asoc->assoc_id;
1261+
12551262
err = sctp_wait_for_connect(asoc, &timeo);
12561263
/* Note: the asoc may be freed after the return of
12571264
* sctp_wait_for_connect.
@@ -1347,7 +1354,16 @@ static int __sctp_setsockopt_connectx(struct sock *sk,
13471354
if (unlikely(IS_ERR(kaddrs)))
13481355
return PTR_ERR(kaddrs);
13491356

1357+
/* Allow security module to validate connectx addresses. */
1358+
err = security_sctp_bind_connect(sk, SCTP_SOCKOPT_CONNECTX,
1359+
(struct sockaddr *)kaddrs,
1360+
addrs_size);
1361+
if (err)
1362+
goto out_free;
1363+
13501364
err = __sctp_connect(sk, kaddrs, addrs_size, assoc_id);
1365+
1366+
out_free:
13511367
kvfree(kaddrs);
13521368

13531369
return err;
@@ -1615,6 +1631,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
16151631
struct sctp_transport *transport, *chunk_tp;
16161632
struct sctp_chunk *chunk;
16171633
union sctp_addr to;
1634+
struct sctp_af *af;
16181635
struct sockaddr *msg_name = NULL;
16191636
struct sctp_sndrcvinfo default_sinfo;
16201637
struct sctp_sndrcvinfo *sinfo;
@@ -1844,6 +1861,24 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
18441861
}
18451862

18461863
scope = sctp_scope(&to);
1864+
1865+
/* Label connection socket for first association 1-to-many
1866+
* style for client sequence socket()->sendmsg(). This
1867+
* needs to be done before sctp_assoc_add_peer() as that will
1868+
* set up the initial packet that needs to account for any
1869+
* security ip options (CIPSO/CALIPSO) added to the packet.
1870+
*/
1871+
af = sctp_get_af_specific(to.sa.sa_family);
1872+
if (!af) {
1873+
err = -EINVAL;
1874+
goto out_unlock;
1875+
}
1876+
err = security_sctp_bind_connect(sk, SCTP_SENDMSG_CONNECT,
1877+
(struct sockaddr *)&to,
1878+
af->sockaddr_len);
1879+
if (err < 0)
1880+
goto out_unlock;
1881+
18471882
new_asoc = sctp_association_new(ep, sk, scope, GFP_KERNEL);
18481883
if (!new_asoc) {
18491884
err = -ENOMEM;
@@ -2909,13 +2944,26 @@ static int sctp_setsockopt_primary_addr(struct sock *sk, char __user *optval,
29092944
{
29102945
struct sctp_prim prim;
29112946
struct sctp_transport *trans;
2947+
struct sctp_af *af;
2948+
int err;
29122949

29132950
if (optlen != sizeof(struct sctp_prim))
29142951
return -EINVAL;
29152952

29162953
if (copy_from_user(&prim, optval, sizeof(struct sctp_prim)))
29172954
return -EFAULT;
29182955

2956+
/* Allow security module to validate address but need address len. */
2957+
af = sctp_get_af_specific(prim.ssp_addr.ss_family);
2958+
if (!af)
2959+
return -EINVAL;
2960+
2961+
err = security_sctp_bind_connect(sk, SCTP_PRIMARY_ADDR,
2962+
(struct sockaddr *)&prim.ssp_addr,
2963+
af->sockaddr_len);
2964+
if (err)
2965+
return err;
2966+
29192967
trans = sctp_addr_id2transport(sk, &prim.ssp_addr, prim.ssp_assoc_id);
29202968
if (!trans)
29212969
return -EINVAL;
@@ -3247,6 +3295,13 @@ static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optva
32473295
if (!sctp_assoc_lookup_laddr(asoc, (union sctp_addr *)&prim.sspp_addr))
32483296
return -EADDRNOTAVAIL;
32493297

3298+
/* Allow security module to validate address. */
3299+
err = security_sctp_bind_connect(sk, SCTP_SET_PEER_PRIMARY_ADDR,
3300+
(struct sockaddr *)&prim.sspp_addr,
3301+
af->sockaddr_len);
3302+
if (err)
3303+
return err;
3304+
32503305
/* Create an ASCONF chunk with SET_PRIMARY parameter */
32513306
chunk = sctp_make_asconf_set_prim(asoc,
32523307
(union sctp_addr *)&prim.sspp_addr);
@@ -8346,6 +8401,8 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
83468401
{
83478402
struct inet_sock *inet = inet_sk(sk);
83488403
struct inet_sock *newinet;
8404+
struct sctp_sock *sp = sctp_sk(sk);
8405+
struct sctp_endpoint *ep = sp->ep;
83498406

83508407
newsk->sk_type = sk->sk_type;
83518408
newsk->sk_bound_dev_if = sk->sk_bound_dev_if;
@@ -8388,7 +8445,10 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
83888445
if (newsk->sk_flags & SK_FLAGS_TIMESTAMP)
83898446
net_enable_timestamp();
83908447

8391-
security_sk_clone(sk, newsk);
8448+
/* Set newsk security attributes from orginal sk and connection
8449+
* security attribute from ep.
8450+
*/
8451+
security_sctp_sk_clone(ep, sk, newsk);
83928452
}
83938453

83948454
static inline void sctp_copy_descendant(struct sock *sk_to,

0 commit comments

Comments
 (0)