Commit 7c2ef024 authored by Xin Long's avatar Xin Long Committed by David S. Miller
Browse files

security: add sctp_assoc_established hook 



security_sctp_assoc_established() is added to replace
security_inet_conn_established() called in
sctp_sf_do_5_1E_ca(), so that asoc can be accessed in security
subsystem and save the peer secid to asoc->peer_secid.

v1->v2:
  - fix the return value of security_sctp_assoc_established() in
    security.h, found by kernel test robot and Ondrej.

Fixes: 72e89f50 ("security: Add support for SCTP security hooks")
Reported-by: default avatarPrashanth Prahlad <pprahlad@redhat.com>
Reviewed-by: default avatarRichard Haines <richard_c_haines@btinternet.com>
Tested-by: default avatarRichard Haines <richard_c_haines@btinternet.com>
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e215dab1

Documentation/security/SCTP.rst

+10 −12
Original line number Diff line number Diff line
@@ -15,10 +15,7 @@ For security module support, three SCTP specific hooks have been implemented:: 
    security_sctp_assoc_request()

    security_sctp_bind_connect()

    security_sctp_sk_clone()



Also the following security hook has been utilised::



    security_inet_conn_established()

    security_sctp_assoc_established()



The usage of these hooks are described below with the SELinux implementation

described in the `SCTP SELinux Support`_ chapter.
@@ -122,11 +119,12 @@ calls **sctp_peeloff**\(3). 
    @newsk - pointer to new sock structure.





security_inet_conn_established()

security_sctp_assoc_established()

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Called when a COOKIE ACK is received::

Called when a COOKIE ACK is received, and the peer secid will be

saved into ``@asoc->peer_secid`` for client::



    @sk  - pointer to sock structure.

    @asoc - pointer to sctp association structure.

    @skb - pointer to skbuff of the COOKIE ACK packet.
@@ -134,7 +132,7 @@ Security Hooks used for Association Establishment 
-------------------------------------------------



The following diagram shows the use of ``security_sctp_bind_connect()``,

``security_sctp_assoc_request()``, ``security_inet_conn_established()`` when

``security_sctp_assoc_request()``, ``security_sctp_assoc_established()`` when

establishing an association.

::
@@ -172,7 +170,7 @@ establishing an association. 
          <------------------------------------------- COOKIE ACK

          |                                               |

    sctp_sf_do_5_1E_ca                                    |

 Call security_inet_conn_established()                    |

 Call security_sctp_assoc_established()                   |

 to set the peer label.                                   |

          |                                               |

          |                               If SCTP_SOCKET_TCP or peeled off
@@ -198,7 +196,7 @@ hooks with the SELinux specifics expanded below:: 
    security_sctp_assoc_request()

    security_sctp_bind_connect()

    security_sctp_sk_clone()

    security_inet_conn_established()

    security_sctp_assoc_established()





security_sctp_assoc_request()
@@ -271,12 +269,12 @@ sockets sid and peer sid to that contained in the ``@asoc sid`` and 
    @newsk - pointer to new sock structure.





security_inet_conn_established()

security_sctp_assoc_established()

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Called when a COOKIE ACK is received where it sets the connection's peer sid

to that in ``@skb``::



    @sk  - pointer to sock structure.

    @asoc - pointer to sctp association structure.

    @skb - pointer to skbuff of the COOKIE ACK packet.

include/linux/lsm_hook_defs.h

+2 −0
Original line number Diff line number Diff line
@@ -335,6 +335,8 @@ LSM_HOOK(int, 0, sctp_bind_connect, struct sock *sk, int optname, 
	 struct sockaddr *address, int addrlen)

LSM_HOOK(void, LSM_RET_VOID, sctp_sk_clone, struct sctp_association *asoc,

	 struct sock *sk, struct sock *newsk)

LSM_HOOK(void, LSM_RET_VOID, sctp_assoc_established, struct sctp_association *asoc,

	 struct sk_buff *skb)

#endif /* CONFIG_SECURITY_NETWORK */



#ifdef CONFIG_SECURITY_INFINIBAND

include/linux/lsm_hooks.h

+5 −0
Original line number Diff line number Diff line
@@ -1050,6 +1050,11 @@ 
 *	@asoc pointer to current sctp association structure.

 *	@sk pointer to current sock structure.

 *	@newsk pointer to new sock structure.

 * @sctp_assoc_established:

 *	Passes the @asoc and @chunk->skb of the association COOKIE_ACK packet

 *	to the security module.

 *	@asoc pointer to sctp association structure.

 *	@skb pointer to skbuff of association packet.

 *

 * Security hooks for Infiniband

 *

include/linux/security.h

+7 −0
Original line number Diff line number Diff line
@@ -1430,6 +1430,8 @@ int security_sctp_bind_connect(struct sock *sk, int optname, 
			       struct sockaddr *address, int addrlen);

void security_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,

			    struct sock *newsk);

void security_sctp_assoc_established(struct sctp_association *asoc,

				     struct sk_buff *skb);



#else	/* CONFIG_SECURITY_NETWORK */

static inline int security_unix_stream_connect(struct sock *sock,
@@ -1649,6 +1651,11 @@ static inline void security_sctp_sk_clone(struct sctp_association *asoc, 
					  struct sock *newsk)

{

}



static inline void security_sctp_assoc_established(struct sctp_association *asoc,

						   struct sk_buff *skb)

{

}

#endif	/* CONFIG_SECURITY_NETWORK */



#ifdef CONFIG_SECURITY_INFINIBAND

net/sctp/sm_statefuns.c

+1 −1
Original line number Diff line number Diff line
@@ -946,7 +946,7 @@ enum sctp_disposition sctp_sf_do_5_1E_ca(struct net *net, 
	sctp_add_cmd_sf(commands, SCTP_CMD_INIT_COUNTER_RESET, SCTP_NULL());



	/* Set peer label for connection. */

	security_inet_conn_established(ep->base.sk, chunk->skb);

	security_sctp_assoc_established((struct sctp_association *)asoc, chunk->skb);



	/* RFC 2960 5.1 Normal Establishment of an Association

	 *