1 files changed, 66 insertions, 4 deletions

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 7a10ae3c3d82..2a2e094560de 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1046,6 +1046,12 @@ static int sctp_setsockopt_bindx(struct sock *sk,
         /* Do the work. */
         switch (op) {
         case SCTP_BINDX_ADD_ADDR:
+                /* Allow security module to validate bindx addresses. */
+                err = security_sctp_bind_connect(sk, SCTP_SOCKOPT_BINDX_ADD,
+                                                 (struct sockaddr *)kaddrs,
+                                                 addrs_size);
+                if (err)
+                        goto out;
                 err = sctp_bindx_add(sk, kaddrs, addrcnt);
                 if (err)
                         goto out;
@@ -1255,6 +1261,7 @@ static int __sctp_connect(struct sock *sk,
 
         if (assoc_id)
                 *assoc_id = asoc->assoc_id;
+
         err = sctp_wait_for_connect(asoc, &timeo);
         /* Note: the asoc may be freed after the return of
          * sctp_wait_for_connect.
@@ -1350,7 +1357,16 @@ static int __sctp_setsockopt_connectx(struct sock *sk,
         if (unlikely(IS_ERR(kaddrs)))
                 return PTR_ERR(kaddrs);
 
+        /* Allow security module to validate connectx addresses. */
+        err = security_sctp_bind_connect(sk, SCTP_SOCKOPT_CONNECTX,
+                                         (struct sockaddr *)kaddrs,
+                                          addrs_size);
+        if (err)
+                goto out_free;
+
         err = __sctp_connect(sk, kaddrs, addrs_size, assoc_id);
+
+out_free:
         kvfree(kaddrs);
 
         return err;
@@ -1680,6 +1696,7 @@ static int sctp_sendmsg_new_asoc(struct sock *sk, __u16 sflags,
         struct sctp_association *asoc;
         enum sctp_scope scope;
         struct cmsghdr *cmsg;
+        struct sctp_af *af;
         int err;
 
         *tp = NULL;
@@ -1705,6 +1722,21 @@ static int sctp_sendmsg_new_asoc(struct sock *sk, __u16 sflags,
 
         scope = sctp_scope(daddr);
 
+        /* Label connection socket for first association 1-to-many
+         * style for client sequence socket()->sendmsg(). This
+         * needs to be done before sctp_assoc_add_peer() as that will
+         * set up the initial packet that needs to account for any
+         * security ip options (CIPSO/CALIPSO) added to the packet.
+         */
+        af = sctp_get_af_specific(daddr->sa.sa_family);
+        if (!af)
+                return -EINVAL;
+        err = security_sctp_bind_connect(sk, SCTP_SENDMSG_CONNECT,
+                                         (struct sockaddr *)daddr,
+                                         af->sockaddr_len);
+        if (err < 0)
+                return err;
+
         asoc = sctp_association_new(ep, sk, scope, GFP_KERNEL);
         if (!asoc)
                 return -ENOMEM;
@@ -2932,6 +2964,8 @@ static int sctp_setsockopt_primary_addr(struct sock *sk, char __user *optval,
 {
         struct sctp_prim prim;
         struct sctp_transport *trans;
+        struct sctp_af *af;
+        int err;
 
         if (optlen != sizeof(struct sctp_prim))
                 return -EINVAL;
@@ -2939,6 +2973,17 @@ static int sctp_setsockopt_primary_addr(struct sock *sk, char __user *optval,
         if (copy_from_user(&prim, optval, sizeof(struct sctp_prim)))
                 return -EFAULT;
 
+        /* Allow security module to validate address but need address len. */
+        af = sctp_get_af_specific(prim.ssp_addr.ss_family);
+        if (!af)
+                return -EINVAL;
+
+        err = security_sctp_bind_connect(sk, SCTP_PRIMARY_ADDR,
+                                         (struct sockaddr *)&prim.ssp_addr,
+                                         af->sockaddr_len);
+        if (err)
+                return err;
+
         trans = sctp_addr_id2transport(sk, &prim.ssp_addr, prim.ssp_assoc_id);
         if (!trans)
                 return -EINVAL;
@@ -3161,6 +3206,7 @@ static int sctp_setsockopt_mappedv4(struct sock *sk, char __user *optval, unsign
 static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned int optlen)
 {
         struct sctp_sock *sp = sctp_sk(sk);
+        struct sctp_af *af = sp->pf->af;
         struct sctp_assoc_value params;
         struct sctp_association *asoc;
         int val;
@@ -3185,7 +3231,8 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned
         if (val) {
                 int min_len, max_len;
 
-                min_len = SCTP_DEFAULT_MINSEGMENT - sp->pf->af->net_header_len;
+                min_len = SCTP_DEFAULT_MINSEGMENT - af->net_header_len;
+                min_len -= af->ip_options_len(sk);
                 min_len -= sizeof(struct sctphdr) +
                            sizeof(struct sctp_data_chunk);
 
@@ -3198,7 +3245,8 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned
         asoc = sctp_id2assoc(sk, params.assoc_id);
         if (asoc) {
                 if (val == 0) {
-                        val = asoc->pathmtu - sp->pf->af->net_header_len;
+                        val = asoc->pathmtu - af->net_header_len;
+                        val -= af->ip_options_len(sk);
                         val -= sizeof(struct sctphdr) +
                                sctp_datachk_len(&asoc->stream);
                 }
@@ -3267,6 +3315,13 @@ static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optva
         if (!sctp_assoc_lookup_laddr(asoc, (union sctp_addr *)&prim.sspp_addr))
                 return -EADDRNOTAVAIL;
 
+        /* Allow security module to validate address. */
+        err = security_sctp_bind_connect(sk, SCTP_SET_PEER_PRIMARY_ADDR,
+                                         (struct sockaddr *)&prim.sspp_addr,
+                                         af->sockaddr_len);
+        if (err)
+                return err;
+
         /* Create an ASCONF chunk with SET_PRIMARY parameter    */
         chunk = sctp_make_asconf_set_prim(asoc,
                                           (union sctp_addr *)&prim.sspp_addr);
@@ -5140,9 +5195,11 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
         sctp_copy_sock(sock->sk, sk, asoc);
 
         /* Make peeled-off sockets more like 1-1 accepted sockets.
-         * Set the daddr and initialize id to something more random
+         * Set the daddr and initialize id to something more random and also
+         * copy over any ip options.
          */
         sp->pf->to_sk_daddr(&asoc->peer.primary_addr, sk);
+        sp->pf->copy_ip_options(sk, sock->sk);
 
         /* Populate the fields of the newsk from the oldsk and migrate the
          * asoc to the newsk.
@@ -8465,6 +8522,8 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
 {
         struct inet_sock *inet = inet_sk(sk);
         struct inet_sock *newinet;
+        struct sctp_sock *sp = sctp_sk(sk);
+        struct sctp_endpoint *ep = sp->ep;
 
         newsk->sk_type = sk->sk_type;
         newsk->sk_bound_dev_if = sk->sk_bound_dev_if;
@@ -8507,7 +8566,10 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
         if (newsk->sk_flags & SK_FLAGS_TIMESTAMP)
                 net_enable_timestamp();
 
-        security_sk_clone(sk, newsk);
+        /* Set newsk security attributes from orginal sk and connection
+         * security attribute from ep.
+         */
+        security_sctp_sk_clone(ep, sk, newsk);
 }
 
 static inline void sctp_copy_descendant(struct sock *sk_to,