SCTP Implementation in the Linux Kernel Explained

This article provides an overview of how the Linux operating system implements the Stream Control Transmission Protocol (SCTP). Linux provides native, kernel-level support for SCTP via the Linux Kernel SCTP (LKSCTP) project, integrating it alongside TCP and UDP in the network stack. Below is an examination of the kernel architecture, socket abstractions, internal data structures, and chunk processing mechanisms that make SCTP functional in Linux environments.

Core Architecture and Kernel Module

SCTP is implemented directly within the core Linux networking subsystem, residing under the net/sctp/ directory in the Linux kernel source tree. It is typically built as a dynamically loadable kernel module named sctp (with an optional helper module sctp_diag for socket monitoring).

In the Linux network hierarchy, SCTP registers itself as an AF_INET and AF_INET6 transport protocol using the inet_register_protosw() function. It hooks into the protocol switch tables via its own struct proto (such as sctp_prot) and struct proto_ops (sctp_stream_ops and sctp_seqpacket_ops), allowing the kernel's Virtual File System (VFS) to map standard socket system calls directly to SCTP-specific handlers.

Socket API Models

Linux supports both standard SCTP programming models defined in RFC 6458:

1. One-to-One Style (SOCK_STREAM): Emulates traditional TCP behavior. Each socket corresponds to a single SCTP association. It supports standard calls like listen(), accept(), connect(), send(), and recv().
2. One-to-Many Style (SOCK_SEQPACKET): Emulates UDP-like semantics while preserving message boundaries and SCTP features. A single socket endpoint can manage multiple simultaneous associations across different remote endpoints without requiring explicit accept() calls for every incoming stream.

Key Kernel Data Structures

The Linux implementation models the protocol through a hierarchy of primary kernel structures:

• struct sctp_endpoint: Represents the local socket abstraction, holding default parameters, security configurations, and references to associated sockets.
• struct sctp_association: Represents an active SCTP connection between two endpoints. It tracks operational states, peer parameters, transmission control blocks, retransmission timers, congestion windows, and stream states.
• struct sctp_transport: Represents an individual network path to a specific destination IP address of a multi-homed peer. It manages Path MTU discovery, round-trip time (RTT) calculation, and error counters for that specific path.
• struct sctp_chunk: Represents an individual SCTP chunk encapsulated inside an sk_buff (socket buffer). It tracks chunk headers, payload references, and transmission flags.

State Machine and Packet Processing

Linux drives SCTP using an explicit finite-state machine (FSM). When incoming packets arrive via the IP layer via sctp_rcv(), the kernel parses the SCTP common header and iterates over bundled chunks:

1. De-bundling: Chunks are extracted into individual sctp_chunk references.
2. Validation: Checksums (CRC32c) and verification tags are validated.
3. FSM Execution: The state machine function sctp_do_sm() evaluates the current state of the sctp_association, the incoming chunk type, and context to produce a set of side effects (commands).
4. Command Interpreter: The side effects, such as generating selective acknowledgments (SACKs), resetting timers, or forwarding payload data to the socket receive queue, are queued and executed sequentially.

Multihoming and Congestion Management

Linux implements multihoming by monitoring all associated sctp_transport paths independently:

• Heartbeat Mechanism: The kernel periodically schedules HEARTBEAT chunks across idle paths via timer controls. If a path fails to respond to repeated heartbeats, its state transitions to inactive.
• Automatic Failover: When the primary path exceeds its error threshold, outgoing traffic is dynamically redirected to an alternate active sctp_transport associated with the connection.
• Per-Path Congestion Control: Linux maintains independent congestion windows (cwnd) and slow-start thresholds (ssthresh) for each individual destination address, preventing an impairment on one physical link from corrupting the transmission metrics of another.

Userspace Interface and Configuration

User space processes interact with the kernel stack using the standard POSIX socket API combined with libsctp from the lksctp-tools package. Protocol configuration is exposed to system administrators via sysctl under /proc/sys/net/sctp/, allowing fine-tuning of parameters such as heartbeat intervals, RTO bounds, and buffer limits. Association and endpoint metrics are exposed through /proc/net/sctp/ for real-time monitoring and debugging.