pf: limit extra SCTP states
Needs ReviewPublic
Actions

Authored by kp on Jun 21 2025, 7:19 PM.

Tags

None

Referenced Files

	Unknown Object (File)
	Thu, Nov 6, 12:16 PM

	Unknown Object (File)
	Thu, Nov 6, 12:16 PM

	Unknown Object (File)
	Mon, Nov 3, 9:26 PM

	Unknown Object (File)
	Mon, Nov 3, 4:13 AM

	Unknown Object (File)
	Oct 25 2025, 1:18 AM

	Unknown Object (File)
	Oct 23 2025, 10:01 PM

	Unknown Object (File)
	Oct 18 2025, 9:55 AM

	Unknown Object (File)
	Oct 6 2025, 4:30 PM

Subscribers

vegeta_tuxpowered.net

Details

Reviewers

None

Group Reviewers

network

Summary

For SCTP we create states for all combinations of endpoints, to allow multihoming to work.
Malicious users could abuse this to fill our state table more easily
than they otherwise could, because we create states between all
combinations of endpoints. Limit this to no more than 8 extra endpoints
for each side of the connection.

MFC after: 2 weeks
Sponsored by: Orange Business Services