pf: limit extra SCTP states
AbandonedPublic
Actions

Authored by kp on Jun 21 2025, 7:19 PM.

Tags

None

Referenced Files

	Unknown Object (File)
	Mon, Sep 14, 12:07 PM

	Unknown Object (File)
	Fri, Sep 11, 4:03 PM

	Unknown Object (File)
	Thu, Sep 10, 2:10 PM

	Unknown Object (File)
	Sun, Sep 6, 7:30 AM

	Unknown Object (File)
	Sat, Sep 5, 3:34 AM

	Unknown Object (File)
	Sat, Sep 5, 12:26 AM

	Unknown Object (File)
	Fri, Sep 4, 8:40 PM

	Unknown Object (File)
	Fri, Sep 4, 8:34 PM

Subscribers

vegeta_tuxpowered.net

Details

Reviewers

rrs
tuexen

Group Reviewers

network
transport

Summary

For SCTP we create states for all combinations of endpoints, to allow multihoming to work.
Malicious users could abuse this to fill our state table more easily
than they otherwise could, because we create states between all
combinations of endpoints. Limit this to no more than 8 extra endpoints
for each side of the connection.

MFC after: 2 weeks
Sponsored by: Orange Business Services

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 65013
Build 61896: arc lint + arc unit

Event Timeline

kp created this revision.Jun 21 2025, 7:19 PM

Herald added subscribers: vegeta_tuxpowered.net, glebius, melifaro and 2 others. · View Herald TranscriptJun 21 2025, 7:19 PM

kp requested review of this revision.Jun 21 2025, 7:19 PM

Harbormaster completed remote builds in B65013: Diff 157413.Jun 21 2025, 7:19 PM

pouria added reviewers: transport, rrs, tuexen.Feb 25 2026, 2:10 PM

This is already in the tree, as cd0169c9379c400ec75b77e87ca770e37f964276. I managed to forget to add the 'differential revision' tag, so Phabricator didn't notice.

In D50968#1270115, @kp wrote:

This is already in the tree, as cd0169c9379c400ec75b77e87ca770e37f964276. I managed to forget to add the 'differential revision' tag, so Phabricator didn't notice.

Thank you

Revision Contents
Changeset List

Path

Size

sys/

netpfil/

pf/

pf.c

11 lines

tests/

sys/

netpfil/

pf/

sctp.py

28 lines

Diff 157413

View Options

sys/netpfil/pf/pf.c