Page MenuHomeFreeBSD

pf: limit extra SCTP states
Needs ReviewPublic

Authored by kp on Jun 21 2025, 7:19 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Oct 6, 4:30 PM
Unknown Object (File)
Mon, Sep 22, 6:04 PM
Unknown Object (File)
Sep 14 2025, 12:12 AM
Unknown Object (File)
Sep 13 2025, 11:50 PM
Unknown Object (File)
Sep 12 2025, 4:51 PM
Unknown Object (File)
Sep 11 2025, 1:07 PM
Unknown Object (File)
Sep 8 2025, 10:00 AM
Unknown Object (File)
Sep 7 2025, 6:17 PM

Details

Reviewers
None
Group Reviewers
network
Summary

For SCTP we create states for all combinations of endpoints, to allow multihoming to work.
Malicious users could abuse this to fill our state table more easily
than they otherwise could, because we create states between all
combinations of endpoints. Limit this to no more than 8 extra endpoints
for each side of the connection.

MFC after: 2 weeks
Sponsored by: Orange Business Services

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 65013
Build 61896: arc lint + arc unit