From nobody Wed Jul 9 12:28:40 2025 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4bcchm6D0Wz61c9f; Wed, 09 Jul 2025 12:28:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4bcchm5c58z42PS; Wed, 09 Jul 2025 12:28:40 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1752064120; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=3w5U5tSyVvjiiWE14RsOzlDkC1eO71Rkvppgc+B8ZFI=; b=uK4+vSZllA9QLpYF8ONQTK5z4fSC4Ci+2HFxFom/KFODrjefNUczHP944AFJF2mv+256k4 VsLdDmb0aWE9jYqbkkNSPXB8ijNZ8ePuPrg75WV/mW1QBKVQ6zqkYObCPDHoMggGlEyzXU +8yiP/PdXMQhWojMNlNK4scrnh3zRMPpsIdHc+ggVkTxNk7Scmri2dRGwHB28Ahi6mWiiq e+gLjG+mFIkMxqKiV9rovW4diOx5GLr3SmVv3/GgLZ8yzsPDfXtAzCxVkOkP88Lzj+h80B 6vbu4YoEtRvEPJp9+FTrd2/ExzyvLenN52joZznBkPhTGOMhx66aVtN/pOCNyg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1752064120; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=3w5U5tSyVvjiiWE14RsOzlDkC1eO71Rkvppgc+B8ZFI=; b=F4SMMe0SQsOrirXYrGiV78qeLHWgVrukUpg0NkiWHgdiTyZ6C1kfzcDuyo5/lKKa5x1woK +A2G8N/TnyfBmoHuFWZq+GqdXsy+19PchDjLWmqy+Duvepp7sIalryv2isGmbxIZjTjU71 8qj7SDh0RkASuVnQFmtWIkuSMBuj0C7dXaos7WwpLMlw48+hUcryC0KUATJ0Zl5jcMTntK Q9pj9FhaJLu86JyffejGiVfN/Kg6kKR+biNd49RNNjYLqJ7Av5cMGxx2QIvnloUIqulCH+ 666kFDleO6BS4AU3TOWOV8NxyOGya0rVTxQhdy50TLa399kFDX5jMu7NcYZ8+w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1752064120; a=rsa-sha256; cv=none; b=NuhQlFsYste0y3LebsOixDS38S08duvk4duyQAznFnIw04RB5C2wZ/hXPj36au2XTSdCEa YI6ZLWCdkfgLOTq6EI3PaSKx48IYbacNhWKnGfa+6sIrtQkBQ93WKZkUT/MPTTBXt8AWQN 8YjrRw/VkfZ9AV/0CHDGiDF1AswglntyNO2w2TkToDmmPCkHA36rGSM5V5FEF/sPgmTrG0 yfAWaJM+SdylCMmG7kI5wDWzJWEgcKrojekfKChifHu18PjffJRx+6rKBnAS4TP1JeNE5M PBe7g0ULQIkwydKXvaTtcMcbzpyiYqQpaDu9L7EqtcLgYYDdttZ/SmoSt70DtQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4bcchm5CVgz6Zr; Wed, 09 Jul 2025 12:28:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 569CSefF041740; Wed, 9 Jul 2025 12:28:40 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 569CSeDb041737; Wed, 9 Jul 2025 12:28:40 GMT (envelope-from git) Date: Wed, 9 Jul 2025 12:28:40 GMT Message-Id: <202507091228.569CSeDb041737@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: 7a96c75098af - stable/14 - pf: limit extra SCTP states List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 7a96c75098afe071e49755f1beccaaf08f9ae13f Auto-Submitted: auto-generated The branch stable/14 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=7a96c75098afe071e49755f1beccaaf08f9ae13f commit 7a96c75098afe071e49755f1beccaaf08f9ae13f Author: Kristof Provost AuthorDate: 2025-06-21 09:13:22 +0000 Commit: Kristof Provost CommitDate: 2025-07-09 08:08:50 +0000 pf: limit extra SCTP states For SCTP we create states for all combinations of endpoints, to allow multihoming to work. Malicious users could abuse this to fill our state table more easily than they otherwise could, because we create states between all combinations of endpoints. Limit this to no more than 8 extra endpoints for each side of the connection. MFC after: 2 weeks Sponsored by: Orange Business Services (cherry picked from commit cd0169c9379c400ec75b77e87ca770e37f964276) --- sys/netpfil/pf/pf.c | 11 +++++++++++ tests/sys/netpfil/pf/sctp.py | 28 ++++++++++++++++++++++++++++ 2 files changed, 39 insertions(+) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 2ba2f2213fb7..f067c2b6bdf4 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -191,6 +191,8 @@ VNET_DEFINE(size_t, pf_allrulecount); VNET_DEFINE(struct pf_krule *, pf_rulemarker); #endif +#define PF_SCTP_MAX_ENDPOINTS 8 + struct pf_sctp_endpoint; RB_HEAD(pf_sctp_endpoints, pf_sctp_endpoint); struct pf_sctp_source { @@ -6374,6 +6376,7 @@ pf_sctp_multihome_add_addr(struct pf_pdesc *pd, struct pf_addr *a, uint32_t v_ta }; struct pf_sctp_source *i; struct pf_sctp_endpoint *ep; + int count; PF_SCTP_ENDPOINTS_LOCK(); @@ -6392,13 +6395,21 @@ pf_sctp_multihome_add_addr(struct pf_pdesc *pd, struct pf_addr *a, uint32_t v_ta } /* Avoid inserting duplicates. */ + count = 0; TAILQ_FOREACH(i, &ep->sources, entry) { + count++; if (pf_addr_cmp(&i->addr, a, pd->af) == 0) { PF_SCTP_ENDPOINTS_UNLOCK(); return; } } + /* Limit the number of addresses per endpoint. */ + if (count >= PF_SCTP_MAX_ENDPOINTS) { + PF_SCTP_ENDPOINTS_UNLOCK(); + return; + } + i = malloc(sizeof(*i), M_PFTEMP, M_NOWAIT); if (i == NULL) { PF_SCTP_ENDPOINTS_UNLOCK(); diff --git a/tests/sys/netpfil/pf/sctp.py b/tests/sys/netpfil/pf/sctp.py index 230dbae0d327..da42ce527195 100644 --- a/tests/sys/netpfil/pf/sctp.py +++ b/tests/sys/netpfil/pf/sctp.py @@ -426,6 +426,34 @@ class TestSCTP(VnetTestTemplate): assert re.search(r"all sctp 192.0.2.4:.*192.0.2.3:1234", states) assert re.search(r"all sctp 192.0.2.4:.*192.0.2.2:1234", states) + @pytest.mark.require_user("root") + def test_limit_addresses(self): + srv_vnet = self.vnet_map["vnet2"] + + ifname = self.vnet_map["vnet1"].iface_alias_map["if1"].name + for i in range(0, 16): + ToolsHelper.print_output("/sbin/ifconfig %s inet alias 192.0.2.%d/24" % (ifname, 4 + i)) + + ToolsHelper.print_output("/sbin/pfctl -e") + ToolsHelper.pf_rules([ + "block proto sctp", + "pass on lo", + "pass inet proto sctp to 192.0.2.0/24"]) + + # Set up a connection, which will try to create states for all addresses + # we have assigned + client = SCTPClient("192.0.2.3", 1234) + client.send(b"hello", 0) + rcvd = self.wait_object(srv_vnet.pipe) + print(rcvd) + assert rcvd['ppid'] == 0 + assert rcvd['data'] == "hello" + + # But the number should be limited to 9 (original + 8 extra) + states = ToolsHelper.get_output("/sbin/pfctl -ss | grep 192.0.2.2") + print(states) + assert(states.count('\n') <= 9) + @pytest.mark.require_user("root") def test_disallow_related(self): srv_vnet = self.vnet_map["vnet2"]