diff options
author | Kristof Provost <kp@FreeBSD.org> | 2019-01-28 08:36:10 +0000 |
---|---|---|
committer | Kristof Provost <kp@FreeBSD.org> | 2019-01-28 08:36:10 +0000 |
commit | 542feeff96df53919c4229ddec5ec4d86c74c734 (patch) | |
tree | ff5ef33797d31964c8bb19c107fece97d640406c /sbin/pfctl | |
parent | 6bda1ad8a279e60ff3684ebae92fffd355aed54b (diff) | |
download | src-test-542feeff96df53919c4229ddec5ec4d86c74c734.tar.gz src-test-542feeff96df53919c4229ddec5ec4d86c74c734.zip |
pfctl: Point users to net.pf.request_maxcount if large requests are rejected
The kernel will reject very large tables to avoid resource exhaustion
attacks. Some users run into this limit with legitimate table
configurations.
The error message in this case was not very clear:
pf.conf:1: cannot define table nets: Invalid argument
pfctl: Syntax error in config file: pf rules not loaded
If a table definition fails we now check the request_maxcount sysctl,
and if we've tried to create more than that point the user at
net.pf.request_maxcount:
pf.conf:1: cannot define table nets: too many elements.
Consider increasing net.pf.request_maxcount.
pfctl: Syntax error in config file: pf rules not loaded
PR: 235076
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D18909
Notes
Notes:
svn path=/head/; revision=343520
Diffstat (limited to 'sbin/pfctl')
-rw-r--r-- | sbin/pfctl/parse.y | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/sbin/pfctl/parse.y b/sbin/pfctl/parse.y index b0410f452b893..1182dde3b079b 100644 --- a/sbin/pfctl/parse.y +++ b/sbin/pfctl/parse.y @@ -4743,6 +4743,8 @@ process_tabledef(char *name, struct table_opts *opts) { struct pfr_buffer ab; struct node_tinit *ti; + unsigned long maxcount; + size_t s = sizeof(maxcount); bzero(&ab, sizeof(ab)); ab.pfrb_type = PFRB_ADDRS; @@ -4770,8 +4772,19 @@ process_tabledef(char *name, struct table_opts *opts) if (!(pf->opts & PF_OPT_NOACTION) && pfctl_define_table(name, opts->flags, opts->init_addr, pf->anchor->name, &ab, pf->anchor->ruleset.tticket)) { - yyerror("cannot define table %s: %s", name, - pfr_strerror(errno)); + + if (sysctlbyname("net.pf.request_maxcount", &maxcount, &s, + NULL, 0) == -1) + maxcount = 65535; + + if (ab.pfrb_size > maxcount) + yyerror("cannot define table %s: too many elements.\n" + "Consider increasing net.pf.request_maxcount.", + name); + else + yyerror("cannot define table %s: %s", name, + pfr_strerror(errno)); + goto _error; } pf->tdirty = 1; |