svn commit: r296025 - head/sys/netpfil/pf

[Kristof Provost]

On 2016-02-24 23:47:55 (-0800), Conrad Meyer <cem at FreeBSD.org> wrote:
> On Wed, Feb 24, 2016 at 11:41 PM, Adrian Chadd <adrian.chadd at gmail.com> wrote:
> > .. what's capping totlen so one doesn't run out of memory?
> 
> There was a DoS vector before (user controlled io->pfrio_size) and
> basically the same DoS vector now (either of io->pfrio_size or
> io->pfrio_size2).  This change isn't a regression.  Still, it should
> be fixed.
> 
It's an M_WAITOK allocation, so if the user asks for more memory than is
available the thread will sleep. I'd assumed that if the user terminates
the thread the sleep will wake, the allocation will fail and the ioctl()
will return an error.

Perhaps we should do what OpenBSD do, and not allocate the temporary
buffer at all. They copy in/out the individual entries one by one. On
the other hand, one could still exhaust memory by inserting large
numbers of addresses in the table.

I'm a little wary of adding arbitrary limits to the number of entries in
a table, because this bug (and #192677) show that users do actually
insert 100.000 addresses in a table.

Regards,
Kristof