freebsd-skq

History

kp 37106b5e69 pfctl: Point users to net.pf.request_maxcount if large requests are rejected

The kernel will reject very large tables to avoid resource exhaustion
attacks. Some users run into this limit with legitimate table
configurations.

The error message in this case was not very clear:

    pf.conf:1: cannot define table nets: Invalid argument
    pfctl: Syntax error in config file: pf rules not loaded

If a table definition fails we now check the request_maxcount sysctl,
and if we've tried to create more than that point the user at
net.pf.request_maxcount:

    pf.conf:1: cannot define table nets: too many elements.
    Consider increasing net.pf.request_maxcount.
    pfctl: Syntax error in config file: pf rules not loaded

PR:		235076
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D18909

2019-01-28 08:36:10 +00:00

tests

pfctl test: Add a test for macro names with a space in it

2018-10-28 05:50:04 +00:00

Makefile

Move pf.os to sbin/pfctl/

2018-08-11 13:58:26 +00:00

Makefile.depend

DIRDEPS_BUILD: Update dependencies.

2017-10-31 00:07:04 +00:00

parse.y

pfctl: Point users to net.pf.request_maxcount if large requests are rejected