Re: "Unknown error" message from pfctl on an existing table

[Alexander Leidinger]

Am 2024-09-20 12:00, schrieb Kristof Provost:

On 20 Sep 2024, at 10:50, Alexander Leidinger wrote:

Hi,

# pfctl -s Tables
bruteforce
crowdsec-blocklists
crowdsec6-blocklists
martians
martians6

# pfctl -t crowdsec-blocklists -T show
pfctl: Unknown error: -1.

What could be the cause of this error?

The next debugging step would be to use ‘truss’ to see what call fails.

When I list a working table (crowdsec6-blocklists):
---snip---
openat(AT_FDCWD,"/dev/pf",O_RDONLY,00)           = 3 (0x3)

openat(AT_FDCWD,"/dev/pf",O_RDWR,00)             = 4 (0x4)
socket(PF_NETLINK,SOCK_RAW,16)                   = 5 (0x5)
setsockopt(5,270,11,0x233eb87db7c,4)             = 0 (0x0)
getsockopt(5,SOL_SOCKET,SO_RCVBUF,0x233eb87db74,0x233eb87db78) = 0 (0x0)
ioctl(3,DIOCRGETADDRS,0x233eb87d240)             = 0 (0x0)
ioctl(3,DIOCRGETADDRS,0x233eb87d240)             = 0 (0x0)

   2001:620:20d0::24
   2001:67c:6ec:203:192:42:116:173
   2001:67c:6ec:203:192:42:116:174
---snip---

When I list the non-working table (crowdsec-blocklists):
---snip---
openat(AT_FDCWD,"/dev/pf",O_RDONLY,00)           = 3 (0x3)

openat(AT_FDCWD,"/dev/pf",O_RDWR,00)             = 4 (0x4)
socket(PF_NETLINK,SOCK_RAW,16)                   = 5 (0x5)
setsockopt(5,270,11,0x19fc93899a2c,4)            = 0 (0x0)

ioctl(3,DIOCRGETADDRS,0x19fc938990f0)            = 0 (0x0)

issetugid()                                      = 0 (0x0)
---snip---

ioctl(3,DIOCGETALTQSV1,0x233eb87dbe0) ERR#19 'Operation not supported by device' fstat(1,{ mode=-rw-r--r-- ,inode=6897,size=7721,blksize=24064 }) = 0 (0x0) ioctl(3,DIOCGETALTQSV1,0x19fc93899a90) ERR#19 'Operation not supported by device' getsockopt(5,SOL_SOCKET,SO_RCVBUF,0x19fc93899a24,0x19fc93899a28) = 0 (0x0) ioctl(3,DIOCRGETADDRS,0x19fc938990f0) ERR#22 'Invalid argument'

I can reproduce the error message attempting to list a table that doesn’t exist.

Well... at least it shows up in the list of tables...

There’s been a bug with table name length: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279225 so perhaps that’s what you’re running into.

I have this on two systems running this version of current.

Bye,
Alexander.

--
http://www.Leidinger.net alexan...@leidinger.net: PGP 0x8F31830F9F2772BF
http://www.FreeBSD.org    netch...@freebsd.org  : PGP 0x8F31830F9F2772BF

I can list crowdsec6-blocklists, but not crowdsec-blocklists. This is current as of 2024-09-05-105247. After looking at the PR, I should run a FreeBSD version which is not affected by this. Correct?

signature.asc
Description: OpenPGP digital signature