Re: "Unknown error" message from pfctl on an existing table

[Alexander Leidinger]

Am 2024-09-20 12:27, schrieb Kristof Provost:

On 20 Sep 2024, at 11:21, Alexander Leidinger wrote:

When I list the non-working table (crowdsec-blocklists):
---snip---
openat(AT_FDCWD,"/dev/pf",O_RDONLY,00)           = 3 (0x3)

openat(AT_FDCWD,"/dev/pf",O_RDWR,00)             = 4 (0x4)
socket(PF_NETLINK,SOCK_RAW,16)                   = 5 (0x5)
setsockopt(5,270,11,0x19fc93899a2c,4)            = 0 (0x0)

ioctl(3,DIOCRGETADDRS,0x19fc938990f0)            = 0 (0x0)

issetugid()                                      = 0 (0x0)
---snip---

ioctl(3,DIOCGETALTQSV1,0x19fc93899a90) ERR#19 'Operation not supported by device' getsockopt(5,SOL_SOCKET,SO_RCVBUF,0x19fc93899a24,0x19fc93899a28) = 0 (0x0) ioctl(3,DIOCRGETADDRS,0x19fc938990f0) ERR#22 'Invalid argument'

That’s not the error code I see for a non-existent table, so it’s not quite the same issue.

DIOCRGETADDRS returns EINVAL, which is probably because the table is running into the net.pf.request_maxcount limit. Try increasing that sysctl.

Yes:
#  pfctl -t crowdsec-blocklists -T show | wc -l
   74167

Thanks!
Alexander.

--
http://www.Leidinger.net alexan...@leidinger.net: PGP 0x8F31830F9F2772BF
http://www.FreeBSD.org    netch...@freebsd.org  : PGP 0x8F31830F9F2772BF

signature.asc
Description: OpenPGP digital signature