Date: Fri, 20 Sep 2024 12:21:44 +0200 From: Alexander Leidinger <Alexander@Leidinger.net> To: Kristof Provost <kp@freebsd.org> Cc: FreeBSD Security list <freebsd-security@freebsd.org> Subject: Re: "Unknown error" message from pfctl on an existing table Message-ID: <c24980270caff52d5d1def3a5e9ae02a@Leidinger.net> In-Reply-To: <E1944C83-4692-42B9-BBC3-C065EE9D84A1@FreeBSD.org> References: <e3eeae1bad4f182bad5abbf281a7bb26@Leidinger.net> <f3b1ade48b9bb0d7891b643defcc7b16@Leidinger.net> <E1944C83-4692-42B9-BBC3-C065EE9D84A1@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--=_b899c553f01b9787da7f2f67a168ab65
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=UTF-8;
format=flowed
Am 2024-09-20 12:00, schrieb Kristof Provost:
> On 20 Sep 2024, at 10:50, Alexander Leidinger wrote:
>> Hi,
>>
>> # pfctl -s Tables
>> bruteforce
>> crowdsec-blocklists
>> crowdsec6-blocklists
>> martians
>> martians6
>>
>> # pfctl -t crowdsec-blocklists -T show
>> pfctl: Unknown error: -1.
>>
>> What could be the cause of this error?
> The next debugging step would be to use ‘truss’ to see what call fails.
When I list a working table (crowdsec6-blocklists):
---snip---
openat(AT_FDCWD,"/dev/pf",O_RDONLY,00) = 3 (0x3)
ioctl(3,DIOCGETALTQSV1,0x233eb87dbe0) ERR#19 'Operation not
supported by device'
openat(AT_FDCWD,"/dev/pf",O_RDWR,00) = 4 (0x4)
socket(PF_NETLINK,SOCK_RAW,16) = 5 (0x5)
setsockopt(5,270,11,0x233eb87db7c,4) = 0 (0x0)
getsockopt(5,SOL_SOCKET,SO_RCVBUF,0x233eb87db74,0x233eb87db78) = 0 (0x0)
ioctl(3,DIOCRGETADDRS,0x233eb87d240) = 0 (0x0)
ioctl(3,DIOCRGETADDRS,0x233eb87d240) = 0 (0x0)
fstat(1,{ mode=-rw-r--r-- ,inode=6897,size=7721,blksize=24064 }) = 0
(0x0)
2001:620:20d0::24
2001:67c:6ec:203:192:42:116:173
2001:67c:6ec:203:192:42:116:174
---snip---
When I list the non-working table (crowdsec-blocklists):
---snip---
openat(AT_FDCWD,"/dev/pf",O_RDONLY,00) = 3 (0x3)
ioctl(3,DIOCGETALTQSV1,0x19fc93899a90) ERR#19 'Operation not
supported by device'
openat(AT_FDCWD,"/dev/pf",O_RDWR,00) = 4 (0x4)
socket(PF_NETLINK,SOCK_RAW,16) = 5 (0x5)
setsockopt(5,270,11,0x19fc93899a2c,4) = 0 (0x0)
getsockopt(5,SOL_SOCKET,SO_RCVBUF,0x19fc93899a24,0x19fc93899a28) = 0
(0x0)
ioctl(3,DIOCRGETADDRS,0x19fc938990f0) = 0 (0x0)
ioctl(3,DIOCRGETADDRS,0x19fc938990f0) ERR#22 'Invalid
argument'
issetugid() = 0 (0x0)
---snip---
> I can reproduce the error message attempting to list a table that
> doesn’t exist.
Well... at least it shows up in the list of tables...
> There’s been a bug with table name length:
> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279225 so perhaps
> that’s what you’re running into.
I can list crowdsec6-blocklists, but not crowdsec-blocklists. This is
current as of 2024-09-05-105247. After looking at the PR, I should run a
FreeBSD version which is not affected by this. Correct?
I have this on two systems running this version of current.
Bye,
Alexander.
--
http://www.Leidinger.net Alexander@Leidinger.net: PGP 0x8F31830F9F2772BF
http://www.FreeBSD.org netchild@FreeBSD.org : PGP 0x8F31830F9F2772BF
--=_b899c553f01b9787da7f2f67a168ab65
Content-Type: application/pgp-signature;
name=signature.asc
Content-Disposition: attachment;
filename=signature.asc;
size=833
Content-Description: OpenPGP digital signature
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEER9UlYXp1PSd08nWXEg2wmwP42IYFAmbtTMkACgkQEg2wmwP4
2Ib4wA/+JZeL4oztSlvq7w7xp9C8XqLXu9wMMreaNQFyfoFXL8d3E43abTOWZb9g
HoWojSpkOwbsVvdJIo6Ra/MRq5EQHMemOAHfBQ17zcr8QbPvL/vHxQ5BAnJOCwUT
YBuwcukomYICx3Znqn70S1n2bqf7R1CM+fh28IPTcAE+IZronZrjP0Ed+suQ5+Qx
W5NvnyKW2qtcyKx5zGJH8YFFeFOdzSza480cT6+LahJ3z0jdZgWvL4GxR/9RE9Zc
D4r76c/F72tEnUoZvEibB1l5cHAaWyVLdr3U/yXO1SzXc4fNtc6GUXewULWIZVWy
LpbNU3nPCz38JF4F50fHWc2Vq6LJHCRo9QhDbvACyKOWuRkHyeKZ3L9ILH1UaHyQ
X3jbuXbbcc0QPs12F1nY5Ns6cUnciFfrCk4ya58Q4BNvd16uZkr7+XnoSD4HOXP0
3WneM7QTwgcpMDnQGrzOfsmiwgZkj30uqd87NlaBAzdkg3YeogTHtV8654cRqLAf
U67IiHX3zc2V/QCDmp705wOoAdA2utBiqLc7spfvTFyyUb9SOJgyy5jmDu2a+MYs
D3NkVYWqvk35sg3Tlf8fH4dc4tBGeLr+ME/QI55OScrEXGUDmEyEhllued1jQPPm
P+pncSlKV1GSJMJZyX0h09S5gegusm2fyeK9v6NYc4WqWRii/qI=
=bcco
-----END PGP SIGNATURE-----
--=_b899c553f01b9787da7f2f67a168ab65--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?c24980270caff52d5d1def3a5e9ae02a>