Date: Fri, 20 Sep 2024 11:27:30 +0100 From: Kristof Provost <kp@FreeBSD.org> To: Alexander Leidinger <Alexander@Leidinger.net> Cc: FreeBSD Security list <freebsd-security@freebsd.org> Subject: Re: "Unknown error" message from pfctl on an existing table Message-ID: <D89F8745-42F8-4586-A2C5-8116EF3C0029@FreeBSD.org> In-Reply-To: <c24980270caff52d5d1def3a5e9ae02a@Leidinger.net> References: <e3eeae1bad4f182bad5abbf281a7bb26@Leidinger.net> <f3b1ade48b9bb0d7891b643defcc7b16@Leidinger.net> <E1944C83-4692-42B9-BBC3-C065EE9D84A1@FreeBSD.org> <c24980270caff52d5d1def3a5e9ae02a@Leidinger.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On 20 Sep 2024, at 11:21, Alexander Leidinger wrote:
> Am 2024-09-20 12:00, schrieb Kristof Provost:
>> On 20 Sep 2024, at 10:50, Alexander Leidinger wrote:
>>> Hi,
>>>
>>> # pfctl -s Tables
>>> bruteforce
>>> crowdsec-blocklists
>>> crowdsec6-blocklists
>>> martians
>>> martians6
>>>
>>> # pfctl -t crowdsec-blocklists -T show
>>> pfctl: Unknown error: -1.
>>>
>>> What could be the cause of this error?
>> The next debugging step would be to use =E2=80=98truss=E2=80=99 to see=
what call fails.
>
> When I list a working table (crowdsec6-blocklists):
> ---snip---
> openat(AT_FDCWD,"/dev/pf",O_RDONLY,00) =3D 3 (0x3)
> ioctl(3,DIOCGETALTQSV1,0x233eb87dbe0) ERR#19 'Operation not =
supported by device'
> openat(AT_FDCWD,"/dev/pf",O_RDWR,00) =3D 4 (0x4)
> socket(PF_NETLINK,SOCK_RAW,16) =3D 5 (0x5)
> setsockopt(5,270,11,0x233eb87db7c,4) =3D 0 (0x0)
> getsockopt(5,SOL_SOCKET,SO_RCVBUF,0x233eb87db74,0x233eb87db78) =3D 0 (0=
x0)
> ioctl(3,DIOCRGETADDRS,0x233eb87d240) =3D 0 (0x0)
> ioctl(3,DIOCRGETADDRS,0x233eb87d240) =3D 0 (0x0)
> fstat(1,{ mode=3D-rw-r--r-- ,inode=3D6897,size=3D7721,blksize=3D24064 }=
) =3D 0 (0x0)
> 2001:620:20d0::24
> 2001:67c:6ec:203:192:42:116:173
> 2001:67c:6ec:203:192:42:116:174
> ---snip---
>
> When I list the non-working table (crowdsec-blocklists):
> ---snip---
> openat(AT_FDCWD,"/dev/pf",O_RDONLY,00) =3D 3 (0x3)
> ioctl(3,DIOCGETALTQSV1,0x19fc93899a90) ERR#19 'Operation not =
supported by device'
> openat(AT_FDCWD,"/dev/pf",O_RDWR,00) =3D 4 (0x4)
> socket(PF_NETLINK,SOCK_RAW,16) =3D 5 (0x5)
> setsockopt(5,270,11,0x19fc93899a2c,4) =3D 0 (0x0)
> getsockopt(5,SOL_SOCKET,SO_RCVBUF,0x19fc93899a24,0x19fc93899a28) =3D 0 =
(0x0)
> ioctl(3,DIOCRGETADDRS,0x19fc938990f0) =3D 0 (0x0)
> ioctl(3,DIOCRGETADDRS,0x19fc938990f0) ERR#22 'Invalid argume=
nt'
> issetugid() =3D 0 (0x0)
> ---snip---
>
That=E2=80=99s not the error code I see for a non-existent table, so it=E2=
=80=99s not quite the same issue.
DIOCRGETADDRS returns EINVAL, which is probably because the table is runn=
ing into the net.pf.request_maxcount limit. Try increasing that sysctl.
That limitation will go away when I get around to converting that particu=
lar ioctl to netlink, but that probably won=E2=80=99t be today. I still h=
ope to get all of them converted before we branch 15, but that=E2=80=99s =
a hope and not a promise.
In the mean time I=E2=80=99ll improve libpfctl so we get an actual error =
message printed in pfctl, rather than =E2=80=98unknown error=E2=80=99.
>> I can reproduce the error message attempting to list a table that does=
n=E2=80=99t exist.
>
> Well... at least it shows up in the list of tables...
>
>> There=E2=80=99s been a bug with table name length: https://bugs.freebs=
d.org/bugzilla/show_bug.cgi?id=3D279225 so perhaps that=E2=80=99s what yo=
u=E2=80=99re running into.
>
> I can list crowdsec6-blocklists, but not crowdsec-blocklists. This is c=
urrent as of 2024-09-05-105247. After looking at the PR, I should run a F=
reeBSD version which is not affected by this. Correct?
>
Correct.
Best regards,
Kristof
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?D89F8745-42F8-4586-A2C5-8116EF3C0029>