[Bug 296577] pfctl cannot replace an existing table in the non anchor case

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D296577

--- Comment #8 from Jim Pirzyk <[email protected]> ---
I think I found the missing piece of debugging info.  In re-upgrading the
server to 15.1-RELEASE-p2, I ran these tests:

pirzyk@lilo:~
3>sudo pfctl -T replace -t blk -f /etc/pf.block.txt
Password:
no changes.

This gave me a different error message, but I then realized that I don't ha=
ve
the system in my final configuration.  Specifically the kern.securelevel was
still the default -1, so changing that:

pirzyk@lilo:~
5>sudo sysctl kern.securelevel=3D2
kern.securelevel: -1 -> 2
pirzyk@lilo:~
6>sudo pfctl -T replace -t blk -f /etc/pf.block.txt
pfctl: Anchor does not exist.

I checked the man page and didn't see any changes to the securelevel(7) tal=
king
about level 2 having any effect on the firewall.  Just the disks, etc that I
remember from the past.

Further testing shows that this only happens at level=3D2:

pirzyk@lilo:~
1>sysctl kern.securelevel
kern.securelevel: -1
pirzyk@lilo:~
2>sudo pfctl -T replace -t blk -f /etc/pf.block.txt
Password:
no changes.
pirzyk@lilo:~
3>sudo sysctl kern.securelevel=3D1
kern.securelevel: -1 -> 1
pirzyk@lilo:~
4>sudo pfctl -T replace -t blk -f /etc/pf.block.txt
no changes.
pirzyk@lilo:~
5>sudo sysctl kern.securelevel=3D2
kern.securelevel: 1 -> 2
pirzyk@lilo:~
6>sudo pfctl -T replace -t blk -f /etc/pf.block.txt
pfctl: Anchor does not exist.

Now when I ran the dtrace command, no output was created:

pirzyk@lilo:~
1>sudo dtrace -n 'fbt::pfr_add_tables:return { printf("@%x =3D> %d\n", arg0,
arg1); }'
Password:
dtrace: description 'fbt::pfr_add_tables:return ' matched 1 probe
^C

pirzyk@lilo:~
2>

This is even after running the re-load in another window:

pirzyk@lilo:~/tmp
2> sudo pfctl -T replace -t blk -f /etc/pf.block.txt
Password:
pfctl: Anchor does not exist.
pirzyk@lilo:~/tmp
3>

--=20
You are receiving this mail because:
You are the assignee for the bug.=