Re: "Unknown error" message from pfctl on an existing table

Alexander Leidinger <[email protected]> Fri, 20 Sep 2024 12:21:44 +0200

Newsgroups	gmane.os.freebsd.security.general
Organization	No organization, this is a private message.
Message-ID	<[email protected]>

Am 2024-09-20 12:00, schrieb Kristof Provost:
> On 20 Sep 2024, at 10:50, Alexander Leidinger wrote:
>> Hi,
>> 
>> # pfctl -s Tables
>> bruteforce
>> crowdsec-blocklists
>> crowdsec6-blocklists
>> martians
>> martians6
>> 
>> # pfctl -t crowdsec-blocklists -T show
>> pfctl: Unknown error: -1.
>> 
>> What could be the cause of this error?
> The next debugging step would be to use ‘truss’ to see what call fails.

When I list a working table (crowdsec6-blocklists):
---snip---
openat(AT_FDCWD,"/dev/pf",O_RDONLY,00)           = 3 (0x3)
ioctl(3,DIOCGETALTQSV1,0x233eb87dbe0)            ERR#19 'Operation not 
supported by device'
openat(AT_FDCWD,"/dev/pf",O_RDWR,00)             = 4 (0x4)
socket(PF_NETLINK,SOCK_RAW,16)                   = 5 (0x5)
setsockopt(5,270,11,0x233eb87db7c,4)             = 0 (0x0)
getsockopt(5,SOL_SOCKET,SO_RCVBUF,0x233eb87db74,0x233eb87db78) = 0 (0x0)
ioctl(3,DIOCRGETADDRS,0x233eb87d240)             = 0 (0x0)
ioctl(3,DIOCRGETADDRS,0x233eb87d240)             = 0 (0x0)
fstat(1,{ mode=-rw-r--r-- ,inode=6897,size=7721,blksize=24064 }) = 0 
(0x0)
    2001:620:20d0::24
    2001:67c:6ec:203:192:42:116:173
    2001:67c:6ec:203:192:42:116:174
---snip---

When I list the non-working table (crowdsec-blocklists):
---snip---
openat(AT_FDCWD,"/dev/pf",O_RDONLY,00)           = 3 (0x3)
ioctl(3,DIOCGETALTQSV1,0x19fc93899a90)           ERR#19 'Operation not 
supported by device'
openat(AT_FDCWD,"/dev/pf",O_RDWR,00)             = 4 (0x4)
socket(PF_NETLINK,SOCK_RAW,16)                   = 5 (0x5)
setsockopt(5,270,11,0x19fc93899a2c,4)            = 0 (0x0)
getsockopt(5,SOL_SOCKET,SO_RCVBUF,0x19fc93899a24,0x19fc93899a28) = 0 
(0x0)
ioctl(3,DIOCRGETADDRS,0x19fc938990f0)            = 0 (0x0)
ioctl(3,DIOCRGETADDRS,0x19fc938990f0)            ERR#22 'Invalid 
argument'
issetugid()                                      = 0 (0x0)
---snip---

> I can reproduce the error message attempting to list a table that 
> doesn’t exist.

Well... at least it shows up in the list of tables...

> There’s been a bug with table name length: 
> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279225 so perhaps 
> that’s what you’re running into.

I can list crowdsec6-blocklists, but not crowdsec-blocklists. This is 
current as of 2024-09-05-105247. After looking at the PR, I should run a 
FreeBSD version which is not affected by this. Correct?

I have this on two systems running this version of current.

Bye,
Alexander.

-- 
http://www.Leidinger.net [email protected]: PGP 0x8F31830F9F2772BF
http://www.FreeBSD.org    [email protected]  : PGP 0x8F31830F9F2772BF

signature.asc (application/pgp-signature, 833 B)