Re: "Unknown error" message from pfctl on an existing table

Alexander Leidinger <[email protected]> Fri, 20 Sep 2024 12:39:16 +0200

Newsgroups	gmane.os.freebsd.security.general
Organization	No organization, this is a private message.
Message-ID	<[email protected]>

Am 2024-09-20 12:27, schrieb Kristof Provost:
> On 20 Sep 2024, at 11:21, Alexander Leidinger wrote:

>> When I list the non-working table (crowdsec-blocklists):
>> ---snip---
>> openat(AT_FDCWD,"/dev/pf",O_RDONLY,00)           = 3 (0x3)
>> ioctl(3,DIOCGETALTQSV1,0x19fc93899a90)           ERR#19 'Operation not 
>> supported by device'
>> openat(AT_FDCWD,"/dev/pf",O_RDWR,00)             = 4 (0x4)
>> socket(PF_NETLINK,SOCK_RAW,16)                   = 5 (0x5)
>> setsockopt(5,270,11,0x19fc93899a2c,4)            = 0 (0x0)
>> getsockopt(5,SOL_SOCKET,SO_RCVBUF,0x19fc93899a24,0x19fc93899a28) = 0 
>> (0x0)
>> ioctl(3,DIOCRGETADDRS,0x19fc938990f0)            = 0 (0x0)
>> ioctl(3,DIOCRGETADDRS,0x19fc938990f0)            ERR#22 'Invalid 
>> argument'
>> issetugid()                                      = 0 (0x0)
>> ---snip---
>> 
> That’s not the error code I see for a non-existent table, so it’s not 
> quite the same issue.
> 
> DIOCRGETADDRS returns EINVAL, which is probably because the table is 
> running into the net.pf.request_maxcount limit. Try increasing that 
> sysctl.

Yes:
#  pfctl -t crowdsec-blocklists -T show | wc -l
    74167

Thanks!
Alexander.

-- 
http://www.Leidinger.net [email protected]: PGP 0x8F31830F9F2772BF
http://www.FreeBSD.org    [email protected]  : PGP 0x8F31830F9F2772BF

signature.asc (application/pgp-signature, 833 B)