From nobody Fri Sep 20 10:27:30 2024 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4X97qm61hTz5Vg8y for ; Fri, 20 Sep 2024 10:27:32 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from smtp.freebsd.org (smtp.freebsd.org [96.47.72.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4X97qm5Swjz4YN3; Fri, 20 Sep 2024 10:27:32 +0000 (UTC) (envelope-from kp@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1726828052; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CbKyfeXI/AGcAqTtrfp4UPiHlcGo37sOM2qn6P86Drs=; b=Oi4kStCew4uoXtrGGdF+2f4EMrMolzs519tTvNhO8Y3TkJJcxVyTTmJIHaY0ghG0LZh6w/ NGcIMGJRDbcnXidFrym2zHyVcdN2kNbPCwqQmds6VWB3O4zgBrOR61tGYDOQprTLojP3/r NBPYwZXRgKbgs207q5xXtvnkkBi5NmeX6riL7mAgDmLPwaQyqNSaJYaSbLnFeCbzT1s2Pq kt3TbG9ak5WqFB3R7qFVDUHiqPSYCKvH2i261Mlnxj4nHTwyqRzJXGp6AiG3o9K/b/Cl5o K7Q+V90ZX9Q2ZTq9D58sblNkBIIWrbE32PJ+CMJcMTJ0YpmZp1duNyzVVhfx1A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1726828052; a=rsa-sha256; cv=none; b=iErUSxycM8M1NdMOszDo2vhhi2bPFFoFB9dXu0GeFhBNbtsiHM0PdtTnBDoxnu72s/+42G x3SZQ3vLc3NGwIMbBXisSSgCI1XP8yFyNWELsohsc9rfXy4s895yBE7fmP/wXws0SquhQn kFKlETGatVI+xGjH1ba3RfAbo9+pWJU89p8Nd+hAADkXJzOtwXmxHeta9fnXOah49IVC2c wxL1fgL1MH/QGmGjECIDE19wVeOoNL+YBKYeJ/MQVW0NrIuuPme6l/W3QQ26tYhXs2Yxhv jxQ+TqZEgx9M7IXzUQNMO4ndWTI3mKU6+8mkFRuSd8rl3dOCOK77gjrB+pcVtQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1726828052; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CbKyfeXI/AGcAqTtrfp4UPiHlcGo37sOM2qn6P86Drs=; b=bOlUAtzOXM1fFal1TduiEs7/5GVOr+LOUzjdZd85N3i3gOOBybFzLjnPf9Emt48wtnowRB likpZbLMKpGn7aCZoQxELxUjMlFoDmiVaMcbIT5yfLQqnVkth2LYLSM7uFNJzO2RfTVBC8 Q8fyZXD1BPJfQ1repXCxJJG/rKOiw+L8kUw6LZLCWAmDRYQ7x+NvW3zVbmLrnCIyh+yCHH nOvtRbGoPGTtqBfuvNio+gQ2G+5u198LbUZ8sLx+ywdDd7Ow+2MZt9H1D7i9PicLyxG3cw jtyv87xiZCt44BsrLcLkcoM9mE6smH0C0QDLFun2WA1uOAV/gshZ3bwPV1vB9Q== Received: from venus.codepro.be (venus.codepro.be [5.9.86.228]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "mx1.codepro.be", Issuer "R11" (verified OK)) (Authenticated sender: kp) by smtp.freebsd.org (Postfix) with ESMTPSA id 4X97qm4L91z1Rgv; Fri, 20 Sep 2024 10:27:32 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: by venus.codepro.be (Postfix, authenticated sender kp) id 377DE3BEF1; Fri, 20 Sep 2024 12:27:31 +0200 (CEST) From: Kristof Provost To: Alexander Leidinger Cc: FreeBSD Security list Subject: Re: "Unknown error" message from pfctl on an existing table Date: Fri, 20 Sep 2024 11:27:30 +0100 X-Mailer: MailMate (1.14r5937) Message-ID: In-Reply-To: References: List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 20 Sep 2024, at 11:21, Alexander Leidinger wrote: > Am 2024-09-20 12:00, schrieb Kristof Provost: >> On 20 Sep 2024, at 10:50, Alexander Leidinger wrote: >>> Hi, >>> >>> # pfctl -s Tables >>> bruteforce >>> crowdsec-blocklists >>> crowdsec6-blocklists >>> martians >>> martians6 >>> >>> # pfctl -t crowdsec-blocklists -T show >>> pfctl: Unknown error: -1. >>> >>> What could be the cause of this error? >> The next debugging step would be to use =E2=80=98truss=E2=80=99 to see= what call fails. > > When I list a working table (crowdsec6-blocklists): > ---snip--- > openat(AT_FDCWD,"/dev/pf",O_RDONLY,00) =3D 3 (0x3) > ioctl(3,DIOCGETALTQSV1,0x233eb87dbe0) ERR#19 'Operation not = supported by device' > openat(AT_FDCWD,"/dev/pf",O_RDWR,00) =3D 4 (0x4) > socket(PF_NETLINK,SOCK_RAW,16) =3D 5 (0x5) > setsockopt(5,270,11,0x233eb87db7c,4) =3D 0 (0x0) > getsockopt(5,SOL_SOCKET,SO_RCVBUF,0x233eb87db74,0x233eb87db78) =3D 0 (0= x0) > ioctl(3,DIOCRGETADDRS,0x233eb87d240) =3D 0 (0x0) > ioctl(3,DIOCRGETADDRS,0x233eb87d240) =3D 0 (0x0) > fstat(1,{ mode=3D-rw-r--r-- ,inode=3D6897,size=3D7721,blksize=3D24064 }= ) =3D 0 (0x0) > 2001:620:20d0::24 > 2001:67c:6ec:203:192:42:116:173 > 2001:67c:6ec:203:192:42:116:174 > ---snip--- > > When I list the non-working table (crowdsec-blocklists): > ---snip--- > openat(AT_FDCWD,"/dev/pf",O_RDONLY,00) =3D 3 (0x3) > ioctl(3,DIOCGETALTQSV1,0x19fc93899a90) ERR#19 'Operation not = supported by device' > openat(AT_FDCWD,"/dev/pf",O_RDWR,00) =3D 4 (0x4) > socket(PF_NETLINK,SOCK_RAW,16) =3D 5 (0x5) > setsockopt(5,270,11,0x19fc93899a2c,4) =3D 0 (0x0) > getsockopt(5,SOL_SOCKET,SO_RCVBUF,0x19fc93899a24,0x19fc93899a28) =3D 0 = (0x0) > ioctl(3,DIOCRGETADDRS,0x19fc938990f0) =3D 0 (0x0) > ioctl(3,DIOCRGETADDRS,0x19fc938990f0) ERR#22 'Invalid argume= nt' > issetugid() =3D 0 (0x0) > ---snip--- > That=E2=80=99s not the error code I see for a non-existent table, so it=E2= =80=99s not quite the same issue. DIOCRGETADDRS returns EINVAL, which is probably because the table is runn= ing into the net.pf.request_maxcount limit. Try increasing that sysctl. That limitation will go away when I get around to converting that particu= lar ioctl to netlink, but that probably won=E2=80=99t be today. I still h= ope to get all of them converted before we branch 15, but that=E2=80=99s = a hope and not a promise. In the mean time I=E2=80=99ll improve libpfctl so we get an actual error = message printed in pfctl, rather than =E2=80=98unknown error=E2=80=99. >> I can reproduce the error message attempting to list a table that does= n=E2=80=99t exist. > > Well... at least it shows up in the list of tables... > >> There=E2=80=99s been a bug with table name length: https://bugs.freebs= d.org/bugzilla/show_bug.cgi?id=3D279225 so perhaps that=E2=80=99s what yo= u=E2=80=99re running into. > > I can list crowdsec6-blocklists, but not crowdsec-blocklists. This is c= urrent as of 2024-09-05-105247. After looking at the PR, I should run a F= reeBSD version which is not affected by this. Correct? > Correct. Best regards, Kristof