After upgrading from FreeBSD 14.4-RELEASE-p7 to 15.1-RELEASE-p1 I no longer can replace table contents in my pf config. pfctl says the anchor does not exist. Well I'm not using any anchors: 16>sudo pfctl -T replace -t ipdb -f /etc/pf.country.txt Password: pfctl: Anchor does not exist. The file loads correct at boot time, but having to reboot the machine every time I want to update my block lists is a bit extreme.
I am unable to reproduce this. Please provide your full pf.conf as well as the outputs of `sudo pfctl -sr`, `sudo pfctl -sr -a '*'` and `sudo truss pfctl -T replace -t ipdb -f /etc/pf.country.txt`.
Created attachment 272573 [details] Requested debug info
Created attachment 272604 [details] ktrace of pfctl -T add failure Here's a ktrace of this failure: 9>sudo ktrace pfctl -t f2b -T add 91.192.10.217 pfctl: Operation not supported by device
(In reply to Jim Pirzyk from comment #2) It looks like PFNL_CMD_ADD_TABLE fails, and we're probably getting an irrelevant error message because the pfr_add_table() caller assumes errno will have the relevant error code, but that's not the case any more. That's a separate issue. `dtrace -n 'fbt::pfr_add_tables:return { printf("@%x => %d\n", arg0, arg1); }'` will hopefully tell us a bit more about why adding the table (a temporary table for the new addresses) fails. The exact same ruleset and table contents load just fine on my machines. Perhaps you're running out of memory?
Hi Kristof, Thanks for the feedback, this is useful. If I had run out of memory where (in what logs) where would I have seen it? Yes this machine is a VPS with limited memory (hw.physmem: 4250370048). And I too am having issues reproducing the issue on other (physical) hardware I have running 15.1. For operational reasons I have rolled back to 14.4-p7 (kudos to the freebsd-update folks for making the rollback work!) I have since dropped the `counters` tag from the PF table, but didn't see any help there (before I downgraded).