Project

General

Profile

Actions

Bug #10254

closed

pf error "too many elements" when attempting to load large tables

Added by Jim Pingle about 4 years ago. Updated over 3 years ago.

Status:
Resolved
Priority:
Urgent
Category:
Operating System
Target version:
Start date:
02/11/2020
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.4.5
Affected Architecture:
All

Description

On at least pfSense-base-2.4.5.r.20200210.0912 and later, pf fails to load large tables no matter what the limits are in pf:

: pfctl -f /tmp/rules.debug
/tmp/rules.debug:23: cannot define table bogonsv6: too many elements.
Consider increasing net.pf.request_maxcount.
pfctl: Syntax error in config file: pf rules not loaded

However, that OID is not present on 2.4.5:

: sysctl net.pf
net.pf.source_nodes_hashsize: 8192
net.pf.states_hashsize: 32768
: sysctl -a | grep request_maxcount
0
:

There is plenty of room in the table hard limit:

: wc -l /etc/bogonsv6 
  108611 /etc/bogonsv6
: pfctl -sm | grep table
table-entries hard limit  2000000

Similar to #9356 on 2.5.0, but in that case we set a higher default for that OID. That does not appear to be possible on 2.4.5.

Tried on amd64 and SG-3100, same result on both.

Actions

Also available in: Atom PDF