pfSense » pfSense Packages

I'm also the OP for that ticket, too.

The issue apparently stems from the output of "pfctl -vvsr" changing in 22.05. Due to the change in output, pfBlockNG is unable read the list of it's rules out of the table. The result is a complete scan of all rules for each log entry processed.

The patch below addresses the issue for pfBlockerNG-devel. I make no representation that this is the best way to address the issue.

*** pfblockerng.inc.org    Tue Mar 29 08:31:43 2022
--- pfblockerng.inc    Tue Jun 14 10:05:51 2022
***************
*** 4136,4142 ****
          foreach ($results as $result) {
              if (substr($result, 0, 1) == '@') {

!                 $r = explode(')', $result, 2);

                  // pfSense > v2.6 uses an 'ridentifier' string
                  if (strpos($result, 'ridentifier') != FALSE) {
--- 4136,4142 ----
          foreach ($results as $result) {
              if (substr($result, 0, 1) == '@') {

!                 $r = explode(' ', $result, 2);

                  // pfSense > v2.6 uses an 'ridentifier' string
                  if (strpos($result, 'ridentifier') != FALSE) {

For reference, the redmine for that issue is here:
https://redmine.pfsense.org/issues/13156

Well... seeing that would have saved me a bunch of debugging...

That one change looks to have solved the issue for me.

Testing in:

2.7.0-DEVELOPMENT (amd64)
built on Tue Jun 14 06:29:50 UTC 2022
FreeBSD 12.3-STABLE

With:
pfBlockerNG-devel 3.1.0_4

For reference, the patch to fix it is as follows:

diff --git a/net/usr/local/pkg/pfblockerng/pfblockerng.inc b/net/usr/local/pkg/pfblockerng/pfblockerng.inc
index 7fa8c1d2f8bf..2abbef30578b 100644
--- a/net/usr/local/pkg/pfblockerng/pfblockerng.inc
+++ b/net/usr/local/pkg/pfblockerng/pfblockerng.inc
@@ -4136,7 +4136,7 @@ function pfb_filterrules() {
         foreach ($results as $result) {
             if (substr($result, 0, 1) == '@') {

-                $r = explode(')', $result, 2);
+                $r = explode(' ', $result, 2);

                 // pfSense > v2.6 uses an 'ridentifier' string
                 if (strpos($result, 'ridentifier') != FALSE) {

Restart the pfb_filter service afterwards.

The high cpu is still occurring with this patch applied and running on 22.05, reboot, reloading package, etc. As stated by me and Steve, the CPU usage does not happen immediately, but when it does, the CPU goes over 7% as shown below. As a temp fix, I have minute cron to killall php_pfb so that we can utilize near full bandwidth with IPsec (~90 Mbps), otherwise throughput is less than half of that. This is on 7100's with over 1270 firewall rules with pfctl.

last pid: 45639;  load averages:  1.90,  1.54,  1.39  up 0+01:15:15    07:46:35
673 threads:   7 running, 624 sleeping, 42 waiting
CPU: 12.8% user,  0.2% nice, 13.9% system,  0.4% interrupt, 72.6% idle
Mem: 777M Active, 325M Inact, 928M Wired, 5831M Free
ARC: 419M Total, 168M MFU, 234M MRU, 8680K Anon, 1865K Header, 6337K Other
     172M Compressed, 497M Uncompressed, 2.88:1 Ratio
Swap: 1024M Total, 1024M Free

  PID USERNAME    PRI NICE   SIZE    RES STATE    C   TIME    WCPU COMMAND
   11 root        155 ki31     0B    64K RUN      1  54:40  68.26% [idle{idle: cpu1}]
   11 root        155 ki31     0B    64K CPU0     0  55:47  66.06% [idle{idle: cpu0}]
   11 root        155 ki31     0B    64K RUN      3  55:24  65.97% [idle{idle: cpu3}]
   11 root        155 ki31     0B    64K CPU2     2  53:14  52.20% [idle{idle: cpu2}]
30485 root         77    0    12M  3232K CPU3     3   0:01  18.55% /sbin/pfctl -vvsr
 5504 root         52    0    71M    52M piperd   0   0:20   8.59% /usr/local/bin/php_pfb -f /usr/local/pkg/pfblockerng/pfblockerng.inc filterlog
    0 root        -92    -     0B   736K -        1   2:23   6.49% [kernel{if_io_tqg_1}]
    0 root        -92    -     0B   736K RUN      3   2:41   5.27% [kernel{if_io_tqg_3}]
    8 root        -16    -     0B    16K e6000s   0   4:28   4.79% [e6000sw tick kproc]
    0 root        -92    -     0B   736K -        0   2:14   3.56% [kernel{if_io_tqg_0}]
88009 root         52    0   150M    87M accept   0   1:54   2.49% php-fpm: pool nginx (php-fpm){php-fpm}

Michael Novotny wrote in #note-9:

The high cpu is still occurring with this patch applied and running on 22.05, reboot, reloading package, etc. As stated by me and Steve, the CPU usage does not happen immediately, but when it does, the CPU goes over 7% as shown below.

Probably should confirm that the patch applied correctly. Assuming that you are running pfBlockerNG-devel, shasum output for pfblockerng.inc should be:

f8846925d60c29a4e189b554fe74c60ce6305c6b  /usr/local/pkg/pfblockerng/pfblockerng.inc

Denny Page wrote in #note-10:

Probably should confirm that the patch applied correctly. Assuming that you are running pfBlockerNG-devel, shasum output for pfblockerng.inc should be:

f8846925d60c29a4e189b554fe74c60ce6305c6b /usr/local/pkg/pfblockerng/pfblockerng.inc

Interesting... I reinstalled pfBlocker (pfBlockerNG-devel 3.1.0_4) as I was not getting that value. The first sum was just after reloading. The second is with the patch, exactly copied from Marco's note 8 above.

[22.05-RELEASE][admin@fw-hq1]/root: shasum /usr/local/pkg/pfblockerng/pfblockerng.inc
fc56abd134d3c35fe66a4736f080c545b42e827b  /usr/local/pkg/pfblockerng/pfblockerng.inc

[22.05-RELEASE][admin@fw-hq1]/root: shasum /usr/local/pkg/pfblockerng/pfblockerng.inc
7d26653c099158e752873c2843c426717dc4d9ed  /usr/local/pkg/pfblockerng/pfblockerng.inc

Michael Novotny wrote in #note-11:

Interesting... I reinstalled pfBlocker (pfBlockerNG-devel 3.1.0_4) as I was not getting that value. The first sum was just after reloading. The second is with the patch, exactly copied from Marco's note 8 above.

pfBlockerNG-devel has not (yet) been updated to correct the problem. Whenever you re-install pfBlockerNG, you are overwriting any patch you have applied to it and re-introducing the problem.

Something is wrong though. The shasums you have don't match either my original or patched version:

  e3d57737a2a6ecef4e8d759ca550fa3bf9fe8232  /usr/local/pkg/pfblockerng/pfblockerng.inc.org
  f8846925d60c29a4e189b554fe74c60ce6305c6b  /usr/local/pkg/pfblockerng/pfblockerng.inc

These are from pfBlockerNG-devel, version 3.1.0_4.

I would suggest that you re-install, and then carefully hand edit pfblockerng.inc to make the one character change. Be sure to change the close paren ')' to a single space ' '. Following that, disable and then re-enable pfBlockerNG.

This issue is still present in the just released pfBlockerNG-devel 3.1.0_6.

Same fix as before:

*** pfblockerng.inc.org    2022-10-10 14:35:41.159055000 -0700
--- pfblockerng.inc    2022-10-10 14:34:26.122428000 -0700
*************** function pfb_filterrules() {
*** 4136,4142 ****
          foreach ($results as $result) {
              if (substr($result, 0, 1) == '@') {

!                 $r = explode(')', $result, 2);

                  // pfSense > v2.6 uses an 'ridentifier' string
                  if (strpos($result, 'ridentifier') != FALSE) {
--- 4136,4142 ----
          foreach ($results as $result) {
              if (substr($result, 0, 1) == '@') {

!                 $r = explode(' ', $result, 2);

                  // pfSense > v2.6 uses an 'ridentifier' string
                  if (strpos($result, 'ridentifier') != FALSE) {

I can confirm this also. Problem still exists in 3.1.0_6