Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    New pfblockerNG install Database Sanity check Failed

    Scheduled Pinned Locked Moved pfBlockerNG
    31 Posts 8 Posters 860 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      madmaxpr
      last edited by

      @SteveITS Still seeing this error myself but have no further info. It does seem to function, just with the error being shown when it updates/reloads.

      1 Reply Last reply Reply Quote 0
      • T
        TheXman
        last edited by TheXman

        I was experiencing the same issue too.

        After comparing /usr/local/pkg/pfblockerng/pfblockerng.sh from 3.2.0 to 3.2.8, there was only 1 line that changed and it happened to be related to this issue. After reverting that line (#1281) back to the way it was in 3.2.0, the "Sanity Check" works as expected.

        Here are the lines as they exist in their respective versions.

        #Line 1281 in 3.2.0
        if [ "${s1} == ${s2}" ]; then
        
        #Line 1281 in 3.2.8
        if [ "${s1}" == "${s2}" ]; then
        

        Edit: Corrected my references to pfBlockerNG version numbers. Thanks @Maltz

        M 1 Reply Last reply Reply Quote 1
        • M
          Maltz @TheXman
          last edited by Maltz

          @TheXman Wouldn't the 2.7.2 version always evaluate as true, since the string is non-null? It looks like the sanity check was fixed in 2.8.0, exposing some other issue that may have been there all along but was hidden by the broken sanity check.

          (Edit: I guess the version numbers should be 3.2.0_8 and 3.2.8, respectively, since we're talking about pfBlockerNG and not pfSense itself.)

          M 1 Reply Last reply Reply Quote 1
          • M
            marchand.guy @Maltz
            last edited by

            @Maltz That is an excellent hypothesis!

            M 1 Reply Last reply Reply Quote 0
            • M
              marchand.guy @marchand.guy
              last edited by marchand.guy

              @marchand-guy Verified hypothesis. The code always reported true before 3.2.8.
              Good catch

              1 Reply Last reply Reply Quote 0
              • tinfoilmattT
                tinfoilmatt
                last edited by

                Looks like dev (@BBcan177) is already reviewing. Good teamwork, y'all.

                Responsible commit here. Remark indicates it was a cleanup commit. I don't have the coding skills to say for sure, but this pfblocker.php update and this pfblocker_alerts.php update look odd for some reason, in addition to whatever the pfblockerng.sh L1281 fix exposed.

                @marcosm

                BBcan177B 1 Reply Last reply Reply Quote 0
                • BBcan177B
                  BBcan177 Moderator @tinfoilmatt
                  last edited by

                  I think I found the last issue. The "masterfile" is a list of Filename/IPs. The "mastercat" file is just the IPs only. So it was trying to grep -v (exclude) any lines that start with the placeholder IP. So we need to change the masterfile to the mastercat in this line.

                  Try to change this line from:

                  From:
                  s1="$(grep -cv ^${ip_placeholder2}$ ${masterfile})"

                  To:
                  s1="$(grep -cv ^${ip_placeholder2}$ ${mastercat})"

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  T M S 3 Replies Last reply Reply Quote 4
                  • T
                    TheXman @BBcan177
                    last edited by

                    @BBcan177 Thank you!

                    1 Reply Last reply Reply Quote 0
                    • M
                      Maltz @BBcan177
                      last edited by

                      @BBcan177 Success!

                      Database Sanity check [ PASSED ]

                      M 1 Reply Last reply Reply Quote 0
                      • M
                        marchand.guy @Maltz
                        last edited by

                        @Maltz How?
                        No change on pfsense.

                        M 1 Reply Last reply Reply Quote 0
                        • M
                          Maltz @marchand.guy
                          last edited by Maltz

                          @marchand-guy I manually made the change to the shell script that BBcan177 described.

                          M 1 Reply Last reply Reply Quote 0
                          • S
                            slu @BBcan177
                            last edited by

                            @BBcan177 so next step is a new package for pfSense?

                            pfSense Gold subscription

                            1 Reply Last reply Reply Quote 0
                            • M
                              marchand.guy @Maltz
                              last edited by

                              @Maltz said in New pfblockerNG install Database Sanity check Failed:

                              @marchand-guy I manually made the change to the shell script that BBcan177 described.

                              Ok, done as well.
                              Thanks

                              1 Reply Last reply Reply Quote 0
                              • tinfoilmattT
                                tinfoilmatt
                                last edited by tinfoilmatt

                                Thanks, @BBcan177.

                                Some clear confusion ITT re pfSense system version and pfBlockerNG package version numbers. For posterity:

                                pfSense 2.7.2 CE - Database Sanity check issue not present, because pfBlockerNG and pfBlockerNG-devel packages are both on "RELENG_2_7_2" branch of pfSense / FreeBSD-Ports

                                pfSense 2.8 CE - Database Sanity check regression, possibly because branch updated to "devel" for both packages?

                                (RELENG_2_7_2 branch: pfBlockerNG/pfBlockerNG-devel)
                                (devel branch: pfBlockerNG/pfBlockerNG-devel)

                                I think that's what's happened. Maybe someone can give me a sanity check. 😜

                                The package version numbers appear to have been realigned in pfSense 2.8 CE however. The last package versions of pfBlockerNG and pfBockerNG-devel on pfSense 2.7.2 CE were 3.2.8 and 3.2.0_20 respectively.

                                But under 2.8 CE, both packages are now currently on version 3.2.8 (pfBlockerNG and pfBlockerNG-devel).

                                Will both packages continue to be maintained separately and we should expect version numbers to potentially diverge again?

                                1 Reply Last reply Reply Quote 1
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.