Pfr_update_stats



  • I have been encountering the following error message repeatedly for the last few 2.3 snapshots

    Jan 28 13:33:37 kernel pfr_update_stats: assertion failed.
    Jan 28 13:33:37 kernel pfr_update_stats: assertion failed.
    Jan 28 13:32:04 kernel pfr_update_stats: assertion failed.
    Jan 28 13:32:04 kernel pfr_update_stats: assertion failed.
    Jan 28 13:32:03 kernel pfr_update_stats: assertion failed.
    Jan 28 13:31:59 kernel pfr_update_stats: assertion failed.
    Jan 28 13:31:59 kernel pfr_update_stats: assertion failed.

    Please help me to understand what it is and how to resolve it.

    Thanks.



  • The latest snapshot seems to have cleared the fault.



  • I'm getting those in 2.3.b.20160203.1400 x64
    and 2.3.b.20160204.1618 x64

    Intel Xeon X3430 @ 2.40GHz

    Installed Packages
    arping 1.2.1_1
    Cron 0.3.6_1
    iftop 0.17_1
    nmap 1.4.3_1
    Notes 0.2.9_1
    openvpn-client-export 1.3.6_1
    pfBlockerNG 2.0.7
    snort 3.2.9.1_1
    System_Patches 1.1.3_1

    Receiving many log entries per second

    Feb 4 19:03:29 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:29 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:28 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:27 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:27 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:27 	kernel 		pfr_update_stats: assertion failed.
    Feb 4 19:03:27 	kernel 		pfr_update_stats: assertion failed. 
    

    Edit:
    I am currently seeing this on a 2nd machine 2.3-BETA (amd64) built on Wed Feb 03 11:34
    AMD Athlon X2

    Installed packages:
    arping 1.2.1_1
    Cron 0.3.6_1
    iftop 0.17_1
    nmap 1.4.3_1
    openvpn-client-export 1.3.6_1
    pfBlockerNG 2.0.7
    snort 3.2.9.1_1
    System_Patches 1.1.3_1

    Edit:
    An Opensense user recently ran into this https://forum.opnsense.org/index.php?topic=2031.msg6392#msg6392

    Their Dev says that trigger is in their pf_table.c
    https://github.com/opnsense/src/blob/stable/15.7/sys/netpfil/pf/pf_table.c#L1988-L1992
    (or this FreeBSD 10 ver http://fxr.watson.org/fxr/source/netpfil/pf/pf_table.c?v=FREEBSD10)

    I'm poking around to see if I can spot something obvious.



  • I had 3 pfSense boxes with this issue.  All 3 are fixed now.

    I believe the issue was due to LAN blocking rules, w/ aliases containing 127.0.0.1

    I fixed it by by turning off the block lists in pfBlocker, containing 127.0.0.1.
    (I located the list by grep'ng for the IP in a shell)

    I also could have fixed it by turning on Suppression in pfBlockerNG -> General

    PSA: Remember to sanitize your inputs!



  • Which lists did you have in pfblocker that would trigger it?



  • @cmb:

    Which lists did you have in pfblocker that would trigger it?

    Spearpoint https://spearpointing.com/cbl.txt

    And an old Shellshock list I made (that's prob outdated by now).
    Not sure how I let 127.0.0.1 into mine.


Log in to reply