Project

General

Profile

Actions

Bug #1561

closed

Write to ipfw divert socket failed: Permission denied rappidly followed thread restart loop

Added by Olivier Cochard-Labbé over 8 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

I'm trying to use suricata in ipfw divert mode under FreeBSD (11-head).
My setup is working on a lab with very few traffic (just ping and few telnet on port 80).
But once put in production it only need one workstation surfing for crashing suricata in less than 5 seconds.

Here this an extract of log message:
23/9/2015 -- 20:49:13 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied
23/9/2015 -- 20:49:13 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 43, dropped 0
23/9/2015 -- 20:49:13 - <Info> - thread "Verdict0" restarted
23/9/2015 -- 20:49:13 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied
23/9/2015 -- 20:49:13 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 12, dropped 0
23/9/2015 -- 20:49:13 - <Info> - thread "Verdict0" restarted
23/9/2015 -- 20:49:13 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied
23/9/2015 -- 20:49:13 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 30, dropped 0
23/9/2015 -- 20:49:13 - <Error> - [ERRCODE: SC_ERR_TM_THREADS_ERROR(136)] - thread restarts exceeded threshold limit for thread "Verdict0"

There were some changes regarding SOCK_RAW in FreeBSD since 10.0, and other change in the futur 11: https://wiki.freebsd.org/SOCK_RAW
Because divert socket is using SOCK_RAW: Can these FreeBSD changes generate this problem ?

Actions

Also available in: Atom PDF