Bug #1561
closedWrite to ipfw divert socket failed: Permission denied rappidly followed thread restart loop
Description
I'm trying to use suricata in ipfw divert mode under FreeBSD (11-head).
My setup is working on a lab with very few traffic (just ping and few telnet on port 80).
But once put in production it only need one workstation surfing for crashing suricata in less than 5 seconds.
Here this an extract of log message:
23/9/2015 -- 20:49:13 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied
23/9/2015 -- 20:49:13 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 43, dropped 0
23/9/2015 -- 20:49:13 - <Info> - thread "Verdict0" restarted
23/9/2015 -- 20:49:13 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied
23/9/2015 -- 20:49:13 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 12, dropped 0
23/9/2015 -- 20:49:13 - <Info> - thread "Verdict0" restarted
23/9/2015 -- 20:49:13 - <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert socket failed: Permission denied
23/9/2015 -- 20:49:13 - <Info> - IPFW Processing: - (Verdict0) Pkts accepted 30, dropped 0
23/9/2015 -- 20:49:13 - <Error> - [ERRCODE: SC_ERR_TM_THREADS_ERROR(136)] - thread restarts exceeded threshold limit for thread "Verdict0"
There were some changes regarding SOCK_RAW in FreeBSD since 10.0, and other change in the futur 11: https://wiki.freebsd.org/SOCK_RAW
Because divert socket is using SOCK_RAW: Can these FreeBSD changes generate this problem ?