/ Register

Want to subscribe to topics you're interested in?
Become a Member

CSF CSF bug, lfd: every block reported as “failed"

Discussion in 'Other Centmin Mod Installed software' started by wmtech, Oct 13, 2026 at 11:02 PM.

Previous Thread Next Thread
Loading...
  1. Oct 13, 2026 at 11:02 PM #1
    wmtech

    wmtech Active Member

    190
    44
    28
    Jul 22, 2017
    Ratings:
    +142
    Local Time:
    1:07 AM
    Version: csf v16.32 (generic), iptables v1.8.10 (nf_tables), LF_IPSET = 1, WAITLOCK = 1

    Symptom

    Every block issued by lfd logs:

    Code:
    *Error* failed to block <IP> - the iptables command(s) reported failure, no block recorded
    The alert email is still sent and claims a temporary block. However, the block is not written to csf.tempban, so it never expires and doesn’t appear in csf -t.

    The iptables rules are actually added. With DEBUG = 3:

    Code:
    lfd[13134]: debug[8823]: Command:/sbin/ip6tables --wait -A DENYIN ! -i lo -s <IP> -j DROP
lfd[13134]: debug[8845]: Command:/sbin/ip6tables --wait -A DENYOUT ! -o lo -d <IP> -j LOGDROPOUT
lfd[13134]: *Error* failed to block <IP> - the iptables command(s) reported failure, no block recorded
    Immediately afterwards:

    Code:
    # ip6tables -S DENYIN | grep <IP>
-A DENYIN -s <IP>/128 ! -i lo -j DROP
    The client is blocked (connection times out). Identical blocks issued via csf -td from the command line succeed and are recorded correctly. This affects IPv4 and IPv6, and both port-specific and all-port temp blocks.

    Cause

    The P3 change in ipblock() only records a block if &iptablescmd(...) == 0. iptablescmd() returns the child wait status after waitpid. However, the block child runs with $SIG{CHLD} = 'IGNORE' (e.g. line 8879), so children are reaped automatically and the wait status is never 0. Every successful iptables command is therefore treated as a failure.

    Fix

    Adding one line at the top of iptablescmd() resolves it, the same pattern already used at lines 2398 and 3287:

    Code:
    sub iptablescmd {
       my $line = shift;
       my $command = shift;
       local $SIG{CHLD} = 'DEFAULT';
    After this change, lfd logs *Blocked in csf* correctly, the block is recorded in csf.tempban, and LF_PERMBLOCK escalation works as expected.
     
  2. Oct 15, 2026 at 3:04 AM #2
    eva2000

    eva2000 Administrator Staff Member

    59,930
    12,550
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,195
    Local Time:
    9:07 AM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Thanks for the heads up. I checked and this bug was already fixed in next CSF Firewall v16.33 beta release which I am testing. Guess I should promote 16.33 beta to stable though it's a big release as it has alot more bug fixes than any other CSF fork (including cPanel's) :)
     
  3. Oct 15, 2026 at 6:17 AM #3
    eva2000

    eva2000 Administrator Staff Member

    59,930
    12,550
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,195
    Local Time:
    9:07 AM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    If you have spare servers or want to test all fixes in Centmin Mod CSF Firewall v16.33 beta, you can check out how to test at https://community.centminmod.com/threads/centmin-mod-csf-firewall-v16-33-beta-release.32544/. This is the next scheduled 16.33 stable base.

    Centmin Mod CSF Firewall supports both stable and beta version upgrades as outlined in above link or below.

    CSF Firewall v16.33 beta release install/upgrade commands. Re-running same command over again will update to a newer v16.33-beta labeled release.
    Code (Text):
    cd /usr/src
rm -fv csf.tgz
wget https://download.centminmod.com/csf-beta/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh

    Code (Text):
    csf -v
csf: v16.33-beta (generic)

    The newer v16.33-beta release includes a forced beta release update command
    Code (Text):
    csf -ubf


    Code (Text):
           -c,  --check
              Check for updates to csf but do not upgrade

       -u,  --update
              Check for updates to csf and upgrade if available

       -uf    Force a checked reinstall from the stable channel

       -ud    Downgrade csf to the previous release (e.g. roll back to the
              last known-good version) using the mirror's /csf-previous/ path.
              Packages are downloaded over TLS and SHA256-verified, like -u

       -ub    Update csf to the beta release published on the mirror's
              /csf-beta/ path when it is newer under labelled release ordering.
              16.33-stable is newer than 16.33-beta; -ud is the explicit rollback.
              Beta packages are TLS- and SHA256-verified

       -ubf   Force a checked reinstall from the beta channel. Mirror rebuilds
              ship under the same 16.33-beta label, so -ub (label comparison)
              never picks one up; -ubf bypasses the ordering gate like -uf and
              still TLS- and SHA256-verifies the package


    CSF Firewall v16.33 beta change log here.

    If you want to switch back to CSF Firewall v16.32 latest release:
    Code (Text):
    cd /usr/src
rm -fv csf.tgz
wget https://download.centminmod.com/csf.tgz
tar -xzf csf.tgz
cd csf
sh install.sh
     
Previous Thread Next Thread
Loading...

.