PHP error log - Had to reboot

[stephenw10]

Hmm, well the error is in the function 'group_ports'. But the error seems to imply part of the file is missing.

Do you have patches applied to 2.7?

Otherwise perhaps you have rules with port ranges or ports aliases with ranges of ports? That's what that function does but it wouldn't do it spontaneously. I would only ever expect to see that when the rules are updated or reloaded.

Steve

[Wylbur]

@stephenw10

This is what the dashboard shows:

2.7.0-RELEASE (amd64)

built on Wed Jun 28 03:53:34 UTC 2023
FreeBSD 14.0-CURRENT

The system is on the latest version.
Version information updated at Thu Nov 9 8:59:13 EST 2023

I was looking at the patches list (finally found it by taking time to actually read everything in each dropdown) and I've read the patch list and I don't see anything that looks like it addresses this. But I do see patches for logs and ARP that I think I should put on.

[stephenw10]

I would certainly apply the list of recommended patches from the system patches package.

But to be clear you don't have any custom patches?

[Wylbur]

@stephenw10

I have put on No patches at all.

But I will take your advice and put on these patches as soon as I can. Probably sometime this weekend.

[Wylbur]

@Wylbur

Forgot to update. Patches on. Also enabled SNORT.

[stephenw10]

Are you still seeing that error regenerated?

[Wylbur]

@stephenw10
Intermittently. Finally found a dual port Intel based adapter -- will get it next week.

It seems related to a web site that is using PHP and has a problem. May just be a coincidence.

[stephenw10]

I think you need to check what's actually on line 1316 in /etc/inc/util.inc. You might have some file corruption.
It's hard to see how that error would happen in the expected file contents.

Steve

[Wylbur]

@stephenw10
Sorry for the delay.

I have not seen that PHP error lately. But if I go back to that PHP based web site, it might trigger it again (I have no idea why).

I can't see a way to get the info via gui. So I'm going to need to get some time to get a monitor and keyboard to the comm closet so I can do the CLI stuff (which I'm just OK with). I'm not a real Linux admin. And then, I have to find a way to capture the output to post it here.

Meanwhile/BTW -- I was able to get a 2 port 1GB Intel adapter and get it installed and configured. So far so good.

And I have SNORT running (got a non-commercial key for testing).

[stephenw10]

Which site is that? Visiting some website shouldn't make any difference to anything happening in pfSense.

You can just open the file ( /etc/inc/util.inc) in Diag > File Edit and then go to the line directly.

[Wylbur]

@stephenw10

Thanks, I had missed that handy little tool in Diagnostics:

Here is what it contains, and I may have gone a bit further than needed, but I wanted to get to what I thought would be end of stanza/paragraph (how ever it is called -- BTW - what language is this?)

foreach ($ports as $port) {
	if (($kflc) && (strpos($port, '#') === 0)) {	// Keep Full Line Comments (lines beginning with #).
		$comments[] = $port;
	} else if (is_portrange($port)) {
		list($begin, $end) = explode(":", $port);
		if ($begin > $end) {
			$aux = $begin;
			$begin = $end;
			$end = $aux;
		}
		for ($i = $begin; $i <= $end; $i++) {
			if (!in_array($i, $uniq)) {
				$uniq[] = $i;
			}
		}
	} else if (is_port($port)) {
		if (!in_array($port, $uniq)) {
			$uniq[] = $port;
		}
	}
}
sort($uniq, SORT_NUMERIC);

$result = array();
foreach ($uniq as $idx => $port) {
	if ($idx == 0) {
		$result[] = $port;
		continue;
	}

	$last = end($result);
	if (is_portrange($last)) {
		list($begin, $end) = explode(":", $last);
	} else {
		$begin = $end = $last;
	}

	if ($port == ($end+1)) {
		$end++;
		$result[count($result)-1] = "{$begin}:{$end}";
	} else {
		$result[] = $port;
	}
}

return array_merge($comments, $result);

}

[stephenw10]

It's PHP.

Hmm, that line looks to be as expected:
https://github.com/pfsense/pfsense/blob/RELENG_2_7_0/src/etc/inc/util.inc#L1316

In which case that error really doesn't make sense.

Are you still seeing it regenerated? And only when you visit some specific page?

[Wylbur]

@stephenw10

I haven't seen it since I put on the maint patches, come to think of it. Hmmmmm.

I'll post back if I see it again. I do tend to review the logs every few days.