Warning: getservbyport() expects parameter 1 to be integer, string given in /etc/inc/filter_log.inc on line 447

pete35

pfsense 2.4.5RC from Sunday, while filtering firewall log entries on pass entries gives a warning:

jimp

I can't reproduce that here. It looks like it might be triggered by a specific message in your filter log.

If you can still reproduce this, look at the raw filter log (clog /var/log/filter.log on 2.4.x) and see if anything obviously stands out as being different/not belonging.

Or you can attach a copy of the filter.log file

pete35

@jimp said in Warning: getservbyport() expects parameter 1 to be integer, string given in /etc/inc/filter_log.inc on line 447:

clog /var/log/filter.log

I can reproduce it every time. No special entries in the filter log. I got a crash rport on the main page, same warnings.

jimp

The error line it mentions is when the log entries to show on the page are being displayed, not when applying the filter. So it must be from a log entry. Can you attach the log file here, or send it to me privately ( <my forum username> (a) netgate (dot) com )

jimp

OK, it is a bad entry in your log. Specifically, this one:

Feb 11 17:24:57 pfsense filterlog: 4294967295,,,0,ix0,short,pass,in,4,0x0,,54,23350,0,none,6,tcp,26,x.x.x.x,y.y.y.y,errormsg='tcp 6 [bad hdr length 0 - too short < 20]',

Normally that would be getting tossed out since it wouldn't parse, but it's not being rejected as expected. Now that I can reproduce it, I can look into a fix.

Thanks!

pete35

@jimp said in Warning: getservbyport() expects parameter 1 to be integer, string given in /etc/inc/filter_log.inc on line 447:

4294967295

Feb 11 17:24:57 pfsense filterlog: 4294967295,,,0,ix0,short,pass,in,4,0x0,,54,23350,0,none,6,tcp,26,89.163.224.233,x.x.x.x,errormsg='tcp 6 [bad hdr length 0 - too short < 20]',

look at this we had the same offendig IP at another pfense, there was a pass in the firewall log !

https://forum.netgate.com/topic/150449/firewall-log-seltsamer-pass-eintrag

jimp

@pete35 said in Warning: getservbyport() expects parameter 1 to be integer, string given in /etc/inc/filter_log.inc on line 447:

look at this we had the same offendig IP at another pfense, there was a pass in the firewall log !

I wouldn't worry about it. The last time one of these short log entries came up I looked through the code and it was actually dropped:

https://forum.netgate.com/topic/147248/had-my-pfsense-been-compromised/72

jimp

I opened an issue and pushed a fix for the PHP error: https://redmine.pfsense.org/issues/10255