Warning: getservbyport() expects parameter 1 to be integer, string given in /etc/inc/filter_log.inc on line 447

pete35 · Feb 12, 2020, 7:39 AM

pfsense 2.4.5RC from Sunday, while filtering firewall log entries on pass entries gives a warning:

jimp · Feb 12, 2020, 2:11 PM

I can't reproduce that here. It looks like it might be triggered by a specific message in your filter log.

If you can still reproduce this, look at the raw filter log (clog /var/log/filter.log on 2.4.x) and see if anything obviously stands out as being different/not belonging.

Or you can attach a copy of the filter.log file

pete35 · Feb 12, 2020, 3:17 PM

@jimp said in Warning: getservbyport() expects parameter 1 to be integer, string given in /etc/inc/filter_log.inc on line 447:

clog /var/log/filter.log

I can reproduce it every time. No special entries in the filter log. I got a crash rport on the main page, same warnings.

jimp · Feb 12, 2020, 3:23 PM

The error line it mentions is when the log entries to show on the page are being displayed, not when applying the filter. So it must be from a log entry. Can you attach the log file here, or send it to me privately ( <my forum username> (a) netgate (dot) com )

jimp · Feb 12, 2020, 3:42 PM

OK, it is a bad entry in your log. Specifically, this one:

Feb 11 17:24:57 pfsense filterlog: 4294967295,,,0,ix0,short,pass,in,4,0x0,,54,23350,0,none,6,tcp,26,x.x.x.x,y.y.y.y,errormsg='tcp 6 [bad hdr length 0 - too short < 20]',

Normally that would be getting tossed out since it wouldn't parse, but it's not being rejected as expected. Now that I can reproduce it, I can look into a fix.

Thanks!

pete35 · Feb 12, 2020, 3:49 PM

@jimp said in Warning: getservbyport() expects parameter 1 to be integer, string given in /etc/inc/filter_log.inc on line 447:

4294967295

Feb 11 17:24:57 pfsense filterlog: 4294967295,,,0,ix0,short,pass,in,4,0x0,,54,23350,0,none,6,tcp,26,89.163.224.233,x.x.x.x,errormsg='tcp 6 [bad hdr length 0 - too short < 20]',

look at this we had the same offendig IP at another pfense, there was a pass in the firewall log !

https://forum.netgate.com/topic/150449/firewall-log-seltsamer-pass-eintrag

jimp · Feb 12, 2020, 4:06 PM

@pete35 said in Warning: getservbyport() expects parameter 1 to be integer, string given in /etc/inc/filter_log.inc on line 447:

look at this we had the same offendig IP at another pfense, there was a pass in the firewall log !

I wouldn't worry about it. The last time one of these short log entries came up I looked through the code and it was actually dropped:

https://forum.netgate.com/topic/147248/had-my-pfsense-been-compromised/72

jimp · Feb 12, 2020, 4:07 PM

I opened an issue and pushed a fix for the PHP error: https://redmine.pfsense.org/issues/10255