2.6.0 --> 2.7.0 Upgrade Crash Report

TAC57

I just upgraded and get the following pop up at the top of my dashboard.
"pfSense has detected a crash report or programming bug. Click here for more information."
This is the info given:

Crash report begins.  Anonymous machine information:

amd64
14.0-CURRENT
FreeBSD 14.0-CURRENT #1 RELENG_2_7_0-n255866-686c8d3c1f0: Wed Jun 28 04:21:19 UTC 2023     root@freebsd:/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/obj/amd64/LwYAddCr/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/sources/FreeBSD-src-REL

Crash report details:

PHP Errors:
[30-Jun-2023 07:16:37 EST5EDT] PHP Fatal error:  Uncaught TypeError: Cannot access offset of type string on string in /usr/local/pkg/snort/snort_generate_conf.php:1025
Stack trace:
#0 /usr/local/pkg/snort/snort.inc(3834): include()
#1 /usr/local/pkg/snort/snort.inc(1023): snort_generate_conf(Array)
#2 /etc/inc/pkg-utils.inc(709) : eval()'d code(1): sync_snort_package_config()
#3 /etc/inc/pkg-utils.inc(709): eval()
#4 /etc/rc.start_packages(66): sync_package('snort')
#5 {main}
  thrown in /usr/local/pkg/snort/snort_generate_conf.php on line 1025
[30-Jun-2023 07:20:09 EST5EDT] PHP Fatal error:  Uncaught TypeError: Cannot access offset of type string on string in /usr/local/pkg/snort/snort_generate_conf.php:1025
Stack trace:
#0 /usr/local/pkg/snort/snort.inc(3834): include()
#1 /usr/local/pkg/snort/snort.inc(1023): snort_generate_conf(Array)
#2 /etc/inc/pkg-utils.inc(709) : eval()'d code(1): sync_snort_package_config()
#3 /etc/inc/pkg-utils.inc(709): eval()
#4 /etc/rc.start_packages(66): sync_package('snort')
#5 {main}
  thrown in /usr/local/pkg/snort/snort_generate_conf.php on line 1025



No FreeBSD crash data found.

bmeeks

What version of the Snort package is showing as installed under SYSTEM > PACKAGE MANAGER > Installed Packages?

If it is 4.1.6_8, then do you have the ARP Spoof preprocessor enabled without any IP/MAC address pairs provided?

TAC57

@bmeeks I have v4.6.1 if Snort installed.

I have no idea about your second question

bmeeks

@TAC57 said in 2.6.0 --> 2.7.0 Upgrade Crash Report:

@bmeeks I have v4.6.1 if Snort installed.

I have no idea about your second question

I think you mean 4.1.6 instead as there is no 4.6.1 Snort version. That base 4.1.6 version is way out of date for the current pfSense release. You should have version 4.1.6_8.

Go to SYSTEM > PACKAGE MANAGER > Installed Packages and click the yellow "update" icon. Or even better, click the "delete" trash icon to remove the package and then return to Available Packages and install it again from there.

TAC57

@bmeeks
When I hit the Confirm button to delete Snort the screen never changes. Which is what happens if I just try to reinstall Snort.

On the installed packages screen I wonder why it doesn't tell me there is an update available.

bmeeks

@TAC57 said in 2.6.0 --> 2.7.0 Upgrade Crash Report:

@bmeeks
When I hit the Confirm button to delete Snort the screen never changes. Which is what happens if I just try to reinstall Snort.

On the installed packages screen I wonder why it doesn't tell me there is an update available.

Are you sure that your pfSense 2.7 CE upgrade fully completed? It should show you an updated Snort package available. Most certainly that old 4.1.6 version is not going to work in the new pfSense due to massive changes in PHP 8.2.

Give me a bit and I will test in a virtual machine that I updated yesterday to be sure.

TAC57

@bmeeks It appeared to update correctly but I didn't get the normal screen that usually says don't mess with the system for a few hours while things update.

Something must be screwed up because if I reboot a number of packages don't automatically start,

Maybe I'll reinstall 2.6.0, load my old config and try again.

bmeeks

Okay, I just verified that my 2.7.0 CE virtual machine correctly shows me the updated Snort 4.1.6_8 package to install. So everything is fine on the pfSense repo side.

I'm thinking your upgrade did not complete or your pkg repo settings are not correct for the new pfSense version.

You should see this on the Dashboard screen:

pfSense-2.7.0-CE.png

And then under SYSTEM > PACKAGE MANAGER > Available Packages you should be able to find this Snort version:

snort_4.1.6_8 Update.png

If either or both of the above screens on your firewall is not showing like mine, then your upgrade is incomplete.

bmeeks

@TAC57 said in 2.6.0 --> 2.7.0 Upgrade Crash Report:

Something must be screwed up because if I reboot a number of packages don't automatically start,

Yes, this would be a red flag that your upgrade did not complete properly.