PHP error log - Had to reboot

[Wylbur]

Have had this system up for 2 plus months. Had to change a WAN port in an attempt to solve a reltek problem. .... Waiting to find Intel dual port card....

So this is new, and I followed it by info from the system log. I rebooted "normal" and that fixed connectivity issues and I'm back up.

Just wanting to know what the PHP errors were caused by because I don't know enough to tinker with anything on this system other than DHCP things to assign ip addresses and the like.

Crash report begins. Anonymous machine information:

amd64
14.0-CURRENT
FreeBSD 14.0-CURRENT #1 RELENG_2_7_0-n255866-686c8d3c1f0: Wed Jun 28 04:21:19 UTC 2023 root@freebsd:/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/obj/amd64/LwYAddCr/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/sources/FreeBSD-src-REL

Crash report details:

PHP Errors:
[08-Nov-2023 08:14:01 US/Eastern] PHP Parse error: syntax error, unexpected token "as", expecting ")" in /etc/inc/util.inc on line 1316
[08-Nov-2023 08:15:00 US/Eastern] PHP Parse error: syntax error, unexpected token "as", expecting ")" in /etc/inc/util.inc on line 1316

No FreeBSD crash data found.

---

system log info....

Nov 8 08:53:34 php-fpm 20028 /status_dhcp_leases.php: Session timed out for user 'admin' from: 192.168.1.21 (Local Database)
Nov 8 10:17:00 sshguard 83537 Exiting on signal.
Nov 8 10:17:00 sshguard 62157 Now monitoring attacks.
Nov 8 14:38:52 rc.gateway_alarm 59480 >>> Gateway alarm: WAN_DHCP (Addr:8.8.8.8 Alarm:1 RTT:15.808ms RTTsd:.928ms Loss:22%)
Nov 8 14:38:52 check_reload_status 443 updating dyndns WAN_DHCP
Nov 8 14:38:52 check_reload_status 443 Restarting IPsec tunnels
Nov 8 14:38:52 check_reload_status 443 Restarting OpenVPN tunnels/interfaces
Nov 8 14:38:52 check_reload_status 443 Reloading filter
Nov 8 14:38:53 php-fpm 20028 /rc.openvpn: Gateway, none 'available' for inet, use the first one configured. 'WAN_DHCP'
Nov 8 14:38:53 php-fpm 20028 /rc.openvpn: Gateway, NONE AVAILABLE
Nov 8 14:56:19 php-fpm 20028 /status_dhcp_leases.php: Successful login for user 'admin' from: 192.168.1.21 (Local Database)

[stephenw10]

Hmm, what exactly did you do to trigger that?

[Wylbur]

@stephenw10

Sorry, but I have no idea at all. I was trying to respond to an email that got some goofy error about a server, which is indicative of having lost connectivity, when a streaming device running TuneIn stopped playing. So I started looking to see what was wrong with pfSense...

[stephenw10]

Hmm, well the error is in the function 'group_ports'. But the error seems to imply part of the file is missing.

Do you have patches applied to 2.7?

Otherwise perhaps you have rules with port ranges or ports aliases with ranges of ports? That's what that function does but it wouldn't do it spontaneously. I would only ever expect to see that when the rules are updated or reloaded.

Steve

[Wylbur]

@stephenw10

This is what the dashboard shows:

2.7.0-RELEASE (amd64)

built on Wed Jun 28 03:53:34 UTC 2023
FreeBSD 14.0-CURRENT

The system is on the latest version.
Version information updated at Thu Nov 9 8:59:13 EST 2023

I was looking at the patches list (finally found it by taking time to actually read everything in each dropdown) and I've read the patch list and I don't see anything that looks like it addresses this. But I do see patches for logs and ARP that I think I should put on.

[stephenw10]

I would certainly apply the list of recommended patches from the system patches package.

But to be clear you don't have any custom patches?

[Wylbur]

@stephenw10

I have put on No patches at all.

But I will take your advice and put on these patches as soon as I can. Probably sometime this weekend.

[Wylbur]

@Wylbur

Forgot to update. Patches on. Also enabled SNORT.

[stephenw10]

Are you still seeing that error regenerated?

[Wylbur]

@stephenw10
Intermittently. Finally found a dual port Intel based adapter -- will get it next week.

It seems related to a web site that is using PHP and has a problem. May just be a coincidence.

[stephenw10]

I think you need to check what's actually on line 1316 in /etc/inc/util.inc. You might have some file corruption.
It's hard to see how that error would happen in the expected file contents.

Steve

[Wylbur]

@stephenw10
Sorry for the delay.

I have not seen that PHP error lately. But if I go back to that PHP based web site, it might trigger it again (I have no idea why).

I can't see a way to get the info via gui. So I'm going to need to get some time to get a monitor and keyboard to the comm closet so I can do the CLI stuff (which I'm just OK with). I'm not a real Linux admin. And then, I have to find a way to capture the output to post it here.

Meanwhile/BTW -- I was able to get a 2 port 1GB Intel adapter and get it installed and configured. So far so good.

And I have SNORT running (got a non-commercial key for testing).

[stephenw10]

Which site is that? Visiting some website shouldn't make any difference to anything happening in pfSense.

You can just open the file ( /etc/inc/util.inc) in Diag > File Edit and then go to the line directly.

[Wylbur]

@stephenw10

Thanks, I had missed that handy little tool in Diagnostics:

Here is what it contains, and I may have gone a bit further than needed, but I wanted to get to what I thought would be end of stanza/paragraph (how ever it is called -- BTW - what language is this?)

foreach ($ports as $port) {
	if (($kflc) && (strpos($port, '#') === 0)) {	// Keep Full Line Comments (lines beginning with #).
		$comments[] = $port;
	} else if (is_portrange($port)) {
		list($begin, $end) = explode(":", $port);
		if ($begin > $end) {
			$aux = $begin;
			$begin = $end;
			$end = $aux;
		}
		for ($i = $begin; $i <= $end; $i++) {
			if (!in_array($i, $uniq)) {
				$uniq[] = $i;
			}
		}
	} else if (is_port($port)) {
		if (!in_array($port, $uniq)) {
			$uniq[] = $port;
		}
	}
}
sort($uniq, SORT_NUMERIC);

$result = array();
foreach ($uniq as $idx => $port) {
	if ($idx == 0) {
		$result[] = $port;
		continue;
	}

	$last = end($result);
	if (is_portrange($last)) {
		list($begin, $end) = explode(":", $last);
	} else {
		$begin = $end = $last;
	}

	if ($port == ($end+1)) {
		$end++;
		$result[count($result)-1] = "{$begin}:{$end}";
	} else {
		$result[] = $port;
	}
}

return array_merge($comments, $result);

}

[stephenw10]

It's PHP.

Hmm, that line looks to be as expected:
https://github.com/pfsense/pfsense/blob/RELENG_2_7_0/src/etc/inc/util.inc#L1316

In which case that error really doesn't make sense.

Are you still seeing it regenerated? And only when you visit some specific page?

[Wylbur]

@stephenw10

I haven't seen it since I put on the maint patches, come to think of it. Hmmmmm.

I'll post back if I see it again. I do tend to review the logs every few days.