Now Available: pfSense® CE 2.8.0-RELEASE

jiri.zemanek

@stephenw10 pfSense-repoc -NDJ:

{
    "repos": {
        "repo": [

        ]
    },
    "links": {
        "next": null,
        "previous": null
    },
    "count": 0,
    "messages": [

    ],
    "messages_text": [

    ],
    "pubkey": {
        "type": "RSA",
        "key": "MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0ww4DLZ1KPhOubCefojk\n+KrkFZ3mvi96AoADnM9ogJ/nykAmAZnAtQeErJyVCQztnKt0OKspHas6grTC4w7O\nt7fw0Lizj2JmY1enA+exmzk2fktY0Bdq1vp+2Y+bZLxdKCs87ocdZtpskC2AbyAf\n48P0pvnr9ueVPO3RotCBUBULAZPr111cHWiDfZbkAQaQ25H9Eh3kcBO7tuwUX0xq\nooDnWzMTPyRX36pczcXu3vqQJwCTvzpozT7D0Qucyf0hwqm3ab4XZmqaIXgjjcj6\nra2tuAIfupXQLZRZnH/hFhqQmBI7UfOVnFLGkZRO1LCQDjSoN3l9Qpiz1o8ARs1r\n94MeSn982worQjdMxvTrGeZSy2mOAexz8c3TH9G5GYN9YSzz4PYYjp0yjgmPfl/6\nSYv7Rp8lEuIklFIjkr3h3gyPi/daIXTZnN8+O3NGc58mfqgQ+kAajQStgnj9kOLZ\noJa3KEie5ravaO961BC9NC6dYJJ5ADl9lznIGfinLxy0TJlstnmavAWbP51lC2F8\newRq0yyJTb+kq7++ZaRHi4xqe7yrkYF/I5gyMR42Heoeq1TQKKiYVkF3X7oWNshq\ntbjaZSOR5ATzTDFehVTDcljBrzeYqIFj0mfgoZ0fIo3QF5iQQcfIOUq/JuFpd0+s\nxWA3MJ4Oq28LRvkMnnVkU40CAwEAAQ=="
    },
    "signature": {
        "type": "RSA",
        "signature": "qel7lnz2U/hrKcuUZUt0sNFNCpzlIo7zXeHWi2wKp4f+xa/yz6J8hjkt56CxuKOym07OSVuYlB5xXaFHLo7koBXpN9cly7Gq2eA4W7xtE5gnaFUluf+pAYam/PlxFcRnVv8WnhGN8NftmO4MLv7BULe+JvFp3I64gzBaogW3fhtNjrleMMQV6jvckJEfh9bcRwnQtdyMcSeruJJWB6XW7mfO60ExbIooY8+x18slqQM5KJlWwm9aKlC4F7xtXRkyNUXn9l1GdRNnlLbXGEomi2rIgQ89iipT8bcG3ZmqkW+F5s4NkdcM6sGiN9yr0ZEAWsEW7Ul2lc1t1y8g+i3px/HawsITsmTkvJP7g0Yi8QxLx9SJb5GeiZVi2S4nIh+FcQahMgSzkGeQdm+oD0L+mhT7z80VhkcWIxGYNPqJO6U300rmSIiEiC3bRAMHE6FaZ3eQZhtBFCqYQeTLDfxfwGJmP6kRSVbHwmoo0qjaXchXvsLbo84xTmIXerQZMBbXEOzFzO8sTAlk5KLlKKvMApvWAtIHsQaCLmgXAAiiQD60rmR4fRfag8neHHDtvoJQ8nrsKctx7em36MBWJuvvQnHO9w7BWwhXOTdjzTQJQW1UAv8g5cXynIEsayo7wS0igEXLFZn92UwJ5k00QPE4oaDjfzXvs9BXr8ia8rgOjVM=",
        "key_signed": "repos.repo"
    }
}

I am not running it in Azure, but even if I did I do not see how this should be relevant. I can connect to the instance over SSH/HTTPS so why it would not see a repository?

Anyway, I am not allowed to burn my time on this anymore, sorry.
As I can't even make clean install to work properly, I do not have confidence the software is up to the task I meant it for (I have working PoC on linux, unfortunately without any GUI :-/ )

stephenw10

Hmm, so it's actually sending you an empty repos list.

If you can send me the NDI from that in chat I can try to check what the server end is doing.

What does the output from repoc show for the 'Model'? Is it incorrectly showing Azure? If so that's something I'd very much like to fix.

Sissy

The upgrade went smoothly, but the thermal dashboard widget has an issue on my system with an Intel N100 CPU:

As the image shows, the Core temperature bar graphs are using the Zone Warning and Zone Critical to set their color coding. I mucked around with various values for Warning and Critical in both Zone and Core and only the "Core Warning and Core Critical values influence the bar graph colors.

The full sensor names are:

dev.cpu.0.temperature
dev.cpu.1.temperature
dev.cpu.2.temperature
dev.cpu.3.temperature
hw.acpi.thermal.tz0.temperature

Is this a bug or have I done something wrong?

Sissy

#ff2600CORRECTION:

As the image shows, the Core temperature bar graphs are using the Zone Warning and Zone Critical to set their color coding. I mucked around with various values for Warning and Critical in both Zone and Core and only the "~~Core~~ Zone Warning and ~~Core~~ Zone Critical values influence the bar graph colors.

stephenw10

Hmm, OK I see here. Digging....

stephenw10

Just to be clear you didn't see this in 2.7.2 with the same hardware?

stephenw10

Yeah, I see how this is failing. And would always have failed.

https://redmine.pfsense.org/issues/16266

Sissy

@stephenw10 said in Now Available: pfSense CE 2.8.0-RELEASE:

Yeah, I see how this is failing. And would always have failed.

https://redmine.pfsense.org/issues/16266

Sorry for my delay in replying. Working through the 2.8.0 update process today pushed the cores well above where I had the Zone Warning set. That's probably why this problem only today caught my eye.

Thank you for so quickly jumping on this and determining the root cause. I see that you've targeted the fix for 2.9.0, which I fear could be a long way off. Is there any chance of creating a patch for 2.8.0 sometime in the next few months? I mean that as a humble ask, not an entitled demand.

stephenw10

Yup you can test the patch if you're able to:

1231.diff

Sissy

@stephenw10 Works great! I just did a cut & paste from the file to the System_Patches utility, pasted the description "Thermal Sensors Widget Thresholds not Evaluated," and applied the patch. The problem was immediately fixed, with the following screenshot showing the results (with test values for thresholds to illustrate the change):

If you're planning to push it out as a formal patch, I think that you're good to go.

Thanks again!

bimmerdriver

I upgraded a couple of weeks ago. I mistakenly forgot to remove snort before upgrading, but it didn't seem to cause any obvious problems.

I have noticed that the GUI is often slow and frequently reports "This site can't be reached..." Refreshing a few times usually brings it back.

This morning, I started having major problems with DHCP and Unbound. This started when I attempted to reassign a couple of DHCP reservations to make room in the sequence for a new server.

I deleted the existing reservation, then used ipconfig /release and ipconfig /renew to force the host to get a new dynamic address, which worked fine. Then I created a new reservation and again used ipconfig /release and ipconfig /renew to force the host to use the new address.

After this, pfSense shows the new reservation is active, but the host is still using the DHCP address. I tried restarting the DHCP service on the host and it made no difference.

To see if this problem was specific to the host, I tried the same procedure on another host. It worked, so I tried one more to see what would happen. It failed.

By this time, the GUI was very slow and was frequently unresponsive, unbound was stopped and would not restart, then crash reports started.

Here are some messages from the DHCP log:

Jul 5 16:41:56	kea2unbound	32656	Unbound reloaded: /var/unbound/unbound.conf
Jul 5 16:41:56	kea2unbound	32656	Include updated: /var/unbound/leases/leases4.conf (5404252cd3db2c6d)
Jul 5 16:41:56	kea2unbound	32656	Unbound lease include is missing or inconsistent: /var/unbound/leases/leases4.conf
Jul 5 16:41:55	kea-dhcp6	30761	WARN [kea-dhcp6.dhcp6.0x199b00612000] DHCP6_MULTI_THREADING_INFO enabled: yes, number of threads: 2, queue size: 64
Jul 5 16:41:55	kea-dhcp4	30320	WARN [kea-dhcp4.dhcp4.0x169f0cc12000] DHCP4_MULTI_THREADING_INFO enabled: yes, number of threads: 2, queue size: 64
Jul 5 16:41:55	kea-dhcp6	30761	WARN [kea-dhcp6.dhcp6.0x199b00612000] DHCP6_RESERVATIONS_LOOKUP_FIRST_ENABLED Multi-threading is enabled and host reservations lookup is always performed first.
Jul 5 16:41:55	kea-dhcp6	30761	WARN [kea-dhcp6.dhcpsrv.0x199b00612000] DHCPSRV_MT_DISABLED_QUEUE_CONTROL disabling dhcp queue control when multi-threading is enabled.
Jul 5 16:41:55	kea-dhcp4	30320	WARN [kea-dhcp4.dhcp4.0x169f0cc12000] DHCP4_RESERVATIONS_LOOKUP_FIRST_ENABLED Multi-threading is enabled and host reservations lookup is always performed first.
Jul 5 16:41:55	kea-dhcp4	30320	WARN [kea-dhcp4.dhcpsrv.0x169f0cc12000] DHCPSRV_MT_DISABLED_QUEUE_CONTROL disabling dhcp queue control when multi-threading is enabled.

I will update this with some crash reports.

bimmerdriver

@bimmerdriver Here are some bug reports:

[05-Jul-2025 14:41:35 America/Vancouver] PHP Fatal error:  Uncaught TypeError: array_get_path(): Argument #1 ($arr) must be of type array, string given, called in /usr/local/pfSense/include/www/services_dhcp.inc on line 174 and defined in /etc/inc/util.inc:3961
Stack trace:
#0 /usr/local/pfSense/include/www/services_dhcp.inc(174): array_get_path()
#1 /etc/inc/system.inc(629): kea6_earlydnsreg_mappings()
#2 /etc/inc/system.inc(660): system_hosts_entries()
#3 /etc/inc/services.inc(4983): system_hosts_generate()
#4 /etc/rc.linkup(164): services_unbound_configure()
#5 /etc/rc.linkup(236): handle_argument_group()
#6 {main}
  thrown in /etc/inc/util.inc on line 3961
[05-Jul-2025 14:41:39 America/Vancouver] PHP Fatal error:  Uncaught TypeError: array_get_path(): Argument #1 ($arr) must be of type array, string given, called in /usr/local/pfSense/include/www/services_dhcp.inc on line 174 and defined in /etc/inc/util.inc:3961
Stack trace:
#0 /usr/local/pfSense/include/www/services_dhcp.inc(174): array_get_path()
#1 /etc/inc/system.inc(629): kea6_earlydnsreg_mappings()
#2 /etc/inc/system.inc(660): system_hosts_entries()
#3 /etc/inc/interfaces.inc(4459): system_hosts_generate()
#4 /etc/rc.linkup(177): interface_configure()
#5 /etc/rc.linkup(236): handle_argument_group()
#6 {main}
  thrown in /etc/inc/util.inc on line 3961
[05-Jul-2025 14:42:07 America/Vancouver] PHP Fatal error:  Uncaught TypeError: array_get_path(): Argument #1 ($arr) must be of type array, string given, called in /usr/local/pfSense/include/www/services_dhcp.inc on line 174 and defined in /etc/inc/util.inc:3961
Stack trace:
#0 /usr/local/pfSense/include/www/services_dhcp.inc(174): array_get_path()
#1 /etc/inc/system.inc(629): kea6_earlydnsreg_mappings()
#2 /etc/inc/system.inc(660): system_hosts_entries()
#3 /etc/inc/services.inc(4983): system_hosts_generate()
#4 /etc/rc.linkup(164): services_unbound_configure()
#5 /etc/rc.linkup(236): handle_argument_group()
#6 {main}
  thrown in /etc/inc/util.inc on line 3961
[05-Jul-2025 14:42:12 America/Vancouver] PHP Fatal error:  Uncaught TypeError: array_get_path(): Argument #1 ($arr) must be of type array, string given, called in /usr/local/pfSense/include/www/services_dhcp.inc on line 174 and defined in /etc/inc/util.inc:3961
Stack trace:
#0 /usr/local/pfSense/include/www/services_dhcp.inc(174): array_get_path()
#1 /etc/inc/system.inc(629): kea6_earlydnsreg_mappings()
#2 /etc/inc/system.inc(660): system_hosts_entries()
#3 /etc/inc/interfaces.inc(4459): system_hosts_generate()
#4 /etc/rc.linkup(177): interface_configure()
#5 /etc/rc.linkup(236): handle_argument_group()
#6 {main}
  thrown in /etc/inc/util.inc on line 3961

Let me know if any other information would be helpful.

Since the system is running so poorly, I'm considering reinstalling it from scratch. I don't know what else to do.

stephenw10

I would run pkg-static upgrade and make sure there are no upgraded packages offered. If it aborted the upgrade part way through for any reason that can result in errors like that.

bimmerdriver

@stephenw10 said in Now Available: pfSense CE 2.8.0-RELEASE:

pkg-static upgrade

Thank you for the reply. I tried that and it reported that the system is already up to date.

The thread, Unbound Keeps restarting, is reporting the same symptoms, so I will give the posted solution a try.

Gertjan

@bimmerdriver said in Now Available: pfSense CE 2.8.0-RELEASE:

Here are some messages from the DHCP log:

Jul 5 16:41:56 kea2unbound 32656 Unbound reloaded: /var/unbound/unbound.conf
....

These are the usual dhcpv6 and v4 startup messages. They are flagged as "WARN" but are just "information".

@bimmerdriver said in Now Available: pfSense CE 2.8.0-RELEASE:

[05-Jul-2025 14:41:35 America/Vancouver] PHP Fatal error: Uncaught TypeError: array_get_path(): Argument #1 ($arr) must be of type array, string given, called in /usr/local/pfSense/include/www/services_dhcp.inc on line 174 and defined in /etc/inc/util.inc:3961

The function array_get_path() is a configuration file access helper function.
As @stephenw10 implicitly said :: if this function fails, wrong file version are used.
Or it's this :

@bimmerdriver said in Now Available: pfSense CE 2.8.0-RELEASE:

Argument #1 ($arr) must be of type array, string given

"<dhcpv6>" is searched in the config file.
Oen yours in a aditor (NOtepad++) and look for "<dhcpv6>" and see for yourself.
Normally, it's a array type called <dhcpv6> and it should contain, for each LAN type interface , a section, like <lan>, <opt1>, >opt2> etc.
Like, this :

It looks like your <dhcpc6> is totally empty ?!?, thus not an array (filled with per LAN interface dhcpv6 setting), so it became a simple text string => that's the error.

<dhcpc6> empty : go to your dhcpv6 settings page(s) and save them all.
This should populate <dhcpc6>, thus it becomes an array, and the error will be gone.

Why all you array items (<lan>, <opt1>, >opt2> etc) in <dhcpc6> were gone : I can't tell.

bimmerdriver

@bimmerdriver said in Now Available: pfSense CE 2.8.0-RELEASE:

@stephenw10 said in Now Available: pfSense CE 2.8.0-RELEASE:

pkg-static upgrade

Thank you for the reply. I tried that and it reported that the system is already up to date.

The thread, Unbound Keeps restarting, is reporting the same symptoms, so I will give the posted solution a try.

As I reported in the referenced thread, I was able to get the system working properly again by disabling and reenabling DHCPv4 and DHCPv6 and the respective DNS settings. The first time I did it, DHCPv4 started working properly. After I did it a second time, DHCPv6 also started working properly. I have no idea why this happened in the first place, but it's at least fixed (for now).

stephenw10

And it's definitely still resolving new leases?

bimmerdriver

@stephenw10 said in Now Available: pfSense CE 2.8.0-RELEASE:

And it's definitely still resolving new leases?

Yes, it appears to be working normally since.

mark_lab_user

I completely forgot that I was running 2.7.2 with manually installed realtek drivers for my $10 2.5Gbit cards. Needless to say the upgrade failed due to unknown reasons because I did not have screen plugged in at the time. So I bricked the system. But I don't have any screen captures. Also, I rebooted and specified "kernel.old" so that I could at least boot but then I could not get PPPoE to work. I just might walk away from the mess. Too many hours and real Netgate hardware is too costly. So for now, my only option was to call my ISP and ask them to take their garbage router out of bridge mode so I could get my lab back working sort of.

It was all my fault.

But one last word... Why did you not add the Realtek 2.5 Gb drivers? They have been stable forever.

stephenw10

We build the module as a package so if you had it installed in 2.7.2 and upgrade it will upgrade the package and you should have it still in 2.8.

But it appears that the driver now has two builds because the newest version is not stable with some hardware. You might have hit that since the package we build is the new version.