2.4.5 Update Caution
-
FYI. There is at least one freshly updated package that has an issue on 2.4.4_p3 but not on 2.4.5. That package is Snort. The
libpcaplibrary in FreeBSD 11.3 (which is what pfSense-2.4.5 is based on) has a different internal library dependency that is NOT satisfied on pfSense-2.4.4_p3. Found that out yesterday from a poster having a problem after updating Snort on pfSense-2.4.4_p3. There are no issues on pfSense-2.5 DEVEL either, just on 2.4.4_p3. Unfortunately that did not shake out during my pre-release testing. The newer Snort binary worked fine there for me on my test VM.So as has been stated in this thread, when new pfSense versions are released, update to the lastest pfSense FIRST, and only then update any installed packages (or let the upgrade update the packages for you when it installs). So as @johnpoz cautioned, pay attention and follow the pfSense updates!
-
Mmm, we are now investigating an issue with Suricata too. The version 5 package should not be installed in 2.4.4p3 but is shown as available.
Steve
-
@bmeeks Snort is one of the packages I updated yesterday to v3.2.9.10_2 on pfSense 2.4.4p3. I see no obvious issues. Did I understand correctly that this is problematic? If so, can I revert to the previous version?
-
@revengineer said in 2.4.5 Update Caution:
@bmeeks Snort is one of the packages I updated yesterday to v3.2.9.10_2 on pfSense 2.4.4p3. I see no obvious issues. Did I understand correctly that this is problematic? If so, can I revert to the previous version?
No, if you updated and it started, then it must be okay for you. The issue would prevent it from even starting. At least it did for me on a VM when I tested shortly after the first report. Maybe the supporting library got updated on the repository ???. I haven't checked that out, though.
-
@stephenw10 said in 2.4.5 Update Caution:
Mmm, we are now investigating an issue with Suricata too. The version 5 package should not be installed in 2.4.4p3 but is shown as available.
Steve
There are two different "current" versions of Suricata out there, one for each pfSense architecture type (amd64/aarch64 and armv6/armv7). This is because of the upstream decision to use Rust and make it a runtime requirement. There is currently no way to build Rust for armv6 or armv7 hardware, thus a Suricata binary that needs Rust can't run on those hardware platforms. So there is a suricata4 binary in the repositories that is based on Suricata v4.1.7, and that binary along with an accompanying custom PHP package should show up for armv6 and armv7 machines. The Suricata 5.0.2 binary must have a runtime Rust package available for the hardware platform, so that binary is now limited to just the amd64 and aarch64 hardware repositories.
Renato was going to use some under-the-hood magic to make all this work.
-
@bmeeks said in 2.4.5 Update Caution:
Renato was going to use some under-the-hood magic to make all this work.
Exactly, and that part works fine. If you had Suricata installed (4.1.7) and you update to 2.4.5 you will end up either in 5.0.2 or 4.1.7_1 depending on the architecture.
However it looks like currently if you're running 2.4.4p3 you may see the 5.0.2 package but you should not update to that before upgrading to 2.4.5.Steve
-
@stephenw10 said in 2.4.5 Update Caution:
@bmeeks said in 2.4.5 Update Caution:
Renato was going to use some under-the-hood magic to make all this work.
Exactly, and that part works fine. If you had Suricata installed (4.1.7) and you update to 2.4.5 you will end up either in 5.0.2 or 4.1.7_1 depending on the architecture.
However it looks like currently if you're running 2.4.4p3 you may see the 5.0.2 package but you should not update to that before upgrading to 2.4.5.Steve
Gotcha
I so wish Suricata upstream would lose their current fascination with Rust.
-
@stephenw10 said in 2.4.5 Update Caution:
I am not aware of any such issues with the step from 2.4.4p3 to 2.4.5. I've updated numerous systems with packages installed and did not see an issue.
Thank you Steve, these is good to know. In the pandemic, I am doing critical work from home and I cannot afford to screw up my internet right now. It looks like I will be able to continue using my current configuration until at least next weekend when any major issues should be apparent.
-
@bmeeks Thank you. My system including snort are definitely working. That's good enough for me in the near term, no need for me to understand why it's working.
-
@johnpoz said in 2.4.5 Update Caution:
None of the packages I have showed any updates before 2.4.5 dropped or after.. Its not the before that could get you it could be the later..
The following packages showed updates yesterday that did not show 2 days ago when I last checked: squid, squiguard, snort, iperf.
Scenario... Your one of those users that has your head in the sand and doesn't pay attention to what is released or not released just completely oblivious to the software your using as your router and firewall. Not like its important or anything, bet you have the latest bleeding edge version of super game X you play and latest tweaks on your over clocked graphics card so you can get 0.3 fps more, etc. . But when it comes to your security software - meh it works! Who cares if version is 3 years old ;)
few weeks from now, your tooling around pfsense, ie don't know trying to figure out how to make sure you don't have any dns leaks <rolleyes> and you not paying any attention to the big update available info right there in the main system widget.. Maybe you have it turned off, or maybe you turn off checking for updates??? And you happen to land in package manager and there you notice hey look at that xyz has an update, or gee look at that package let me try that out..
And you update something, now 3 weeks later you figure out oh shit look at that new version is out - and update..
This scenario does not apply to me... at all... not a single sentence applies to my situation.
-
-
Just to be clear though any package updates you do see may be intended for 2.4.5. Do not update any packages before updating to 2.4.5.
Steve
-
@stephenw10 Understood. Now that I am aware of the new release, I will not update package until I update the release next weekend.
-
Followed the instructions; made backup, re-booted and then updated. Smooth as silk.
Uptime before re-boot was 155 days.
Very pleasant experience. Thanks.
-
seen update notice on dashboard yesterday. uninstalled packages and updated. It took 5 or 6 minutes and took a few attempts to auto reconnect. it keep saying not ready yet so I was getting worried but then it came up with no issues. re-installed packages and all is good. thank you Devs
-
uhm my 2.4.5 ended up with suricata 5.0.2
I didn't noticed this until i read this thread because it's working
-
That is correct if it's amd64 or aarch64. Only armv6 should get 4.1.7_1 in 2.4.5.
Steve
-
ah ok, great
-
@stephenw10 said in 2.4.5 Update Caution:
Just to be clear though any package updates you do see may be intended for 2.4.5. Do not update any packages before updating to 2.4.5.
Steve
What if I do need to do a fresh Installation of 2.4.4_p3 and want to Install snort for example? Do I get a compatible version or the one which is indented for 2.4.5?
-
@Artes said in 2.4.5 Update Caution:
@stephenw10 said in 2.4.5 Update Caution:
Just to be clear though any package updates you do see may be intended for 2.4.5. Do not update any packages before updating to 2.4.5.
Steve
What if I do need to do a fresh Installation of 2.4.4_p3 and want to Install snort for example? Do I get a compatible version or the one which is indented for 2.4.5?
The one compiled for pfSense-2.4.5 won't load on pfSense-2.4.4_p3 due to FreeBSD shared library changes. And right now, short of building your own pfSense package builder and creating a custom Poudriere ports repo, you can't install the new Snort package on older pfSense versions. If you went the custom repo route, you could build and install the old Snort.
