2.3.2_1 crash report

dennypage

Bug report filed: https://redmine.pfsense.org/issues/6858

jwt

Thanks for the bug report. Assigned, bumped priority.

Will get this looked at early tomorrow.

dennypage

Thanks Jim. Much appreciated.

rbgarga

Actually it's not a bug, it's expected and it's how pkg is designed to work.

When we moved to 2.3.2_1 we cherry-picked some package upgrades from FreeBSD ports tree since these upgrades fixes some vulnerabilities listed by 'pkg audit'. Following ports were updated:

php56
perl5
libxml2
libidn
curl

Due to these updates, when poudriere starts to build our ports set, it deletes all packages that depends of above listed packages and rebuild them. At this time, strongswan was rebuilt as many other ports, and a new package with same version was created.

This new package was included in 2.3.2-p1, so when you install it directly you will see the new package, and checksum differs.

During upgrade, since any shared library version has bumped, pkg understands packages like strongswan don't need to be reinstalled, because libraries it depends didn't have any ABI changes. Then you end up with the version built for 2.3.2.

If you compare the built date for strongswan package on both systems you will see this:

2.3.2


[2.3.2-RELEASE][admin@pf232.home]/root: pkg info strongswan
strongswan-5.5.0
Name           : strongswan
Version        : 5.5.0
Installed on   : Wed Jul 20 15:39:17 2016 UTC
Origin         : security/strongswan
Architecture   : freebsd:10:x86:64
Prefix         : /usr/local
Categories     : security
Licenses       : GPLv2
Maintainer     : strongswan@nanoteq.com
WWW            : http://www.strongswan.org
Comment        : Open Source IKEv2 IPsec-based VPN solution

2.3.2-p1


[2.3.2-RELEASE][admin@pfs232-1.home]/root: pkg info strongswan
strongswan-5.5.0
Name           : strongswan
Version        : 5.5.0
Installed on   : Mon Oct 17 23:14:33 2016 UTC
Origin         : security/strongswan
Architecture   : freebsd:10:x86:64
Prefix         : /usr/local
Categories     : security
Licenses       : GPLv2
Maintainer     : strongswan@nanoteq.com
WWW            : http://www.strongswan.org
Comment        : Open Source IKEv2 IPsec-based VPN solution

dennypage

Renato, thank you for the write up.

Does this cover file /usr/local/lib/php/20131226/suhosin.so? This shared object is the one that triggered the original crash report. It is different in 2.3.2_1 install vs upgrade. Was package php-suhosin-0.9.38 also part of the cherry picking?

Is there another explanation for the crash report?

rbgarga

@dennypage:

Renato, thank you for the write up.

Does this cover file /usr/local/lib/php/20131226/suhosin.so? This shared object is the one that triggered the original crash report. It is different in 2.3.2_1 install vs upgrade. Was package php-suhosin-0.9.38 also part of the cherry picking?

Is there another explanation for the crash report?

php-suhosin was rebuilt because lang/php56 was updated. But the original issue is a problem we faced sometimes on pfSense 2.3. In some hard-to-reproduce circumstances extensions.ini ended up out of order and suhosin was loaded before session, that is a dependency.

The real fix for this was done in FreeBSD ports and is already on 2.4 and 2.3.3 snapshots. It was reworked the way PHP extensions create their config files to make sure they are loaded in correct order.

dennypage

Thank you Renato, I really appreciate you checking this out and providing such a thorough explanation.

I am looking forward to the new version of FreeBSD ports.

jimp

Back today and getting caught up. Looks like this was what I suspected to start with, but with the added twist that the same version of the package could have different files. A red herring, but an interesting red herring.

I, more than most, am happy to see FreeBSD finally have a way to deal with the extension ordering in PHP. I've been ranting about it being broken (and advocating to get a fix in) for over 10 years now (as of yesterday).

dennypage

@jimp:

I, more than most, am happy to see FreeBSD finally have a way to deal with the extension ordering in PHP. I've been ranting about it being broken (and advocating to get a fix in) for over 10 years now (as of yesterday).

Happy Anniversary

:)