Upgrade from 2.4.5 to 21.01 fatal error in upgrade_config

palesius

Upon (attempting to) upgrade from 2.4.5 to 21.01 last night the firewall didn't come bacj up properly. When I connected to the console I got the following output (Sorry for the weird characters at the end, I think that's an artifact of capturing the session with PUTTY.):

Welcome to Netgate pfSense Plus 21.02-RELEASE (Patch 1)...

No core dumps found.
...ELF ldconfig path: /lib /usr/lib /usr/lib/compat /usr/local/lib /usr/local/lib/compat/pkg /usr/lib/engines /usr/local/lib/compat/pkg /usr/local/lib/ipsec /usr/local/lib/perl5/5.32/mach/CORE
32-bit compatibility ldconfig path: /usr/lib32
done.
>>> Removing vital flag from php74... done.
External config loader 1.0 is now starting... da0s1 da0s1a da0s1b
Launching the init system...Updating CPU Microcode...
CPU: Intel(R) Atom(TM) CPU  C2558  @ 2.40GHz (2400.06-MHz K8-class CPU)
  Origin="GenuineIntel"  Id=0x406d8  Family=0x6  Model=0x4d  Stepping=8
  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
  Features2=0x43d8e3bf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,SSE4.1,SSE4.2,MOVBE,POPCNT,TSCDLT,AESNI,RDRAND>
  AMD Features=0x28100800<SYSCALL,NX,RDTSCP,LM>
  AMD Features2=0x101<LAHF,Prefetch>
  Structured Extended Features=0x2282<TSCADJ,SMEP,ERMS,NFPUSG>
  Structured Extended Features3=0xc000400<MD_CLEAR,IBPB,STIBP>
  VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID
  TSC: P-state invariant, performance statistics
Done.
.... done.
Initializing.................... done.
Starting device manager (devd)...done.
Loading configuration......done.
Updating configuration........................
Fatal error: Uncaught Error: Cannot unset string offsets in /etc/inc/upgrade_config.inc:6437
Stack trace:
#0 /etc/inc/config.lib.inc(482): upgrade_212_to_213()
#1 /etc/rc.bootup(132): convert_config()
#2 {main}
  thrown in /etc/inc/upgrade_config.inc on line 6437
PHP ERROR: Type: 1, File: /etc/inc/upgrade_config.inc, Line: 6437, Message: Uncaught Error: Cannot unset string offsets in /etc/inc/upgrade_config.inc:6437
Stack trace:
#0 /etc/inc/config.lib.inc(482): upgrade_212_to_213()
#1 /etc/rc.bootup(132): convert_config()
#2 {main}
  thrownStarting CRON... done.
2021-04-10T09:53:28.511326-04:00  php-fpm 386 - - /rc.start_packages: Restarting/Starting all packages.

 Starting package OpenVPN Client Export Utility...done.
Netgate pfSense Plus 21.02-RELEASE (Patch 1) amd64 Mon Feb 22 09:39:51 EST 2021
Bootup complete


FreeBSD/amd64 (Amnesiac) (ttyu1)



7[r[999;999H[6n8 #

It doesn't bring up the normal menu and the web configurator certainly isn't accessible. I just get a "#" prompt.

Also, aside from resolving this issue, if I need to open a support ticket/subscription is there a way to pull the NDI from here since I (foolishly) did not write it down.

palesius

@palesius
Solved my own problem. This fix is obviously unsupported (even by me), don't know if it will cause future issues or problems when it tries to upgrade next time. If you are worried about that you could always backup the original file before making any changes and restore it when you are done.

find the line:

unset($ph1ent['reauth_enable'], $ph1ent['rekey_enable'], $ph1ent['margintime'], $ph1ent['over_time']);

in /etc/inc/upgrade_config.inc

and replace with

		if (isset($ph1ent['reauth_enable'])) {
			unset($ph1ent['reauth_enable']);
		}
		if (isset($ph1ent['rekey_enable'])) {
			unset($ph1ent['rekey_enable']);
		}
		if (isset($ph1ent['margintime'])) {
			unset($ph1ent['margintime']);
		}
		if (isset($ph1ent['over_time'])) {
			unset($ph1ent['over_time']);
		}

PHP isn't my 1st language, or even my 2nd/3rd, so there is undoubtedly a more concise way of doing this, but it got it past the upgrade and working again.

Basically it is now only doing the unset if it is actually necessary for each of those variables.

jimp

I opened https://redmine.pfsense.org/issues/11801 and copied the details over there. We'll get that fixed up soon. Thanks!

palesius

@jimp In case it's helpful or necessary, here is the ipsec portion of my config file. (Don't have any actual ipsec tunnels configured.)

	<ipsec>
		<phase1>i</phase1>
		<logging>
			<dmn>1</dmn>
			<mgr>1</mgr>
			<ike>1</ike>
			<chd>1</chd>
			<job>1</job>
			<cfg>1</cfg>
			<knl>1</knl>
			<net>1</net>
			<asn>1</asn>
			<enc>1</enc>
			<imc>1</imc>
			<imv>1</imv>
			<pts>1</pts>
			<tls>1</tls>
			<esp>1</esp>
			<lib>1</lib>
		</logging>
	</ipsec>