Patching/Upgrading OpenSSL

dgcom · Apr 10, 2014, 4:15 PM

I will first wait for 2.1.2, then troubleshoot packages. Both mentioned are not essential for now.
Snort and HAProxy-devel are good after update.

Thanks again.

pvoigt · Apr 10, 2014, 4:39 PM

@fatsailor:

Yes - Finding things at FBSD forums isn't easy.

Here you go - http://forums.freebsd.org/viewtopic.php?f=5&t=45870&start=25

There's been been no further discussion on the topic

Thank you vey much. Yeah, finding things in the forums isn't easy. But the really unbelievable thing is that I have even been already subsribed to just this thread but did not see the curl/header sub-topic :).

Even at the risk of driving off-topic: To me as a non-expert the described header mismatch seems not that problemmatic because:

curl just complains about the header mismatch, but I did not read any hint that it refuses to build or becomes unstable.
it is detected in the environment of the question, whether a port is build against the base or the port version of openssl.

Or do you expect a subsequent patch with updated headers? Nevertheless, I am going to follow that thread.

Regards,
Peter

doktornotor · Apr 10, 2014, 4:49 PM

@jimp:

Packages should be OK now, make sure to uninstall and then reinstall (not update) to ensure that it obtains the latest binaries.

I already commented on this on the issue tracker: Simply stop messing with packages without version bumps. This really is insane practice with absolutely no benefit whatsoever. Highly annoying at best, and worse yet very dangerous in cases like this. You just cannot have different packages with the same version installing different files depending on whether it's a first install, reinstall or upgrade, and you cannot have different packages with the same version installing different files depending on whether I install now or 10 minutes later. Ditto if the fixes affect configuration of the packages.

Stupid practice, drop it.

jimp · Apr 10, 2014, 4:51 PM

I replied on the ticket but it's better here:

We're looking into a way to do that but the version numbers are controlled by the FreeBSD port versions and not directly by us. Unless the FreeBSD port gets bumped, then we'd have to maintain our own copies of the port with our own custom version numbers and so on (a nightmare to keep synchronized). That is, unless there's another mechanism in the PBI build process that lets us set an additional number to signify a change.

The version number of the pfSense packages did change.

The problem is that the version of (for example) haproxy didn't change.

doktornotor · Apr 10, 2014, 5:02 PM

I must be missing something about PBI. The entire idea of "lets bundle separate libraries for each package so that they are self-contained" simply goes beyond me. This is not what you should do for exactly the reasons like this - instead of a simple single system library update you now go and need to recompile tons of packages. Where's the benefit in pretending that runtime dependencies don't exist? Exactly the same reason why bundling (either untouched or modified versions) of libraries in the source code - instead of compiling against the system ones - sucks from security POV. Coming from the Linux world - this is just on par with Windows. I seriously don't get it.

jimp · Apr 10, 2014, 5:02 PM

Not a topic for this thread, but see the mess that was 2.0.x and before packages for reasons why PBIs are better. The problem is primarily packages stomping all over each other with different versions of things like perl, openldap, etc. Uninstalling one package could render another one (or the base system) broken. There haven't been any such problems with PBIs, the only drawback is the extra space and sometimes duplicated files. If you want to open a new debate on that, start a fresh thread.

doktornotor · Apr 10, 2014, 5:16 PM

Well, frankly said, stuff that cannot be compiled against and run with what's shipped with the base system, well… either needs to be fixed or - failing that - simply should not be packaged and distributed. That's pretty much it. (Simplified, but that basically is the deal. People do not want to end up with 3 versions of openldap, 5 versions of perl and 7 versions of openssl just because some package has bugs and noone wants to fix it. Cannot see how's this beneficial to maintainers either - look at what happened now...

(And yeah, debating PBI would be worth its own topic.)

jimp · Apr 10, 2014, 5:16 PM

It's not that simple or easy, but may get better in the future after 2.2. Back seat driving is easy, actual solutions not so much. Still off topic for this thread.

Bravissimo594 · Apr 10, 2014, 5:19 PM

@jimp:

Packages should be OK now

What is the easiest way to verify that the version of 2.1.1 that we get from mirror sites contains the updates?

@jimp:

make sure to uninstall and then reinstall (not update) to ensure that it obtains the latest binaries.

"Uninstall"? Is that best done by wiping out the pfSense partition? (…after backing up the configuration, of course...)

doktornotor · Apr 10, 2014, 5:24 PM

Well, that "back seat driving" is with some 10+ years of hands-on experience with source-based distros, such as Gentoo. Meanwhile, to get back on topic - so what's up with the upgrade/reinstall? So, the ports version has not changed, so the package manager just ignores the changed PBI even though you bump the version in the XML? ??? :o

@Bravissimo594:

What is the easiest way to verify that the version of 2.1.1 that we get from mirror sites contains the updates?
"Uninstall"? Is that best done by wiping out the pfSense partition? (…after backing up the configuration, of course...)

A total misunderstanding - you need (the not yet available) 2.1.2 to get the OS itself fixed! We've been just debating the optional packages.

jimp · Apr 10, 2014, 5:23 PM

@Bravissimo594:

@jimp:

Packages should be OK now

What is the easiest way to verify that the version of 2.1.1 that we get from mirror sites contains the updates?

@jimp:

make sure to uninstall and then reinstall (not update) to ensure that it obtains the latest binaries.

"Uninstall"? Is that best done by wiping out the pfSense partition? (…after backing up the configuration, of course...)

That is for packages, not the base system. The base system requires an update to 2.1.2 (coming momentarily)

jimp · Apr 10, 2014, 5:25 PM

@doktornotor:

Well, that "back seat driving" is with some 10+ years of hands-on experience with source-based distros, such as Gentoo. Meanwhile, to get back on topic - so what's up with the upgrade/reinstall? So, the ports version has not changed, so the package manager just ignores the changed PBI even though you bump the version in the XML? ??? :o

I don't recall the specific logic of the reinstall but the safest way to always ensure you have the correct version is to uninstall/reinstall the package. It's not worth splitting hairs over for something this important.

goofytux · Apr 10, 2014, 5:35 PM

@jimp:

I don't recall the specific logic of the reinstall but the safest way to always ensure you have the correct version is to uninstall/reinstall the package. It's not worth splitting hairs over for something this important.

Just to be sure: If an update for the package is offered, I can install this directly. Or do I need to uninstall every package first?

doktornotor · Apr 10, 2014, 5:39 PM

@goofytux:

Just to be sure: If an update for the package is offered, I can install this directly. Or do I need to uninstall every package first?

Apparently the former is not safe (as in, it produces completely invalid results, like here).

jimp · Apr 10, 2014, 5:45 PM

@goofytux:

Just to be sure: If an update for the package is offered, I can install this directly. Or do I need to uninstall every package first?

You need only uninstall the affected package and reinstall that one affected package. No need to reinstall all. Or just do a firmware upgrade in a bit when 2.1.2 rolls out and the packages will reinstall themselves.

@doktornotor:

Apparently the former is not safe (as in, it produces completely invalid results, like here).

That guy's invalid results aren't the fault of anything but his broken "testing" methodology.

athurdent · Apr 10, 2014, 5:55 PM

Maybe the "Reinstall all Packages" Button should move to the Packages Section. So one can easily find it, push it if advised to and go for a beverage of choice afterwards…

Bravissimo594 · Apr 10, 2014, 5:57 PM

@jimp:

That is for packages, not the base system. The base system requires an update to 2.1.2 (coming momentarily)

Oops. Sorry to waste time with that question. I know everyone there must be busy.

doktornotor · Apr 10, 2014, 5:59 PM

@athurdent:

Maybe the "Reinstall all Packages" Button should move to the Packages Section. So one can easily find it, push it if advised to and go for a beverage of choice afterwards…

I'm not even sure whether the reinstall does really reinstall or what it does ATM and how that differs from uninstall/install and/or upgrade… Altogether, feeling highly uncomfortable with a package manager that seems to produce totally unpredictable results.

(The placement of the button goes totally beyond me and makes simply no sense.)

stephenw10 · Apr 10, 2014, 6:06 PM

Hmm, am I missing something? The button is right there in the installed packages screen next to the package listing.

Steve

doktornotor · Apr 10, 2014, 6:08 PM

@stephenw10:

Hmm, am I missing something?

Talking about the Reinstall Packages button in Diagnostics - Backup/Restore

Click this button to reinstall all system packages. This may take a while.