update error - advice please

[skyeci2018]

Hi,

I have a couple or opnsense qotom units and encountered a problem applying the latest update to one of them remotely. The process appeared to hang during the last couple of bits. I was applying the update through the console.

I did reboot the unit afterwards but on running a health audit I am getting the following. Is there anyway to roll the whole patch back or fix the problem without having to rebuild etc?  If I run another update the console reports no updates required.

any help appreciated, thanks

***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 20.7.8 (amd64/OpenSSL) at Sat Jan 23 12:07:59 GMT 2021
>>> Check installed kernel version
Version 20.7.8 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 20.7.8 is correct.
>>> Check for missing or altered base files
Error 2 ocurred.
bin/freebsd-version:
                size (3333, 3322)
                sha256digest (0xecc8d07441731cd576e28932aaee79331974078011f879d750fee3c95941f773, 0x5070d97d187538b03bd325ca7bb64097c00d256043a7fad74c2adbf89d44fb1c)
boot/loader.efi:
                sha256digest (0xbacf690ee7d8a934da979e9a12789cafc92e386e8a6ebfa04be5fe1466f67232, 0xf50eddba00e3c572358adca9a64c7686ede30ee2b53459461f3cfb5993e8c575)
boot/zfsloader:
                sha256digest (0x74dc7d85890384bce5aacff355cb73f987e9c3367d9d6ee99282f6a5719e20d8, 0xea8000cc0a0e7174b04614b1718b91ea13c1c23a8290ff90263ed1021671e3ff)
boot/pxeboot:
                sha256digest (0x15a48a495353915dc6484fcf03ca3c38d885c911d935d644ade7ca4a5b0b6972, 0x437bc252f3e8fdd9c430af9e38125230703b2c15acd32e9dd83bf141d666b0de)
boot/loader:
                sha256digest (0x74dc7d85890384bce5aacff355cb73f987e9c3367d9d6ee99282f6a5719e20d8, 0xea8000cc0a0e7174b04614b1718b91ea13c1c23a8290ff90263ed1021671e3ff)
boot/userboot.so:
                sha256digest (0xf88669f52c817a3c7e13095e5a5c1d023dca1a336654261c297eccb7a27413b8, 0xe69d0be1081ef0615435f8262fe0b76e645a6f0d4732d8b638c9c28edb192cc7)
boot/userboot_4th.so:
                sha256digest (0xf88669f52c817a3c7e13095e5a5c1d023dca1a336654261c297eccb7a27413b8, 0xe69d0be1081ef0615435f8262fe0b76e645a6f0d4732d8b638c9c28edb192cc7)
boot/userboot_lua.so:
                sha256digest (0xc80021eb2725c1d2bbc690f87247521472339e000ea05947c43edbbd18fadd15, 0xecefa95a76283aaa4ba3e5fa3504ef43caef451f96bce0dc247302784973755d)
boot/loader_4th:
                sha256digest (0x74dc7d85890384bce5aacff355cb73f987e9c3367d9d6ee99282f6a5719e20d8, 0xea8000cc0a0e7174b04614b1718b91ea13c1c23a8290ff90263ed1021671e3ff)
boot/loader_lua:
                sha256digest (0xa974491ed049c5035f5df1f125067509e83373a54c1645850ce31a5eb3f8ee92, 0xfb48d7ee6589cdd387881250c9447c0b53fa6766d46b0d531961a96a71579394)
boot/loader_simp:
                sha256digest (0x7c007c426776835936cbc17112f801c283e7bece4a72e4334ef82810c2958626, 0x4730070de59b5445e300a0c3efc2b8f175136b1f2ea5b35bab3382c4d07d27f9)
boot/loader_4th.efi:
                sha256digest (0xbacf690ee7d8a934da979e9a12789cafc92e386e8a6ebfa04be5fe1466f67232, 0xf50eddba00e3c572358adca9a64c7686ede30ee2b53459461f3cfb5993e8c575)
boot/loader_lua.efi:
                sha256digest (0x90d46e3deef945666f9d413ef4ec5d346a86b195f20de91fa0bc49a90ef54377, 0xb9059794ded528a17f2b5256d879014173033ce591974f870f653ea4120f452a)
boot/loader_simp.efi:
                sha256digest (0x8aa8c3f5e9b310dabf42cc806ef8e4bcf3d369d9f2d407d033621fa4b00813f2, 0xf789f68174e3fc77241821c530077fe1699858896c67c24559d5f68a9c193f58)
lib/libcrypto.so.111:
                size (3060000, 3059968)
                sha256digest (0x77c0de26823c8071bc490b22e604af911131fc0a220e08cfe5b720a32339343a, 0x82355cd9619efa3e8278819f6b021fa6eceb2abc50757be5c3bc8c6bdba35368)
sbin/pfctl:
                sha256digest (0xc86465d13df7511191f0bbbb39e25dd91f06f5f185c34ab73343a9133db969b1, 0x77a24f3d7ba245e8673c846d6d3479bd7bb22f8b6bcb7d9cdc317b87b9030e23)
usr/bin/llvm-extract:
                size (8427144, 4808192)
                sha256digest (0x74348d2fa988399977943c36ff446264dbfccb71431bfe042c37cb0d0f15dbca, 0xa694f3bdc07abb31bb87d552cbca51d446ba37198ba5b6aa14add017e6848ff7)
>>> Check for missing package dependencies
Checking all packages: .......... done

 

[franco]

Hi,

Got to firewall packages tab, reinstall "base" package (needs reboot).

If you don't want to reboot drop to shell and run:

# opnsense-update -fb

Either way the base set where your errors pop up will be reinstalled cleanly once more.

If you run another audit the errors should be gone.

On a small amount of updates this is due to the disk or UFS misbehaving (signature of archive is ok, unpack returns success, but after reboot the files are the old ones or gone or empty).


Cheers,
Franco

[skyeci2018]

Hi Franco.

Thanks for the response. Can I check all settings are preserved from my current config. Its a remote unit and given our lockdown I just need to check I won't lose access to it.

Also I  notice the freed bsd version is not the same as my other unit with the update. Is this a problem?
Cheers

[franco]

The opnsense-update command is harmless: it only fetches the base files again and installs them (same files except for the ones that your health audit complains about). No reboot, no config changes, no functional changes.

I would keep an eye on that hard disk though. It might give you further issues later.


Cheers,
Franco

[franco]

PS: Regarding FreeBSD version could be same issue here, athough that info normally comes from the kernel so it's still running p11 instead of p12?

[skyeci2018]

Hi Franco

Thanks , it reports 12.1 hbsd even though the console says no updates required...

Thanks

[franco]

I need exact info version string and which component gives you this info.

We did fix freebsd-version in 20.7.8 as witnessed by your heath audit and this commit...

https://github.com/opnsense/src/commit/d59f27476fa3

So yes, < 20.7.8 will not print the full version string in freebsd-version, but 20.7.8 will.


Cheers,
Franco

[franco]

PS: Both of which are not an issue, because we normally use kernel info from uname and that was always correct...


Cheers,
Franco

[skyeci2018]

Ok. I just did freebsd-version from shell and compared the 2 results. The unit that has the issue shows the same version info in the gui but the free bsd version differ between the 2 from shell. I haven't run anything yet so if you want any other info let me know what you need.

Thanks.

[franco]

Sorry, this is a bit confusing without hard facts like copy+paste or screenshots.

For now I would assume reinstalling the base package on the system that shows the health errors will fix it and that's all the worries to have.


Cheers,
Franco

[skyeci2018]

Ok. Will try as you have suggested and report back. Thanks

[skyeci2018]

All good and all sorted. Audit clear and bsd versions match.

Many thanks for your help.

[franco]

Yay, glad to hear