25.7.3_7

[BrandyWine]

Wow, very fast updating on releases from .3 to .3_7 versions.
My mini pc is now running latest OPNsense and v2.32 nvm on i226-V.
No issues that I can see.

[franco]

Only small changes to ensure error free operation. 25.7.3 has been rocky, but also very useful in terms of optimisation. So overall we are happy with it (now more than ever).

:)


Cheers,
Franco

[Wombat]

Only small changes to ensure error free operation. 25.7.3 has been rocky, but also very useful in terms of optimisation. So overall we are happy with it (now more than ever).

:)


Cheers,
Franco

Well I am not sure the 25.7.3 problems on install are fixed.  Just did upgrades first to 25.1.x to 25.1.12, then updated to 25.7 and finally to 25.7.3 (not sure what _x, but it is what was downloaded by OPN upgrade Gui at 0715Z on 18Sep).
The update to 25.7.3 downloaded, and extracted OK but on then stalled at

Code Select Expand

[1/49] Upgrading python311 from 3.11.13 to 3.11.13_1...I left it for some 20 minutes and no change on progress so left and returned and it was like the update had cancelled itself and dashboard reported version running was 25.7
Ran a few Audits, and the health audit reported running 25.7 but then reported a few mismatches on version numbers, like the Audit was expecting version associated with 25.7.3, not 25.7 that is running.

The output of that Health Audit is

Code Select Expand

***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 25.7 (amd64) at Thu Sep 18 17:46:12 AEST 2025
>>> Root file system: /dev/gpt/rootfs
>>> Check installed kernel version
Version 25.7 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 25.7 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check installed repositories
OPNsense (Priority: 11)
>>> Check installed plugins
No plugins found.
>>> Check locked packages
No locks found.
>>> Check for missing package dependencies
Checking all packages: .......... done
>>> Check for missing or altered package files
Checking all packages: ......
pkg-1.19.2_6: checksum mismatch for /usr/local/lib/libpkg.so.4
pkg-1.19.2_6: checksum mismatch for /usr/local/man/man8/pkg-create.8.gz
Checking all packages....... done
>>> Check for core packages consistency
Core package "opnsense" at 25.7 has 68 dependencies to check.
Checking packages: ..
ca_root_nss-3.108 version mismatch, expected 3.115
Checking packages: ...............
lighttpd-1.4.79 version mismatch, expected 1.4.81
Checking packages: ....
openssh-portable-10.0.p1_1,1 version mismatch, expected 10.0.p1_2,1
Checking packages: .
openvpn-2.6.14 version mismatch, expected 2.6.14_3
Checking packages: .
opnsense-25.7 version mismatch, expected 25.7.3_7
Checking packages: ..
opnsense-lang-25.1.11 version mismatch, expected 25.7.2
Checking packages: .
opnsense-update-25.7 version mismatch, expected 25.7.3
Checking packages: ...
php83-ctype-8.3.23 version mismatch, expected 8.3.25
Checking packages: .
php83-curl-8.3.23 version mismatch, expected 8.3.25
Checking packages: .
php83-dom-8.3.23 version mismatch, expected 8.3.25
Checking packages: .
php83-filter-8.3.23 version mismatch, expected 8.3.25
Checking packages: .
php83-gettext-8.3.23 version mismatch, expected 8.3.25
Checking packages: .
php83-ldap-8.3.23 version mismatch, expected 8.3.25
Checking packages: .
php83-pcntl-8.3.23 version mismatch, expected 8.3.25
Checking packages: .
php83-pdo-8.3.23 version mismatch, expected 8.3.25
Checking packages: .....
php83-session-8.3.23 version mismatch, expected 8.3.25
Checking packages: .
php83-simplexml-8.3.23 version mismatch, expected 8.3.25
Checking packages: .
php83-sockets-8.3.23 version mismatch, expected 8.3.25
Checking packages: .
php83-sqlite3-8.3.23_1 version mismatch, expected 8.3.25
Checking packages: .
php83-xml-8.3.23 version mismatch, expected 8.3.25
Checking packages: .
php83-zlib-8.3.23 version mismatch, expected 8.3.25
Checking packages: ....
py311-duckdb-1.3.1_1 version mismatch, expected 1.3.2
Checking packages: .
py311-jq-1.8.0_1 version mismatch, expected 1.10.0
Checking packages: ...
py311-numpy-1.26.4_6,1 version mismatch, expected 1.26.4_7,1
Checking packages: ....
py311-ujson-5.10.0_1 version mismatch, expected 5.11.0
Checking packages: .....
strongswan-5.9.14 version mismatch, expected 6.0.1
Checking packages: .
sudo-1.9.17p1 version mismatch, expected 1.9.17p2
Checking packages: ..
syslog-ng-4.8.2_3 version mismatch, expected 4.8.2_4
Checking packages: ... done
***DONE***
Hardware is a mini PC, N100 8GB RAM, 100GB SSD, 3 NUC

[franco]

> pkg-1.19.2_6: checksum mismatch for /usr/local/lib/libpkg.so.4

This is a bad sign, but not one of a server side issue.

The update can cancel it self and rerunning the update is the only way to fix this. We actually made a fix for 25.7.2 that tells the user this and avoids a reboot into an inconsistent state.

> Upgrading python311 from 3.11.13 to 3.11.13_1...

Also, python package has many files. Disk performance matters too.


Cheers,
Franco

[franco]

BTW

>>> Root file system: /dev/gpt/rootfs

I think the conclusion is for N100 ZFS does perform more stable on FreeBSD 14.3 (so since 25.7) for whatever reason.


Cheers,
Franco

[meyergru]

The exact reason is unclear, yet we now know how to prevent those problems, see: https://forum.opnsense.org/index.php?topic=48343.msg244891#msg244891

Also, in all reported cases, it was UFS installations, ZFS seems exempt, as also indicated by this FreeBSD report: https://lists.freebsd.org/archives/freebsd-current/2025-January/006984.html

So, the recommendation if you have an N1x0 (or N3x5) is:

1. Use ZFS
2. Use microcode updates
3. Set these tuneables:

vm.pmap.pcid_enabled=0
hw.ibrs_disable=0
vm.pmap.pti=1

[franco]

Uwe: Thanks for the nice summary.  :)