TrueNAS CORE 12.0-U8.1 Released

[eturgeon]

TrueNAS Community,

TrueNAS CORE 12.0-U8.1 has been released! 12.0-U8.1 is a small security-focused release with additional fixes for the Minio service and a hardware-specific boot issue. See the release notes for the full changelog.

Release Notes: https://www.truenas.com/docs/releasenotes/core/12.0u8.1/
Download: https://www.truenas.com/download-truenas-core/

Thanks for using TrueNAS, and we appreciate all your feedback!

 

[anodos]

This release contains several critical CVE fixes for the AFP service (Netatalk).

 

[awasb]

Is a zlib fix included?

https://www.freebsd.org/security/advisories/FreeBSD-SA-22:08.zlib.asc

 

[elvisimprsntr]

Trying to update, but can't reach host

Unable to connect to url https://update-master.ixsystems.com/TrueNAS/TrueNAS-12.0-STABLE/LATEST: Automatic update check failed. Please check system network settings.

Code:

root@NAS-1[~]# ping google.com
PING google.com (142.250.64.174): 56 data bytes
64 bytes from 142.250.64.174: icmp_seq=0 ttl=117 time=5.820 ms
64 bytes from 142.250.64.174: icmp_seq=1 ttl=117 time=5.642 ms
^C
--- google.com ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 5.642/5.731/5.820/0.089 ms
root@NAS-1[~]# ping https://update-master.ixsystems.com
ping: cannot resolve https://update-master.ixsystems.com: Unknown host
root@NAS-1[~]# ping http://update-master.ixsystems.com
ping: cannot resolve http://update-master.ixsystems.com: Unknown host

 

[NugentS]

If its any help - I managed

 

[Jailer]

Trying to update, but can't reach host

Same here, I'll try again later.

 

[Tony-1971]

I can ping it:

Code:

Warning: settings changed through the CLI are not written to
the configuration database and will be reset on reboot.

root@freenas-sm[~]# ping update-master.ixsystems.com
PING update-master.freenas.org (192.41.228.50): 56 data bytes
64 bytes from 192.41.228.50: icmp_seq=0 ttl=37 time=142.768 ms
64 bytes from 192.41.228.50: icmp_seq=1 ttl=37 time=141.672 ms
...

 

[jlpellet]

Successfully applied to 5 U8 systems with no issues so far. YMMV

 

[anodos]

Successfully applied to 5 U8 systems with no issues so far. YMMV

Primary concern will be for AFP users. If AFP client gets unexpectedly disconnected, then check for core files. Due to changes related to CVE we call netatalk_panic() in cases where adouble metadata is malformed in a potentially dangerous way. It's somewhat hard to test all the edge cases for this (especially with old data / clients). Generally speaking, it's better to begin the migration process off of AFP.

 

[Daisuke]

502 Nginx errors:

Code:

$ curl -I https://update-master.ixsystems.com/TrueNAS/TrueNAS-12.0-STABLE/LATEST
HTTP/1.1 502 Bad Gateway
Server: nginx/1.18.0
Date: Fri, 15 Apr 2022 21:59:44 GMT
Content-Type: text/html
Content-Length: 157
Connection: keep-alive

 

[elvisimprsntr]

was able to get on system updated to U8.1

second system not able to reach server

Unable to connect to url https://update-master.ixsystems.com/TrueNAS/TrueNAS-12.0-STABLE/LATEST: Automatic update check failed. Please check system network settings.

Code:

root@NAS-2[~]# ping update-master.ixsystems.com
PING update-master.freenas.org (192.41.228.50): 56 data bytes
64 bytes from 192.41.228.50: icmp_seq=0 ttl=47 time=44.126 ms
64 bytes from 192.41.228.50: icmp_seq=1 ttl=47 time=43.576 ms
^C
--- update-master.freenas.org ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 43.576/43.851/44.126/0.275 ms
root@NAS-2[~]# ping google.com                 
PING google.com (142.250.217.174): 56 data bytes
64 bytes from 142.250.217.174: icmp_seq=0 ttl=117 time=6.757 ms
64 bytes from 142.250.217.174: icmp_seq=1 ttl=117 time=6.602 ms
^C
--- google.com ping statistics ---
2 packets transmitted, 2 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 6.602/6.679/6.757/0.078 ms

 

[elvisimprsntr]

Had to resort to downloading the manual update file.

TrueNAS-12.0-U8.1-manual-update.tar

 

[darylk]

Installed this last night. Plugins not working. Dropped to community and tried to install any of them and received "release 12.2 not found". Issuing a "pkg update" in the shell gave a bunch of errors as well so....... First time trying truenas core. Before reaching this deal breaker I also wasnt able to bind network cards, 2 port intel nic card. Same technique that worked last night on truenas-scale. Scale screwed up SSL so I tried core. Off to another pasture.

 

[Nordlicht-13]

Update stays at:
Update
66.67%
Installing base-os (1/3)

Under System->Boot I already got listed several entrys:

Boot Environments

Name / Active / Created / Space / Keep
12.0-U8.1 / - / 2022-04-18 21:04:00 / 653.98 MiB / no
12.0-U8.1-1 / - / 2022-04-18 21:23:00 / 1.17 GiB / no
12.0-U8.1-2 / - / 2022-04-19 02:23:00 / 1.20 GiB / no
12.0-U8.1-3 / Reboot / 2022-04-19 15:35:00 / 1.20 GiB / no
12.0-U8.1-4 / - / 2022-04-20 00:29:00 / 665.97 MiB / no
default / Now / 2022-02-18 23:41:00 / 410.00 KiB
Initial-Install / - / 2022-02-23 13:45:00 / 9.65 MiB / yes

1 - 7 of 7

 

[Kartoffel]

Warning: If you need AFP on maybe older mac's wait! I get a lot of this problems:

kernel: pid 4846 (afpd), jid 0, uid 1001: exited on signal 6​

pid is counting every 5 seconds. No way to work with. Rollback to 12.0 U8 solved it temporary. I hope U8.2 fix the problem.

 

[anodos]

Warning: If you need AFP on maybe older mac's wait! I get a lot of this problems:

kernel: pid 4846 (afpd), jid 0, uid 1001: exited on signal 6​

pid is counting every 5 seconds. No way to work with. Rollback to 12.0 U8 solved it temporary. I hope U8.2 fix the problem.

The problem was caused by a buggy CVE fix upstream. I fixed several issues with it before U8.1 release, but obviously there is some edge case I missed.

add handling for cases where ad_entry() returns NULL by anodos325 · Pull Request #174 · Netatalk/netatalk

With recent CVE fixes, ad_enty() may now return NULL. This commit adds basic error handling for these cases and asserting where such a return is totally unexpected. In case of ad_getid() and ad_for...

github.com

Is where I've fixed the initial issues with AFP. If you are using AFP in a production environment / place of work. Do not roll back without thoroughly understanding the consequences of this. The AFP vulnerabilities are IIRC unauthenticated remote code execution as root. This is not something to leave exposed at your place of work :)

This means, that I need some user who is having this crash (I can't reproduce the crash) provide me with clear instructions on how to reproduce the issue. It will not get fixed until this happens.

With that said, people using AFP should migrate to SMB already. :)

 

[Kartoffel]

Thank you for your fast feedback, anodos. i am glad to hear that the problem is being addressed.

Using 8.1 is no option because the whole computer becomes unusable when connected to TrureNAS.

 

[anodos]

Thank you for your fast feedback, anodos. i am glad to hear that the problem is being addressed.

Using 8.1 is no option because the whole computer becomes unusable when connected to TrureNAS.

Can you send me a debug file (System->Advanced->Save Debug) via private message?

 

[mrcjames]

Can you send me a debug file (System->Advanced->Save Debug) via private message?

Hi, I have the same issue with AFP. I've prepared a debug file and can also send directly.

 

[anodos]

Hi, I have the same issue with AFP. I've prepared a debug file and can also send directly.

I've gotten what I can out of a debug. At this point I need corefile from afpd to investigate further.