[Bug]: gateway 2.0.0 fails on opnsense

[jamtur01]

Summary

root@opnsense:/home/jamtur01 # /usr/local/bin/defguard-gateway --version
ld-elf.so.1: Shared object "libutil.so.10" not found, required by "defguard-gateway"

This is pretty showstopper'y for me.

Steps to reproduce

1. Try to start defguard.

Expected behavior

1. Defguard starts.

Actual behavior

Gateway does not start.

Defguard version

opnsense 2.0.0

Environment details

OPNsense 26.1.6_2-amd64 FreeBSD 14.3-RELEASE-p10 OpenSSL 3.0.20

root@opnsense:/home/jamtur01 # uname -a
FreeBSD opnsense.malefidus.com 14.3-RELEASE-p10 FreeBSD 14.3-RELEASE-p10 stable/26.1-n272047-4ad47b697b0a SMP amd64
root@opnsense:/home/jamtur01 #
root@opnsense:/home/jamtur01 # uname -a
FreeBSD opnsense.malefidus.com 14.3-RELEASE-p10 FreeBSD 14.3-RELEASE-p10 stable/26.1-n272047-4ad47b697b0a SMP amd64
root@opnsense:/home/jamtur01 # opnsense-version
OPNsense 26.1.6_2 (amd64)
root@opnsense:/home/jamtur01 # freebsd-version -ku
14.3-RELEASE-p10
14.3-RELEASE-p10

Deployment / install method

Standalone packages

[kchudy]

Thank you for the report. We'll try to reproduce it and potentially provide a fix asap.

[jamtur01]

What platform did you build the package on? I am guessing FreeBSD 15 and not 14?

[jamtur01]

Ah - I didn't realize you'd stopped using Cross: #308.

[teon]

@jamtur01 we did but OPNsense build were rewritten - and they are working for sure (we have an OPNsense cluster on our Production for gateways and firewall).

We've been testing all build on our cluster, so TBH don't know what happend to this build. We will test in on Monday.

[jamtur01]

Cool! Thanks! My fix (as I need to have defguard working - about to get on a plane! :))

1. Created a FreeBSD image: Dockerfile.freebsd-cross

FROM rust:1-slim AS builder

ARG FREEBSD_VERSION=14.3
ARG FREEBSD_SYSROOT=/usr/local/freebsd-sysroot

RUN apt-get update && apt-get install -y --no-install-recommends \
    clang lld llvm \
    curl xz-utils ca-certificates \
    protobuf-compiler libprotobuf-dev pkg-config \
    libssl-dev \
    && rm -rf /var/lib/apt/lists/*

# Download and extract FreeBSD sysroot
RUN curl -fSL "https://download.freebsd.org/ftp/releases/amd64/${FREEBSD_VERSION}-RELEASE/base.txz" -o /tmp/base.txz \
    && mkdir -p ${FREEBSD_SYSROOT} \
    && tar xf /tmp/base.txz -C ${FREEBSD_SYSROOT} \
        ./usr/include \
        ./usr/lib \
        ./lib \
    && rm /tmp/base.txz

# Create clang wrapper for cross-compilation
RUN printf '#!/bin/sh\nexec clang --target=x86_64-unknown-freebsd14 --sysroot=%s -fuse-ld=lld "$@"\n' \
    "${FREEBSD_SYSROOT}" > /usr/local/bin/x86_64-unknown-freebsd-cc \
    && chmod +x /usr/local/bin/x86_64-unknown-freebsd-cc \
    && printf '#!/bin/sh\nexec clang++ --target=x86_64-unknown-freebsd14 --sysroot=%s -fuse-ld=lld "$@"\n' \
    "${FREEBSD_SYSROOT}" > /usr/local/bin/x86_64-unknown-freebsd-cxx \
    && chmod +x /usr/local/bin/x86_64-unknown-freebsd-cxx \
    && printf '#!/bin/sh\nexec llvm-ar "$@"\n' \
    > /usr/local/bin/x86_64-unknown-freebsd-ar \
    && chmod +x /usr/local/bin/x86_64-unknown-freebsd-ar

# Add Rust FreeBSD target
RUN rustup target add x86_64-unknown-freebsd

# Configure Cargo for cross-compilation
ENV CARGO_TARGET_X86_64_UNKNOWN_FREEBSD_LINKER=x86_64-unknown-freebsd-cc
ENV CC_x86_64_unknown_freebsd=x86_64-unknown-freebsd-cc
ENV CXX_x86_64_unknown_freebsd=x86_64-unknown-freebsd-cxx
ENV AR_x86_64_unknown_freebsd=x86_64-unknown-freebsd-ar
# Target-specific OpenSSL — don't set OPENSSL_DIR globally or proc macros
# (which compile for the host) will try to link against FreeBSD libs.
ENV X86_64_UNKNOWN_FREEBSD_OPENSSL_DIR=${FREEBSD_SYSROOT}/usr
ENV X86_64_UNKNOWN_FREEBSD_OPENSSL_STATIC=1
ENV SQLX_OFFLINE=1
ENV BINDGEN_EXTRA_CLANG_ARGS_x86_64_unknown_freebsd="--sysroot=${FREEBSD_SYSROOT} --target=x86_64-unknown-freebsd14"

WORKDIR /app

2. Build the binary.

docker run --rm --platform linux/amd64 \
    -v "$(pwd):/app" \
    -v "${HOME}/.cargo/registry:/usr/local/cargo/registry" \
    freebsd14-cross \
    cargo build --locked --release --target x86_64-unknown-freebsd

3. Build the package with fpm.

  fpm -s dir -t freebsd \
    --name defguard-gateway --version 2.0.0 \
    --architecture amd64 --freebsd-osversion '*' --depends openssl \
    target/.../defguard-gateway=/usr/local/bin/defguard-gateway \
    freebsd/defguard-gateway=/usr/local/etc/rc.d/defguard-gateway \
    example-config.toml=/etc/defguard/gateway.toml.sample \
    defguard-rc.conf=/etc/rc.conf.d/defguard_gateway \
    opnsense/src/etc/=/usr/local/etc/ \
    opnsense/src/opnsense/=/usr/local/opnsense/

I have OSX so I ran fpm in a container because I think tar on OSX lacks --transform.

[teon]

@jamtur01 thank you! Was it a new setup or did you upgrade to 2.0 (in that case how do you like new UI, adoption, etc)? Thank you in advance! 💪🫡

[jamtur01]

Upgrade from 1.6.5 to 2.0.0. I like the new UI a lot. Everything's a lot clearer and cleaner. The native certificate management is nice too.

I will confess as an opnsense user having to manually manage the packages is annoying. I know there's a ticket for it but I'd love to see opnsense as a native package in the opnsense repo.

[jamtur01]

As an aside:

      - name: Build OPNsense package
        uses: defGuard/fpm-action@main
        with:
          fpm_args:
            "defguard-gateway-${{ env.VERSION }}-x86_64-unknown-freebsd=/usr/local/bin/defguard-gateway
            freebsd/defguard-gateway=/usr/local/etc/rc.d/defguard-gateway
            example-config.toml=/etc/defguard/gateway.toml
            defguard-rc.conf=/etc/rc.conf.d/defguard_gateway
            opnsense/src/etc/=/usr/local/etc/
            opnsense/src/opnsense/=/usr/local/opnsense/"
          fpm_opts:
            "--architecture amd64
            --output-type freebsd
            --version ${{ env.VERSION }}
            --package defguard-gateway-${{ env.VERSION }}_x86_64-unknown-opnsense.pkg
            --freebsd-osversion '*'
            --depends openssl"

in the release/2.0 branch. Should that be:

      - name: Build OPNsense package
        uses: defGuard/fpm-action@main
        with:
          fpm_args:
            "defguard-gateway-${{ env.VERSION }}-x86_64-unknown-freebsd=/usr/local/bin/defguard-gateway
            freebsd/defguard-gateway=/usr/local/etc/rc.d/defguard_gateway
            example-config.toml=/etc/defguard/gateway.toml
            defguard-rc.conf=/etc/rc.conf.d/defguard_gateway
            opnsense/src/etc/=/usr/local/etc/
            opnsense/src/opnsense/=/usr/local/opnsense/"
          fpm_opts:
            "--architecture amd64
            --output-type freebsd
            --version ${{ env.VERSION }}
            --package defguard-gateway-${{ env.VERSION }}_x86_64-unknown-opnsense.pkg
            --freebsd-osversion '*'
            --depends openssl"

Note the:

 freebsd/defguard-gateway=/usr/local/etc/rc.d/defguard-gateway

to

 freebsd/defguard-gateway=/usr/local/etc/rc.d/defguard_gateway

Because https://github.com/DefGuard/gateway/blob/release/2.0/opnsense/src/opnsense/service/conf/actions.d/actions_defguardgateway.conf uses:

[start]
command:/usr/local/etc/rc.d/defguard_gateway start
parameters:
type:script
message:starting Defguard Gateway

Given that it's your release branch, I didn't want to cause any confusion by opening a PR against it.

It's correct in main.

[moubctez]

These should be fixed in v2.0.1

[kchudy]

Closing this issue as resolved.

If anything comes up again, feel free to reopen.