Topics

1

Announcements / OPNsense 24.7.10 released

« on: Today at 02:10:20 pm »

Hi there,

This ships a number of base system changes, kernel fixes and driver
updates.  The time-loop authentication change is back with the fixed
TOTP case and the Unbound domain overrides are now found in query
forwarding since this offers the same functionality anyway.

With the year almost over we are shifting focus to finishing the items
on the roadmap and it is nice to note that the MVC/API conversions are
already over 75% complete.  That means it will not take another decade
to migrate the other 25%. 

Here are the full patch notes:

o system: readd a "time-loop" around authentication for failed attempts
o system: remove the SSL bundles in default locations
o system: prevent JS crashing out when dashboard widget title is not set
o system: use system instead of sample defaults when reverting tunables
o system: report actual LAN address being used after factory reset
o interfaces: use Autoconf class to avoid raw ifctl file access
o interfaces: remove ancient MAC address trickery to unbreak hostapd
o interfaces: add missing neighbor and DNS lookup page ACL entries
o interfaces: PPP device page ACL missed getserviceproviders.php
o firmware: force CRL check on development deployment
o firmware: use REQUEST to print a TLS/CRL usage hint
o firmware: improved output helpers and associated cleanup in audit scripts
o firmware: opnsense-update: add support for regression tests set
o intrusion detection: limit stats.log logging (contributed by doktornotor)
o kea-dhcp: add dhcp-socket-type option (contributed by Till Niederauer)
o kea-dhcp: add MAC formatter to leases page (contributed by cpalv)
o openvpn: support case-insensitive strict user CN matching for instances
o unbound: move domain overrides to query forwarding
o mvc: let JsonKeyValueStoreField cache configd call for the duration of the session
o mvc: another batch of sessionClose() cleanups in controllers
o mvc: cleanup in ApiMutableServiceControllerBase
o mvc: fix hint display for "0"
o ui: restore right tab border in standard theme
o plugins: os-caddy 1.7.5[1]
o plugins: os-debug 1.7[2]
o src: atf/kyua: ship regression tests runtime support
o src: if_bridge: mask MEXTPG if some members do not support it
o src: if_tuntap: enable MEXTPG support
o src: ice: update to 1.43.2-k et al
o src: ipsec: fix IPv6 over IPv4 tunneling
o src: ixgbe: add support for 1Gbit (active) DAC links
o src: ixgbe: sysctl for TCP flag handling during TSO
o src: jail: expose children.max and children.cur via sysctl
o src: libfetch: add the error number to verify callback failure case
o src: netlink: assorted stable backports
o src: pf: prevent SCTP-based NULL dereference in pfi_kkif_match()
o src: pf: let rdr rules modify the src port if doing so would avoid a conflict
o src: pf: make pf_get_translation() more expressive
o src: pf: let pf_state_insert() handle redirect state conflicts
o src: pf: fix wrong pflog action in NAT rule
o src: pf: fix potential state key leak
o src: rc: ignore INSYDE BIOS placeholder UUID for /etc/hostid
o src: route: fix failure to add an interface prefix route when route with the same prefix is already presented in the routing table
o src: route: route: avoid overlapping strcpy
o src: sfxge: defer ether_ifattach to when ifmedia_init is done
o ports: curl 8.11.0[3]
o ports: expat 2.6.4[4]
o ports: nss 3.107[5]
o ports: openldap 2.6.9[6]
o ports: php 8.2.26[7]
o ports: sudo 1.9.16p2[8]


Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/24.7/www/caddy/pkg-descr
[2] https://github.com/opnsense/plugins/blob/stable/24.7/devel/debug/pkg-descr
[3] https://curl.se/changes.html#8_11_0
[4] https://github.com/libexpat/libexpat/blob/R_2_6_4/expat/Changes
[5] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_107.html
[6] https://www.openldap.org/software/release/changes.html
[7] https://www.php.net/ChangeLog-8.php#8.2.26
[8] https://www.sudo.ws/stable.html#1.9.16p2

2

Announcements / 24.10.1 business edition released

« on: November 27, 2024, 01:46:57 pm »

This business release is based on the OPNsense 24.7.9 community version
with additional reliability improvements.

Here are the full patch notes:

o system: remove obsolete banners from static pages
o system: address CRL/cert subject hash mismatch during trust store rehash
o system: add missing MinProtocol in OpenSSL config template from trust settings
o system: add SignatureAlgorithms option and fix minor form glitch in trust settings
o system: sync certctl to FreeBSD 14.1 base code et al
o system: migrate authoritative bundle location to /usr/local/etc/ssl/cert.pem
o system: flush the global OpenSSL configuration to /etc/ssl/openssl.cnf as well
o system: ignore gateway monitor status on boot when setting up routes
o system: fix IP address validation not being displayed in the gateway form
o reporting: refactor existing RRD backend code
o reporting: isset() vs. empty() on RRD enable
o reporting: fix regression in RRD temperature readings
o reporting: ISO dates and logical ranges in health graphs (contributed by Roy Orbitson)
o interfaces: fix VXLAN interface being busy when vxlanlocal or vxlanremote is changed
o interfaces: 6RD/6to4 route creation should be limited to IPv6
o interfaces: parse part of SFP module information in legacy_interfaces_details()
o interfaces: kill defunct route-to states with the stale gateway IP
o firewall: add a note about stateless TCP during syncookie use
o firewall: enhance validation that group name can not start or end with a digit
o firewall: make loopback traffic stateful again to fix its use with syncookie option
o firewall: add 'Action' property to list of retrieved rules
o firewall: use UUIDs as rule labels to ease tracking
o firmware: remove escaped slashes workaround on mirror/flavour write
o firmware: introduce config.sh and use it in launcher.sh and connection.sh
o firmware: restart cron on updates
o firmware: improve health script and use config.sh
o firmware: rework CRL check in config.sh
o firmware: use the trust store for CRL verification
o firmware: refactor for generic config.sh use and related code audit
o firmware: move the bogons update script to the firmware scripts, improve logging messages and use config.sh
o firmware: opnsense-version: restored pre-2019 default output format (contributed by TotalGriffLock)
o firmware: use REQUEST to print a TLS/CRL usage hint
o firmware: force CRL check on development deployment
o intrusion detection: reorganise settings page with headers
o intrusion detection: support configuration of eve-log for HTTP and TLS (contributed by Toby Chen)
o ipsec: add swanctl.conf download button to settings page
o ipsec: add description field to pre-shared-keys
o isc-dhcp: safeguard output type for json_decode() in leases page
o openvpn: add Require Client Provisioning option for instances
o unbound: allow RFC 2181 compatible names in overrides
o backend: correct template helper exists() return type (contributed by kumy)
o backend: add 'configd environment' debug action
o lang: update available translations
o mvc: extend sanity checks in isIPInCIDR()
o mvc: fix UpdateOnlyTextField incompatibility with DependConstraint (contributed by kumy)
o mvc: always do stop/start on forced restart
o mvc: remove obsolete sessionClose() use in Base, Firmware, Unbound and WireGuard controllers
o ui: fix tree view style targeting elements outside this view
o plugins: enforce defaults on devices
o plugins: os-bind 1.33[1]
o plugins: os-caddy 1.7.4[2]
o plugins: os-ddclient 1.25[3]
o plugins: os-debug 1.6
o plugins: os-etpro-telemetry lowers log level of collection invoke (contributed by doktornotor)
o plugins: os-freeradius 1.9.26[4]
o plugins: os-frr 1.42[5]
o plugins: os-iperf fixes JS TypeError when parsing result (contributed by Leo Huang)
o plugins: os-lldpd 1.2[6]
o plugins: os-ndproxy 1.0 adds an IPv6 Neighbour Discovery proxy
o plugins: os-net-snmp 1.6[7]
o plugins: os-tinc removes "pipes" Python module dependency (contributed by andrewhotlab)
o plugins: os-upnp 1.7[8]
o plugins: os-wazuh-agent 1.2[9]
o src: multiple issues in the bhyve hypervisor[10]
o src: unbounded allocation in ctl(4) CAM Target Layer[11]
o src: XDG runtime directory file descriptor leak at login[12]
o src: assorted FreeBSD stable patches for Intel ixgbe, igb, igc and e1000 drivers
o src: cxgb: register ifmedia callbacks before ether_ifattach
o src: enc: use new KPI to create enc interface
o src: ifconfig: fix wrong indentation for the status of pfsync
o src: iflib: simplify iflib_legacy_setup
o src: iflib: use if_alloc_dev() to allocate the ifnet
o src: netmap: make memory pools NUMA-aware
o src: vlan: handle VID conflicts
o ports: libpfctl 0.14
o ports: monit 5.34.2[13]
o ports: nss 3.106[14]
o ports: openssh 9.9.p1[15]
o ports: php 8.2.25[16]
o ports: py-duckdb 1.1.3[17]
o ports: syslog-ng 4.8.1[18]
o ports: unbound 1.22.0[19]


Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/24.7/dns/bind/pkg-descr
[2] https://github.com/opnsense/plugins/blob/stable/24.7/www/caddy/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/24.7/dns/ddclient/pkg-descr
[4] https://github.com/opnsense/plugins/blob/stable/24.7/net/freeradius/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/24.7/net/frr/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/24.7/net-mgmt/lldpd/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/24.7/net-mgmt/net-snmp/pkg-descr
[8] https://github.com/opnsense/plugins/blob/stable/24.7/net/upnp/pkg-descr
[9] https://github.com/opnsense/plugins/blob/stable/24.7/security/wazuh-agent/pkg-descr
[10] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:17.bhyve.asc
[11] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:18.ctl.asc
[12] https://www.freebsd.org/security/advisories/FreeBSD-EN-24:17.pam_xdg.asc
[13] https://mmonit.com/monit/changes/
[14] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_105.html
[15] https://www.openssh.com/txt/release-9.9
[16] https://www.php.net/ChangeLog-8.php#8.2.25
[17] https://github.com/duckdb/duckdb/releases/tag/v1.1.3
[18] https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.8.1
[19] https://nlnetlabs.nl/projects/unbound/download/#unbound-1-22-0

3

Announcements / OPNsense 24.7.9 released

« on: November 20, 2024, 11:32:22 am »

Dear all,

This is a minor update that further tweaks the trust store integration
and firmware updates tying into it although in practice it does not
change the current behaviour from a user perspective.  If something is
not behaving as usual afterwards please let us know.

A new plugin has been added to finally allow proxying ND messages for
those people stuck on a single /64 prefix delegation.  Otherwise it
has been pretty quiet as you can see.  But we will be back soon. 

Here are the full patch notes:

o system: revert CRLs in bundles as the default bundles will be removed in 25.1
o system: migrate authoritative bundle location to /usr/local/etc/ssl/cert.pem
o system: flush the global OpenSSL configuration to /etc/ssl/openssl.cnf as well
o system: ignore gateway monitor status on boot when setting up routes
o system: fix IP address validation not being displayed in the gateway form
o system: add a "time-loop" around authentication for failed attempts
o reporting: ISO dates and logical ranges in health graphs (contributed by Roy Orbitson)
o interfaces: kill defunct route-to states with the stale gateway IP
o firewall: make loopback traffic stateful again to fix its use with syncookie option
o firewall: add 'Action' property to list of retrieved rules
o firewall: use UUIDs as rule labels to ease tracking
o firmware: refactor for generic config.sh use and related code audit
o firmware: move the bogons update script to the firmware scripts, improve logging messages and use config.sh
o firmware: opnsense-version: restored pre-2019 default output format (contributed by TotalGriffLock)
o openvpn: add Require Client Provisioning option for instances
o backend: add 'configd environment' debug action
o mvc: always do stop/start on forced restart
o mvc: remove obsolete sessionClose() use in Base, Firmware, Unbound and WireGuard controllers
o plugins: os-debug 1.6
o plugins: os-ndproxy 1.0 adds an IPv6 Neighbour Discovery proxy
o plugins: os-wazuh-agent 1.2[1]
o ports: py-duckdb 1.1.3[2]


Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/24.7/security/wazuh-agent/pkg-descr
[2] https://github.com/duckdb/duckdb/releases/tag/v1.1.3

4

Announcements / OPNsense 24.7.8 released

« on: November 06, 2024, 02:52:51 pm »

Hey there,

Minor update with FreeBSD security advisories and a number of stable
branch patches for various Intel drivers.  Two problems with the RRD
rework are herby fixed as well.

Here are the full patch notes:

o system: add missing MinProtocol in OpenSSL config template from trust settings
o system: add SignatureAlgorithms option and fix minor form glitch in trust settings
o system: bring CRLs into bundles as well
o system: sync certctl to FreeBSD 14.1 base code et al
o reporting: isset() vs. empty() on RRD enable
o reporting: fix regression in RRD temperature readings
o interfaces: parse part of SFP module information in legacy_interfaces_details()
o firewall: add a note about stateless TCP during syncookie use
o firewall: enhance validation that group name can not start or end with a digit
o firmware: improve health script and use config.sh
o firmware: rework CRL check in config.sh
o firmware: use the trust store for CRL verification
o lang: update available translations
o ipsec: add swanctl.conf download button to settings page
o ipsec: add description field to pre-shared-keys
o isc-dhcp: safeguard output type for json_decode() in leases page
o unbound: allow RFC 2181 compatible names in overrides
o mvc: fix UpdateOnlyTextField incompatibility with DependConstraint (contributed by kumy)
o plugins: os-bind 1.33[1]
o plugins: os-caddy 1.7.4[2]
o plugins: os-etpro-telemetry lowers log level of collection invoke (contributed by doktornotor)
o plugins: os-iperf fixes JS TypeError when parsing result (contributed by Leo Huang)
o plugins: os-tinc removes "pipes" Python module dependency (contributed by andrewhotlab)
o src: multiple issues in the bhyve hypervisor[3]
o src: unbounded allocation in ctl(4) CAM Target Layer[4]
o src: XDG runtime directory file descriptor leak at login[5]
o src: assorted FreeBSD stable patches for Intel ixgbe, igb, igc and e1000 drivers
o src: cxgb: register ifmedia callbacks before ether_ifattach
o src: enc: use new KPI to create enc interface
o src: ifconfig: fix wrong indentation for the status of pfsync
o src: iflib: simplify iflib_legacy_setup
o src: iflib: use if_alloc_dev() to allocate the ifnet
o src: netmap: make memory pools NUMA-aware
o src: vlan: handle VID conflicts
o ports: libpfctl 0.14
o ports: nss 3.106[6]
o ports: php 8.2.25[7]


Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/24.7/dns/bind/pkg-descr
[2] https://github.com/opnsense/plugins/blob/stable/24.7/www/caddy/pkg-descr
[3] https://www.freebsd.org/security/advisories/FreeBSD-EN-24:17.pam_xdg.asc
[4] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:17.bhyve.asc
[5] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:18.ctl.asc
[6] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_106.html
[7] https://www.php.net/ChangeLog-8.php#8.2.25

5

Announcements / OPNsense 24.7.7 released

« on: October 23, 2024, 03:01:53 pm »

Hello,

A small update to keep things moving forward while things are quietening
down a little bit.  Still working on improving the trust store integration
and already tackling new MVC/API conversions on the development end.

Here are the full patch notes:

o system: add OpenSSH "RekeyLimit" with a limited set of choices
o system: fix certificate condition in setCRL() (contributed by richierg)
o system: untrusted directory changed in FreeBSD 14
o system: remove obsolete banners from static pages
o system: address CRL/cert subject hash mismatch during trust store rehash
o reporting: refactor existing RRD backend code
o firewall: throttle live logging on dashboard widget
o interfaces: fix VXLAN interface being busy when vxlanlocal or vxlanremote is changed
o interfaces: 6RD/6to4 route creation should be limited to IPv6
o firmware: remove escaped slashes workaround on mirror/flavour write
o firmware: CRL checking for business update mirror
o firmware: introduce config.sh and use it in launcher.sh and connection.sh
o firmware: restart cron on updates
o intrusion detection: reorganise settings page with headers
o intrusion detection: support configuration of eve-log for HTTP and TLS (contributed by Toby Chen)
o ipsec: fix advanced option "max_ikev1_exchanges"
o backend: cache file cleanup when TTL is reached
o backend: correct template helper exists() return type (contributed by kumy)
o mvc: fix config.xml file open mode in overwrite()
o mvc: add missing request->hasQuery()
o mvc: add missing request->getScheme()
o mvc: add missing request->getURI()
o mvc: extend sanity checks in isIPInCIDR()
o ui: fix tree view style targeting elements outside this view
o plugins: enforce defaults on devices
o plugins: os-caddy 1.7.3[1]
o plugins: os-ddclient 1.25[2]
o plugins: os-freeradius 1.9.26[3]
o plugins: os-frr 1.42[4]
o plugins: os-lldpd 1.2[5]
o plugins: os-net-snmp 1.6[6]
o plugins: os-upnp 1.7[7]
o plugins: os-wazuh-agent 1.1[8]
o ports: monit 5.34.2[9]
o ports: nss 3.105[10]
o ports: openssh 9.9.p1[11]
o ports: pkg fix for for embedded libfetch when doing CRL verification
o ports: py-duckdb 1.1.2[12]
o ports: syslog-ng 4.8.1[13]
o ports: unbound 1.22.0[14]


Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/24.7/www/caddy/pkg-descr
[2] https://github.com/opnsense/plugins/blob/stable/24.7/dns/ddclient/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/24.7/net/freeradius/pkg-descr
[4] https://github.com/opnsense/plugins/blob/stable/24.7/net/frr/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/24.7/net-mgmt/lldpd/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/24.7/net-mgmt/net-snmp/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/24.7/net/upnp/pkg-descr
[8] https://github.com/opnsense/plugins/blob/stable/24.7/security/wazuh-agent/pkg-descr
[9] https://mmonit.com/monit/changes/
[10] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_105.html
[11] https://www.openssh.com/txt/release-9.9
[12] https://github.com/duckdb/duckdb/releases/tag/v1.1.2
[13] https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.8.1
[14] https://nlnetlabs.nl/projects/unbound/download/#unbound-1-22-0

6

Announcements / OPNsense 24.10 business edition released

« on: October 17, 2024, 02:20:30 pm »

The OPNsense business edition transitions to this 24.10 release including
ZFS snapshot support via GUI/API, rewritten dashboard, system trust MVC/API
support, GRE and GIF MVC/API support, NAT 1-to-1 MVC/API support, WireGuard
QR code generator, dynamic IPsec VTI tunnel support, experimental OpenVPN
DCO support, FreeBSD 14.1, Python 3.11 plus much more.

Please make sure to read the migration notes before upgrading.

Download link is as follows.  An installation guide[1] and the checksums for
the images can be found below as well.

https://downloads.opnsense.com/

This business release is based on the OPNsense 24.7.6 community version
with additional reliability improvements.

Here are the full changes against version 24.4.3:

o system: remove "load_balancer" configuration remnants from core
o system: replace usage of mt_rand() with random_int()
o system: rewrote Trust configuration using MVC/API
o system: add XMLRPC option for OpenDNS
o system: rewrote the high availability settings page using MVC/API
o system: remove obsolete SSH DSA key handling
o system: replaced the dashboard with a modern alternative with streaming widgets
o system: harden a number of PHP settings according to best practices
o system: support streaming of log files for the new dashboard widget
o system: assorted dashboard widget tweaks
o system: sidebar optimisation and fixes (contributed by Team Rebellion)
o system: set short Cache-Control lifetime for widgets
o system: fix disk widget byte unit "B" parsing crashing the whole widget
o system: increase widget timeout to 5 seconds
o system: cores and threads flipped in system widget
o system: increase the PHP children count of the web GUI
o system: guard destroy on traffic widget
o system: adjust address display in interfaces widget
o system: fix display of multiple sources in thermal sensor widget
o system: add load average back to system info widget
o system: remove dots from traffic widget graphs
o system: add publication date to announcement widget
o system: fix monit widget status code handling
o system: allow and persist vertical resize in widgets
o system: improve formatting of byte values in widgets
o system: update OpenVPN widget server status color
o system: add aggregated traffic information about connected children in IPsec widget
o system: remove animated transition from row hover for table widgets
o system: improve the styling of the widget lock button
o system: apply locked state to newly added widgets as well
o system: account for removal of rows in non-rotated widget tables with top headers
o system: use "importmap" to force cache safe imports of base classes for widgets
o system: allow custom fonts in the widgets with gauges (contributed by Jaka Prasnika)
o system: add monitor IP to gateway API result (contributed by Herman Bonnes)
o system: better define "in use" flag and safety guards in certificates section
o system: export p12 resulted in mangled binary blob in certificates section
o system: when using debug kernels prevent them from triggering unrelated panics on assertions
o system: switch Twitter to Reddit URL in message of the day
o system: fix API exception on empty CA selection
o system: CRL import ignored text input and triggered unrelated validations
o system: improve the locking during web GUI restart
o system: improve WireGuard and IPsec widgets
o system: add CPU widget graph selection
o system: reformat traffic graphs to bps
o system: add gateway widget item selection
o system: add table view to interface statistics widget on expansion
o system: improve widget error recovery
o system: fix wrong variable assignment in system log search backend
o system: add missing delAction() for proper CRL removal
o system: remove obsolete dashboard sync
o system: compact services widget on dashboard
o system: convert lock mode to edit mode on dashboard
o system: link certificates by subject on import
o system: unify how log search clauses work and add a search time constraint
o system: move to static imports for widget base classes on dashboard
o system: fix ACL check on dashboard restore and add safety check for save action
o system: change dashboard modify buttons to a bootstrap group (contributed by Jaka Prašnikar)
o system: use built-in controller logic for JSON decoding on dashboard
o system: map derivative field cert_type to expose purpose to the UI
o system: handle stale "pfsyncinterfaces" and improve workflow
o system: tweak the boot detection for code minimalism
o system: do not save x/y widget coordinates on smaller screens
o system: fix CARP widget on invalid CARP configuration
o system: fix storing private key when creating a CSR
o system: update default dashboard layout and include the services widget
o system: render header for failed active widgets to allow identification and removal
o system: add ability for widget referral links
o system: cleaned up ACL definitions and use thereof
o system: add a picture widget
o system: default to vm.numa.disabled=1
o system: handle log lines with no timestamp (contributed by Iain MacDonnell)
o system: use interface maps in system_routing_configure() and dpinger_configure_do()
o system: when only selecting TLS1.3 ciphers make sure to only allow 1.3 as well in web GUI
o system: move web GUI restart to newwanip_map / plugins_argument_map() use
o system: due to observed timing issues avoid the use of closelog()
o system: do not render non-reachable dashboard widget links
o system: handle picture deletion via hidden input on general settings page
o system: straighten out API ACL entries for several components
o system: remove unreachable "page-getstats" ACL entry
o system: adjust "page-system-login-logout" ACL entry to be used as a minimal dashboard privilege
o system: deprecate the "page-dashboard-all" ACL entry as it will be removed in 25.1
o system: add descriptions on CA and certificate downloads file names
o system: show user icon when certificate is not otherwise used (in case CN matches any of our registered users)
o system: add proper validation when certificates are being imported via CSR
o system: add missing CRL changed event when CRLs are saved in the GUI
o system: add a trust settings page and move existing trust settings there as well
o system: optionally fetch and store CRLs attached to trusted authorities
o system: improve and extend certctl.py script doing the trust store rehashing
o system: enforce CRL behaviour for existing revocations in the trust store when doing remove syslog sending over TLS
o system: untrusted directory changed in FreeBSD 14
o system: add OpenSSH "RekeyLimit" with a limited set of choices
o system: improve context of changed/modified message in certctl.py
o reporting: start using cron for RRD collection
o reporting: remove nonexistent 3G statistics
o interfaces: rewrote GRE configuration using MVC/API
o interfaces: rewrote GIF configuration using MVC/API
o interfaces: temporary flush SLAAC addresses in DHCPv6 WAN mode to avoid using them primarily
o interfaces: add peer/peer6 options to CARP VIPs
o interfaces: allow to assign a prefix ID to WAN interface in DHCPv6 as well
o interfaces: allow to set manual interface ID in DHCPv6 and tracking modes
o interfaces: improve apply of the new peer/peer6 options to avoid unneeded reset
o interfaces: avoid deprecating SLAAC address for now
o interfaces: require PPP interface to be in up state (contributed by Nicolai Scheer)
o interfaces: lock down PPP modes when editing interfaces
o interfaces: backport required interface_ppps_capable()
o interfaces: retire interfaces_bring_up()
o interfaces: add "newwanip_map" event and deprecate old "newwanip" one
o interfaces: keep 24.7 backwards compatibility by allowing 6RD and 6to4 on PPP
o interfaces: add logging to PPP link scripts to check for overlap
o interfaces: return correct uppercase interface name in getArp()
o interfaces: fix issue with PPP port not being posted
o interfaces: force regeneration of link-local on spoofed MAC
o interfaces: add proper validation for 6RD and 6to4
o interfaces: add new "vpn_map" event to deprecate "vpn"
o interfaces: unify PPP linkup/linkdown scripting
o interfaces: replace "newwanip" from interface apply with "early"
o interfaces: move IPv6 over IPv4 connectivity to a separate script
o interfaces: port VXLAN to newwanip_map event
o interfaces: fix PPP regression of empty gateway default
o interfaces: move compatible event listeners to newwanip_map
o interfaces: decouple PPP configure/reset from IPv4/IPv6 modes
o interfaces: move legacy RFC2136 invoke to plugin hook
o interfaces: add "spoofmac" device option and enforce it
o interfaces: prevent CARP VIP removal when VHID group is in use by IP aliases
o interfaces: routing configuration on changed interfaces only during apply
o interfaces: simplify and clarify pfsync reconfiguration hooks
o interfaces: non-functional refactors in PPP configuration
o interfaces: send IPv6 solicit immediately on WAN interfaces
o firewall: performance improvements in alias handling
o firewall: refactor pftop output, move search to controller layer and implement cache for sessions page
o firewall: support streaming of filter logs for the new dashboard widget
o firewall: fix one-to-one NAT migration with external address without a subnet set
o firewall: fix parsing port alias names in /etc/services
o firewall: replace filter_(un)lock() with a FileObject lock
o firewall: add gateway groups to the list of gateways in automation rules
o captive portal: add "Allow inbound" option to select interfaces which may enter the zone
o captive portal: remove defunct transparent proxy settings
o captive portal: clean up the codebase
o captive portal: fix client disconnect (contributed by Vivek Panchal)
o dhcrelay: start on "newwanip_map" event as well
o dhcrelay: refactor for plugins_argument_map() use
o firmware: revoke old fingerprints
o firmware: remove inactive mirrors from the list
o firmware: introduce sanity checks prior to upgrades
o firmware: cleanup package manager temporary files prior to upgrades
o firmware: remove auto-retry from fetch invokes
o firmware: allow auto-configure patching via full URL
o firmware: automatically handle most plugin conflicts
o firmware: opnsense-update: support unescaped mirror input (contributed by Michael Gmelin)
o firmware: opnsense-verify: show repository priority while listing active repositories
o firmware: CRL checking for business update mirror
o intrusion detection: update the default suricata.yaml (contributed by Jim McKibben)
o intrusion detection: fix indent in suricata.yaml
o ipsec: prevent gateway when remote gateway family does not match selected protocol in legacy tunnel configuration
o ipsec: add aggregated traffic totals to phase 1 view
o ipsec: advanced settings MVC/API conversion
o ipsec: add retransmission settings in charon section in advanced settings
o ipsec: move two logging settings to correct location misplaced in previous version
o ipsec: fix migration and regression during handling of "disablevpnrules" setting
o ipsec: convert to vpn_map event invoke and plugins_argument_map() use
o ipsec: add "make_before_break" option to settings
o ipsec: fix advanced option "max_ikev1_exchanges"
o isc-dhcp: do not reload DNS services when editing static mappings to match behaviour with Kea
o kea-dhcp: ignore invalid hostnames in static mappings to prevent DNS services crashes
o kea-dhcp: add configurable "max-unacked-clients" parameter and change its default to 2
o kea-dhcp: add missing constraint on IP address for reservations
o monit: expose HTTPD username and password settings to GUI
o monit: fix undefined function error in CARP script
o network time: enable "restrict noquery" by default (contributed by doktornotor)
o openssh: convert to newwanip_map and rework the code
o openssh: port to plugins_argument_map()
o openvpn: optionally support DCO devices for instances
o openvpn: remove duplicate and irrelevant data for the client session in question
o openvpn: add "remote_cert_tls" option to instances
o openvpn: disable DCO permanently in legacy client/server configuration
o openvpn: use new trust model to link users by common_name in exporter
o openvpn: DCO mode only supports UDP on FreeBSD
o openvpn: unhide server fields for DCO instances
o openvpn: validate "Auth Token Lifetime" to require a non-zero renegotiate time in instances
o openvpn: convert to vpn_map event invoke and plugins_argument_map() use
o openvpn: fix "auth-gen-token" being supplied in server mode
o openvpn: register OpenVPN group immediately when setting up instances
o openvpn: push "data-ciphers-fallback" in client export when configured to align with legacy setup
o unbound: add discard-timeout (contributed by Nigel Jones)
o unbound: port to newwanip_map / plugins_interface_map()
o wireguard: support CARP VHID reuse on different interfaces
o wireguard: fix widget display with public key reuse
o wireguard: convert to vpn_map event invoke
o backend: add "cache_ttl" parameter to allow for generic caching of actions
o backend: run default action "configd actions" when none was specified
o backend: extended support for streaming actions
o backend: patch -6 address support into pluginctl
o backend: cache file cleanup when TTL is reached
o installer: update the ZFS install script to the latest FreeBSD 14.1 code
o installer: prefer ZFS over UFS in main menu selection
o mvc: replaced most of the Phalcon MVC use with a native band compatible implementation
o mvc: improve searchRecordsetBase() filtering capabilities
o mvc: remove obsolete getParams() usage in ApiControllerBase
o mvc: hook default index action in API handler
o mvc: fix API regression due to getParams() removal
o mvc: make Response->setContentType() second argument optional
o mvc: fix API endpoint sending data without giving the Response object the chance to flush its headers
o mvc: remove setJsonContent() and make sure Response->send() handles array types properly
o mvc: FileObject write() should sync by default
o mvc: when a hint is provided, also show them for selectpickers
o rc: export default ZPOOL_IMPORT_PATH
o rc: fix banner HTTPS fingerprint
o ui: assorted improvements for screen readers (contributed by Jason Fayre)
o ui: add "select all" to standard form selectors and remove dialog on "clear all" for tokenizers
o ui: lock save button while in progress to prevent duplicate input on Bootgrid
o ui: backport accessibility fix in Bootstrap
o ui: sidebar submenu expand fix (contributed by Team Rebellion)
o ui: refine cookie policies and make them explicit
o ui: remove bold text from tab headers for consistency
o plugins: add plugins_argument_map() helper
o plugins: os-OPNWAF 1.6 with multiple new features (see info in firmware plugins tab for details)
o plugins: os-acme-client 4.6[2]
o plugins: os-apcupsd 1.2[3]
o plugins: os-caddy 1.7.2[4]
o plugins: os-cpu-microcode-amd 1.0
o plugins: os-cpu-microcode-intel 1.0
o plugins: os-ddclient 1.24[5]
o plugins: os-dec-hw 1.1 replaces the dashboard widget
o plugins: os-etpro-telemetry 1.7 replaces dashboard widget
o plugins: os-freeradius 1.9.25[6]
o plugins: os-frr 1.41[7]
o plugins: os-helloworld 1.4
o plugins: os-intrusion-detection-content-snort-vrt 1.2 switch to newer ruleset snapshot (contributed by Jim McKibben)
o plugins: os-nginx 1.34[8]
o plugins: os-smart 2.3 adds new dashboard widget (contributed by Francisco Dimattia)
o plugins: os-theme-advanced 1.0 based on AdvancedTomato (contributed by Jaka Prašnikar)
o plugins: os-theme-cicada 1.38 (contributed by Team Rebellion)
o plugins: os-theme-rebellion 1.9.1 fixes more compatibility issues with new dashboard (contributed by Team Rebellion)
o plugins: os-theme-tukan 1.28 (contributed by Dr. Uwe Meyer-Gruhl)
o plugins: os-theme-vicuna 1.48 (contributed by Team Rebellion)
o plugins: os-udpbroadcastrelay API error fixes (contributed by Team Rebellion)
o plugins: os-upnp 1.6[9]
o plugins: os-wol 2.5 adds widget for new dashboard (contributed by Michał Brzeziński)
o src: FreeBSD 14.1-RELEASE[10]
o src: assorted backports from FreeBSD stable/14 branch
o src: ktrace(2) fails to detach when executing a setuid binary[11]
o src: NFS client accepts file names containing path separators[12]
o src: xen/netfront: Decouple XENNET tags from mbuf lifetimes
o src: dummynet: fix fq_pie traffic stall
o src: mcast: fix leaked igmp packets on multicast cleanup
o src: wg: change dhost to something other than a broadcast address (contributed by Sunny Valley Networks)
o src: axgbe: implement ifdi_i2c_req for diagnostics information
o src: if_clone: allow maxunit to be zero
o src: if_pflog: limit the maximum unit via the new KPI
o src: pf: vnet-ify pf_hashsize, pf_hashmask, pf_srchashsize and V_pf_srchashmask
o src: u3g: add SIERRA AC340U
o src: agp: Set the driver-specific field correctly
o src: cron(8) / periodic(8) session login[13]
o src: multiple vulnerabilities in libnv[14]
o src: bhyve(8) privileged guest escape via TPM device passthrough[15]
o src: multiple issues in ctl(4) CAM target layer[16]
o src: bhyve(8) privileged guest escape via USB controller[17]
o src: possible DoS in X.509 name checks in OpenSSL[18]
o src: umtx kernel panic or use-after-free[19]
o src: revert "ixl: fix multicast filters handling"[20]
o src: bhyve: improve input validation in pci_xhci[21]
o src: libnv: correct the calculation of the size of the structure[22]
o src: ifnet: Remove if_getamcount()
o src: ifnet: Add handling for toggling IFF_ALLMULTI in ifhwioctl()
o src: ifconfig: Add an allmulti verb
o src: date: include old and new time in audit log
o src: bpf: Add IfAPI analogue for bpf_peers_present()
o src: pf: use AF_INET6 when comparing IPv6 addresses
o src: if_ovpn: ensure it is safe to modify the mbuf
o src: if_ovpn: declare our dependency on the crypto module
o src: pf: revert part of 39282ef3 to properly log the drop due to state limits
o src: pflog: pass the action to pflog directly
o src: various check removals for malloc(M_WAITOK) driver calls
o src: libpfctl: ensure we return useful error codes
o src: x86/ucode: add support for early loading of CPU ucode on AMD
o src: libfetch: improve optional CRL verification
o src: fetch: fix "--crl" option not working
o ports: curl 8.10.1[23]
o ports: dhcp6c 20241008
o ports: dhcrelay 1.0[24]
o ports: dnspython 2.7.0
o ports: expat 2.6.3[25]
o ports: hostapd 2.11[26]
o ports: kea 2.6.1[27]
o ports: libpfctl 0.13
o ports: libxml 2.11.9[28]
o ports: monit 5.34.1[29]
o ports: nss 3.104[30]
o ports: openvpn 2.6.12[31]
o ports: phalcon 5.8.0[32]
o ports: php 8.2.24[33]
o ports: phpseclib 3.0.41[34]
o ports: pkg fix for for embedded libfetch when doing CRL verification
o ports: py-duckdb 1.1.1[35]
o ports: python 3.11.10[36]
o ports: rrdtool 1.9.0[37]
o ports: sqlite 3.46.1[38]
o ports: sudo 1.9.16[39]
o ports: suricata 7.0.7[40]
o ports: syslog-ng 4.8.0[41]
o ports: unbound 1.21.1[42]
o ports: wpa_supplicant 2.11[43]

Migration notes, known issues and limitations:

o The dashboard has been replaced. Widgets from the old format are no longer supported and need to be rewritten by the respective authors.
o ISC DHCP will no longer reload DNS services on static mapping edits. This is for feature parity with Kea DHCP and avoiding cross-service complications. If you expect your static mappings to show up in a particular DNS service please restart this service manually.

The public key for the 24.10 series is:

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAunCgLymz7ichjk+uZ4pR
XwFX8FxG0KFBf4f6kCfQ+wNF9KTFBELzGg2tXPUmrJD/DzcMqQExP3WyTg0Z96ZW
HofN2AbOCG84PpNlsKXpaUtm9Ow8kiYh7tn26eX7FaOEPtpJkMiwUymbCJJaPE0O
smQbWGnJTvF8LTmuviPoiMrPv1cJ0kEyJvjDD0yMw1HrIgwPOazGmTQiuM3LoLOK
F0KWf2p40c77QDOuGC7AIobQgDkZTabfU7PQUn6gDiKARYCst7y2xX3OQ7foXCJW
nDDypfbfHixv77mVAeIED0h9ZsQaIHskL2dqqRbFHiY+OHjQTCAJP1Ptm/HGSCdj
GOjpuD4WXvxru8AgcOCh6GpqO4IbByIHXu+67Ur3UBlxsp4x44lxBWXQzeemVhaS
ZAmkJNemw51oRDTxYtpR7TF3OlgLAQBOB/0tqHmkbSBouQ6PK7HYzNglu9LStxo1
uxgMss5q8GoZCkWKvRDz87YceeC75l0aWOVnkOMmC5Lf+fFMJp6TF7BzCi3ZC7CD
DQchBlE2F98D3E7KiI4vGrLUj3qKwfwV41JSQ8OtwOV+KFGOmyHeNassTQHm1Mdn
reTzHeusqUdAL7+pXH1XNwoFSZo7A6RoZzTzb0p7WYbKU9SV39DPytsYES7FsyY8
l7+AsM+sBOY1ngeB/twBzyUCAwEAAQ==
-----END PUBLIC KEY-----


Stay safe,
Your OPNsense team

--
[1] https://docs.opnsense.org/manual/install.html
[2] https://github.com/opnsense/plugins/blob/stable/24.7/security/acme-client/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/24.7/sysutils/apcupsd/pkg-descr
[4] https://github.com/opnsense/plugins/blob/stable/24.7/www/caddy/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/24.7/dns/ddclient/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/24.7/net/freeradius/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/24.7/net/frr/pkg-descr
[8] https://github.com/opnsense/plugins/blob/stable/24.7/www/nginx/pkg-descr
[9] https://github.com/opnsense/plugins/blob/stable/24.7/net/upnp/pkg-descr
[10] https://www.freebsd.org/releases/14.1R/relnotes/
[11] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:06.ktrace.asc
[12] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:07.nfsclient.asc
[13] https://www.freebsd.org/security/advisories/FreeBSD-EN-24:15.calendar.asc
[14] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:09.libnv.asc
[15] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:10.bhyve.asc
[16] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:11.ctl.asc
[17] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:12.bhyve.asc
[18] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:13.openssl.asc
[19] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:14.umtx.asc
[20] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281125
[21] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:15.bhyve.asc
[22] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:16.libnv.asc
[23] https://curl.se/changes.html#8_10_1
[24] https://github.com/opnsense/dhcrelay/issues/2
[25] https://github.com/libexpat/libexpat/blob/R_2_6_3/expat/Changes
[26] https://w1.fi/cgit/hostap/plain/hostapd/ChangeLog
[27] https://downloads.isc.org/isc/kea/2.6.1/Kea-2.6.1-ReleaseNotes.txt
[28] https://gitlab.gnome.org/GNOME/libxml2/-/blob/master/NEWS
[29] https://mmonit.com/monit/changes/
[30] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_104.html
[31] https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn26#Changesin2.6.12
[32] https://github.com/phalcon/cphalcon/releases/tag/v5.8.0
[33] https://www.php.net/ChangeLog-8.php#8.2.24
[34] https://github.com/phpseclib/phpseclib/releases/tag/3.0.41
[35] https://github.com/duckdb/duckdb/releases/tag/v1.1.1
[36] https://docs.python.org/release/3.11.10/whatsnew/changelog.html
[37] https://github.com/oetiker/rrdtool-1.x/releases/tag/v1.9.0
[38] https://sqlite.org/releaselog/3_46_1.html
[39] https://www.sudo.ws/stable.html#1.9.16
[40] https://suricata.io/2024/10/01/suricata-7-0-7-released/
[41] https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.8.0
[42] https://nlnetlabs.nl/projects/unbound/download/#unbound-1-21-1
[43] https://w1.fi/cgit/hostap/plain/wpa_supplicant/ChangeLog

SHA256 (OPNsense-business-24.10-dvd-amd64.iso.bz2) = 0316ee09336945462b26bc40f8ac65ca7cf4cf0ca1a3f584170a4d1a06e3e82f
SHA256 (OPNsense-business-24.10-nano-amd64.img.bz2) = 16a06aa22fe3913b2f1e707b726a32d92d805e160bd7f42f42af8f7845684af6
SHA256 (OPNsense-business-24.10-serial-amd64.img.bz2) = 19f57cc5f0d4190f6c0cf2ff1d3ed5e170929352ab58db92f2b1714be485b4b6
SHA256 (OPNsense-business-24.10-vga-amd64.img.bz2) = 8afb164cbd9c4b7f8032377bdfd0161c40b9fea74f40e40a156aff594f1a6897

7

Announcements / OPNsense 24.7.6 released

« on: October 09, 2024, 04:05:17 pm »

Hello there!

A few security and reliability issues this week.  Most notably Suricata
and Unbound.  The dashboard rework seems to be concluded now as the
ACL behaviour was now aligned and should match the user expectation on
the "Lobby" section privileges.  Note not all widgets have separate
ACLs as it aims to provide a minimal safe selection of system widgets
associated with the access to the dashboard page in general.

We will, however, continue to improve the dashboard further while we
also tackle other interesting areas for 25.1.  That being said have
a look at the new roadmap[1] we published recently.

You may notice the increased activity on the trust store side due to
our LINCE certification efforts.  Valuable feedback and code changes
have come from this process that will also find their way into other
related projects in the near future.

Here are the full patch notes:

o system: do not render non-reachable dashboard widget links
o system: handle picture deletion via hidden input on general settings page
o system: straighten out API ACL entries for several components
o system: remove unreachable "page-getstats" ACL entry
o system: adjust "page-system-login-logout" ACL entry to be used as a minimal dashboard privilege
o system: deprecate the "page-dashboard-all" ACL entry as it will be removed in 25.1
o system: add descriptions on CA and certificate downloads file names
o system: show user icon when certificate is not otherwise used (in case CN matches any of our registered users)
o system: add proper validation when certificates are being imported via CSR
o system: add missing CRL changed event when CRLs are saved in the GUI
o system: add a trust settings page and move existing trust settings there as well
o system: optionally fetch and store CRLs attached to trusted authorities
o system: improve and extend certctl.py script doing the trust store rehashing
o system: enforce CRL behaviour for existing revocations in the trust store when doing remove syslog sending over TLS
o interfaces: simplify and clarify pfsync reconfiguration hooks
o interfaces: non-functional refactors in PPP configuration
o interfaces: send IPv6 solicit immediately on WAN interfaces
o firewall: add gateway groups to the list of gateways in automation rules
o src: pf: revert part of 39282ef3 to properly log the drop due to state limits
o src: pflog: pass the action to pflog directly
o src: various check removals for malloc(M_WAITOK) driver calls
o src: libpfctl: ensure we return useful error codes
o src: x86/ucode: add support for early loading of CPU ucode on AMD
o src: libfetch: improve optional CRL verification
o src: fetch: fix "--crl" option not working
o dhcrelay: refactor for plugins_argument_map() use
o firmware: opnsense-verify now lists repository priorities
o ipsec: add "make_before_break" option to settings
o firmware: opnsense-verify now also lists repository priorities
o kea-dhcp: add configurable "max-unacked-clients" parameter and change its default to 2
o kea-dhcp: add missing constraint on IP address for reservations
o openvpn: register OpenVPN group immediately when setting up instances
o openvpn: push "data-ciphers-fallback" in client export when configured to align with legacy setup
o unbound: port to newwanip_map / plugins_interface_map()
o ui: remove bold text from tab headers for consistency
o plugins: os-acme-client 4.6[2]
o plugins: os-caddy 1.7.2[3]
o plugins: os-frr 1.41[4]
o plugins: os-smart 2.3 adds new dashboard widget (contributed by Francisco Dimattia)
o ports: curl 8.10.1[5]
o ports: crowdsec fix for stuck service handling[6]
o ports: dhcp6c 20241008 properly handle NoAddrAvail status code
o ports: monit 5.34.1[7]
o ports: php 8.2.24[8]
o ports: dnspython 2.7.0
o ports: py-duckdb 1.1.1[9]
o ports: suricata 7.0.7[10]
o ports: unbound 1.21.1[11]


Stay safe,
Your OPNsense team

--
[1] https://opnsense.org/about/road-map/
[2] https://github.com/opnsense/plugins/blob/stable/24.7/security/acme-client/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/24.7/www/caddy/pkg-descr
[4] https://github.com/opnsense/plugins/blob/stable/24.7/net/frr/pkg-descr
[5] https://curl.se/changes.html#8_10_1
[6] https://discourse.crowdsec.net/t/bug-opnsense-24-7-5-crowdsec-1-6-3/2057
[7] https://mmonit.com/monit/changes/
[8] https://www.php.net/ChangeLog-8.php#8.2.24
[9] https://github.com/duckdb/duckdb/releases/tag/v1.1.1
[10] https://suricata.io/2024/10/01/suricata-7-0-7-released/
[11] https://nlnetlabs.nl/projects/unbound/download/#unbound-1-21-1

8

Announcements / OPNsense 24.7.5 released

« on: September 26, 2024, 12:42:07 pm »

A good day to you all,

This release removes significant processing overhead from larger setups
due to being able to coalesce parallel configuration requests for the same
component instead of iterating over the list of selected interfaces one
by one.  A number of third party software updates and FreeBSD security
advisories are included as well.

This update also disables NUMA by default which can bring a boost in
network throughput on affected systems.  And of course we are still
working on dashboard improvements so now the treasured picture widget
is back with a better integration approach.

Also take note that the NTP default changes to "restrict noquery" so that
the system cannot externally be queried for revealing system internals
anymore unless explicitly allowed.

The technical stuff out of the way we would simply like to add that we
had a great time at EuroBSDCon in Dublin over the weekend.  Lots of good
and productive conversations.  Looking forward to more of those!  :)

Here are the full patch notes:

o system: update default dashboard layout and include the services widget
o system: render header for failed active widgets to allow identification and removal
o system: add ability for widget referral links
o system: cleaned up ACL definitions and use thereof
o system: add a picture widget
o system: default to vm.numa.disabled=1
o system: handle log lines with no timestamp (contributed by Iain MacDonnell)
o system: use interface maps in system_routing_configure() and dpinger_configure_do()
o system: when only selecting TLS1.3 ciphers make sure to only allow 1.3 as well in web GUI
o system: move web GUI restart to newwanip_map / plugins_argument_map() use
o interfaces: move compatible event listeners to newwanip_map
o interfaces: decouple PPP configure/reset from IPv4/IPv6 modes
o interfaces: move legacy RFC2136 invoke to plugin hook
o interfaces: add "spoofmac" device option and enforce it
o interfaces: prevent CARP VIP removal when VHID group is in use by IP aliases
o interfaces: routing configuration on changed interfaces only during apply
o firmware: opnsense-update: support unescaped mirror input (contributed by Michael Gmelin)
o firmware: opnsense-verify: show repository priority while listing active repositories
o ipsec: convert to vpn_map event invoke and plugins_argument_map() use
o monit: fix undefined function error in CARP script
o network time: enable "restrict noquery" by default (contributed by doktornotor)
o openssh: port to plugins_argument_map()
o openvpn: validate "Auth Token Lifetime" to require a non-zero renegotiate time in instances
o openvpn: convert to vpn_map event invoke and plugins_argument_map() use
o wireguard: convert to vpn_map event invoke
o ui: refine cookie policies and make them explicit
o plugins: add plugins_argument_map() helper
o plugins: os-caddy 1.7.1[1]
o src: bhyve: improve input validation in pci_xhci[2]
o src: libnv: correct the calculation of the size of the structure[3]
o src: ifnet: Remove if_getamcount()
o src: ifnet: Add handling for toggling IFF_ALLMULTI in ifhwioctl()
o src: ifconfig: Add an allmulti verb
o src: date: include old and new time in audit log
o src: bpf: Add IfAPI analogue for bpf_peers_present()
o src: pf: use AF_INET6 when comparing IPv6 addresses
o src: if_ovpn: ensure it is safe to modify the mbuf
o src: if_ovpn: declare our dependency on the crypto module
o ports: curl 8.10.0[4]
o ports: dhcp6c 20240919 reintroduced fixed arc4random() usage
o ports: expat 2.6.3[5]
o ports: libpfctl 0.13
o ports: libxml 2.11.9[6]
o ports: nss 3.104[7]
o ports: python 3.11.10[8]
o ports: sudo 1.9.16[9]


Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/24.7/www/caddy/pkg-descr
[2] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:15.bhyve.asc
[3] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:16.libnv.asc
[4] https://curl.se/changes.html#8_10_0
[5] https://github.com/libexpat/libexpat/blob/R_2_6_3/expat/Changes
[6] https://gitlab.gnome.org/GNOME/libxml2/-/blob/master/NEWS
[7] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_104.html
[8] https://docs.python.org/release/3.11.10/whatsnew/changelog.html
[9] https://www.sudo.ws/stable.html#1.9.16

9

Announcements / OPNsense 24.4.3 business edition released

« on: September 17, 2024, 01:30:58 pm »

This business release is based on the OPNsense 24.4.2 business version
with additional reliability improvements.

Here are the full patch notes:

o system: add snapshots (boot environments) support via MVC/API (contributed by Sheridan Computers)
o system: recover stuck monitors and offer a cron job
o isc-dhcp: allow to disable a DHCPv6 server with faulty settings
o openvpn: add close-on-exec flag to service lock file
o openvpn: add username field to the status page
o wireguard: add close-on-exec flag to service lock file
o mvc: improve container field cloning
o ui: allow style tag on headers
o ports: openssl 3.0.15[1]


Stay safe,
Your OPNsense team

--
[1] https://github.com/openssl/openssl/blob/openssl-3.0/CHANGES.md

10

Announcements / OPNsense 24.7.4 released

« on: September 12, 2024, 02:24:45 pm »

Hey,

Since we are currently having a vivid discussion about what constitutes
a downstream or upstream issue in the FreeBSD scope we will revert the
FreeBSD-SA-24:05.pf advisory until further notice.  As confirmed by many
users this brings ICMPv6 and therefore IPv6 back to an uneventful stable
state.  We will be trying to work with FreeBSD on the issue as it seems
unavoidable that we meet it again when working on FreeBSD 14.2 inclusion.

In other IPv6 news we found a strange regression in dhcp6c introduced in
24.7.2 and reverted the offending commits for now.  What this tells us,
though, is that we did uncover an inherent issue with the timeout value
generation that may be present since two decades in the code at least.

Apart from smaller fixes for the dashboard, trust pages, this update
also ships the first backwards-compatible PPP rework patch.  The ultimate
goal here is to offer IPv6-only connectivity which requires untangling
old code to be IP family agnostic.  Should you note any change in behaviour
please do not hesitate to contact us.

BTW, the roadmap for 25.1 has been decided and will be published soon.

Here are the full patch notes:

o system: recover stuck monitors and offer a cron job
o system: use built-in controller logic for JSON decoding on dashboard
o system: map derivative field cert_type to expose purpose to the UI
o system: handle stale "pfsyncinterfaces" and improve workflow
o system: tweak the boot detection for code minimalism
o system: do not save x/y widget coordinates on smaller screens
o system: fix CARP widget on invalid CARP configuration
o system: fix storing private key when creating a CSR
o reporting: remove nonexistent 3G statistics
o interfaces: force regeneration of link-local on spoofed MAC
o interfaces: add proper validation for 6RD and 6to4
o interfaces: add new "vpn_map" event to deprecate "vpn"
o interfaces: unify PPP linkup/linkdown scripting
o interfaces: replace "newwanip" from interface apply with "early"
o interfaces: move IPv6 over IPv4 connectivity to a separate script
o interfaces: port VXLAN to newwanip_map event
o firewall: replace filter_(un)lock() with a FileObject lock
o isc-dhcp: allow to disable a DHCPv6 server with faulty settings
o firmware: remove auto-retry from fetch invokes
o firmware: allow auto-configure patching via full URL
o firmware: automatically handle most plugin conflicts
o openssh: convert to newwanip_map and rework the code
o openvpn: add username field to the status page
o openvpn: add close-on-exec flag to service lock file
o unbound: add discard-timeout (contributed by Nigel Jones)
o wireguard: fix widget display with public key reuse
o wireguard: add close-on-exec flag to service lock file
o ui: allow style tag on headers
o plugins: os-helloworld 1.4
o plugins: os-caddy 1.7.0[1]
o src: revert FreeBSD-SA-24:05.pf until further notice to restore proper IPv6 behaviour[2]
o src: agp: Set the driver-specific field correctly
o src: cron(8) / periodic(8) session login[3]
o src: multiple vulnerabilities in libnv[4]
o src: bhyve(8) privileged guest escape via TPM device passthrough[5]
o src: multiple issues in ctl(4) CAM target layer[6]
o src: bhyve(8) privileged guest escape via USB controller[7]
o src: possible DoS in X.509 name checks in OpenSSL[8]
o src: umtx kernel panic or use-after-free[9]
o src: revert "ixl: fix multicast filters handling"[10]
o ports: dhcp6c 20240907 for now reverts instability regression in random number handling
o ports: openssl 3.0.15[11]
o ports: php 8.2.23[12]


Stay safe and take a snapshot,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/24.7/www/caddy/pkg-descr
[2] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280701
[3] https://www.freebsd.org/security/advisories/FreeBSD-EN-24:15.calendar.asc
[4] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:09.libnv.asc
[5] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:10.bhyve.asc
[6] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:11.ctl.asc
[7] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:12.bhyve.asc
[8] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:13.openssl.asc
[9] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:14.umtx.asc
[10] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281125
[11] https://github.com/openssl/openssl/blob/openssl-3.0/CHANGES.md
[12] https://www.php.net/ChangeLog-8.php#8.2.23

11

Announcements / OPNsense 24.7.3 released

« on: August 29, 2024, 01:58:04 pm »

Dear all,

Today we are switching pf stateful tracking of ICMPv6 neighbour discoveries
off in order to fix the previous instability with the FreeBSD security
advisory first shipped in 24.7.1.  We do this in order to provide the same
reliable IPv6 functionality that was on all previous versions prior to
24.7.1 at the cost of resurfacing CVE-2024-6640 until a better solution
has been devised.  A link to the long and difficult upstream bug report is
included below.

But that is not all.  The GUI gains snapshot support on ZFS installations by
implementing what is called "boot environments" which allows one to move
seamlessly from one snapshot to another via reboot.  This functionality can
also be accessed from the boot loader menu option "8" for a quick recovery
ensuring that at least one other snapshot was created to boot into.  A very
special thank you to Sheridan Computers for contributing this feature.

Here are the full patch notes:

o system: add snapshots (boot environments) support via MVC/API (contributed by Sheridan Computers)
o system: remove obsolete dashboard sync
o system: compact services widget on dashboard
o system: convert lock mode to edit mode on dashboard
o system: link certificates by subject on import
o system: unify how log search clauses work and add a search time constraint
o system: move to static imports for widget base classes on dashboard
o system: fix ACL check on dashboard restore and add safety check for save action
o system: change dashboard modify buttons to a bootstrap group (contributed by Jaka Prašnikar)
o interfaces: add "newwanip_map" event and deprecate old "newwanip" one
o interfaces: keep 24.7 backwards compatibility by allowing 6RD and 6to4 on PPP
o interfaces: add logging to PPP link scripts to check for overlap
o interfaces: return correct uppercase interface name in getArp()
o interfaces: fix issue with PPP port not being posted
o dhcrelay: start on "newwanip_map" event as well
o intrusion detection: update the default suricata.yaml (contributed by Jim McKibben)
o ipsec: move two logging settings to correct location misplaced in previous version
o ipsec: fix migration and regression during handling of "disablevpnrules" setting
o wireguard: support CARP VHID reuse on different interfaces
o mvc: when a hint is provided, also show them for selectpickers
o rc: fix banner HTTPS fingerprint
o plugins: os-ddclient 1.24[1]
o plugins: os-theme-advanced 1.0 based on AdvancedTomato (contributed by Jaka Prašnikar)
o plugins: os-theme-cicada 1.38 (contributed by Team Rebellion)
o plugins: os-theme-vicuna 1.48 (contributed by Team Rebellion)
o plugins: os-upnp 1.6[2]
o plugins: os-wol 2.5 adds widget for new dashboard (contributed by Michał Brzeziński)
o src: pf: fully annotated patch of disabling ND state tracking and issues for ICMPv6[3]
o src: u3g: add SIERRA AC340U
o ports: dhcrelay 1.0 switches to official release numbering, but otherwise equal to 0.6
o ports: sqlite 3.46.1[4]


Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/24.7/dns/ddclient/pkg-descr
[2] https://github.com/opnsense/plugins/blob/stable/24.7/net/upnp/pkg-descr
[3] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280701
[4] https://sqlite.org/releaselog/3_46_1.html

12

Announcements / OPNsense 24.7.2 released

« on: August 21, 2024, 02:28:40 pm »

Howdy,

Today a follow-up for the FreeBSD security advisory for pf/ICMP
ships that addresses the undesired traceroute behaviour.  A few
dashboard improvements are included as well as better IPv6 recovery
for dhcp6c and assorted stability fixes.

As a special note we now have native CPU microcode update plugins
for either AMD or Intel to install from the GUI.  Apart from a reboot
these plugins require no further user interaction and will keep the
applicable microcode at the latest known version as shipped in the
packages repository.

We are currently working on making PPP capable of running in
IPv6-only deployments; additionally ZFS snapshots (a.k.a boot environments)
are coming to the next stable release and can already be previewed in
the bundled development version.

Last but not least, an "importmap" free dashboard version is also
ready for testing in the development release.  We hereby ask for
feedback so that it can be included in a subsequent stable release.

Here are the full patch notes:

o system: CRL import ignored text input and triggered unrelated validations
o system: improve the locking during web GUI restart
o system: improve WireGuard and IPsec widgets
o system: add CPU widget graph selection
o system: reformat traffic graphs to bps
o system: add gateway widget item selection
o system: add table view to interface statistics widget on expansion
o system: improve widget error recovery
o system: fix wrong variable assignment in system log search backend
o system: add missing delAction() for proper CRL removal
o interfaces: require PPP interface to be in up state (contributed by Nicolai Scheer)
o interfaces: lock down PPP modes when editing interfaces
o interfaces: backport required interface_ppps_capable()
o interfaces: retire interfaces_bring_up()
o reporting: start using cron for RRD collection
o firmware: remove inactive mirrors from the list
o firmware: introduce sanity checks prior to upgrades
o firmware: cleanup package manager temporary files prior to upgrades
o kea-dhcp: fix privileges for page ACL
o ipsec: advanced settings MVC/API conversion
o ipsec: add retransmission settings in charon section in advanced settings
o openvpn: unhide server fields for DCO instances
o mvc: remove setJsonContent() and make sure Response->send() handles array types properly
o mvc: FileObject write() should sync by default
o rc: export default ZPOOL_IMPORT_PATH
o ui: sidebar submenu expand fix (contributed by Team Rebellion)
o plugins: os-caddy 1.6.3[1]
o plugins: os-cpu-microcode-amd 1.0
o plugins: os-cpu-microcode-intel 1.0
o plugins: os-freeradius 1.9.25[2]
o plugins: os-intrusion-detection-content-snort-vrt 1.2 switch to newer ruleset snapshot (contributed by Jim McKibben)
o plugins: os-theme-tukan 1.28 (contributed by Dr. Uwe Meyer-Gruhl)
o src: axgbe: implement ifdi_i2c_req for diagnostics information
o src: if_clone: allow maxunit to be zero
o src: if_pflog: limit the maximum unit via the new KPI
o src: pf: invert direction for inner icmp state lookups
o src: pf: fix icmp-in-icmp state lookup
o src: pf: vnet-ify pf_hashsize, pf_hashmask, pf_srchashsize and V_pf_srchashmask
o ports: dhcp6c 20240820 fixes two renewal edge cases
o ports: nss 3.103[3]
o ports: phpseclib 3.0.41[4]
o ports: unbound 1.21.0[5]


Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/24.7/www/caddy/pkg-descr
[2] https://github.com/opnsense/plugins/blob/stable/24.7/net/freeradius/pkg-descr
[3] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_103.html
[4] https://github.com/phpseclib/phpseclib/releases/tag/3.0.41
[5] https://nlnetlabs.nl/projects/unbound/download/#unbound-1-21-0

13

Announcements / OPNsense 24.4.2 business edition released

« on: August 16, 2024, 10:53:33 am »

This business release is based on the OPNsense 24.1.10 community version
with additional reliability improvements.

Here are the full patch notes:

o system: add pluginctl -x/-X modes for digesting XMLRPC options
o system: replace rand() with random_int() in remote backup script
o system: skip tentative IPv6 addresses for binding in the web GUI (contributed by tionu)
o firewall: migrate one-to-one NAT to MVC/API
o firewall: show inspect button on "xs" size screen
o interfaces: make SLAAC flush a feature of ifctl for incoming reuse
o interfaces: move SLAAC tunables to system requirements
o interfaces: disable IPv6 interface modes when IPv6 is disabled globally
o interfaces: avoid pluginctl giving out IPv4 info for non-interfaces
o interfaces: improve DHCPv6 requirement rules on WAN interface
o interfaces: support reading more attributes in ifconfig output parser
o interfaces: correct logic of resolve flag in ARP table (contributed by Kevin Pelzel)
o reporting: add NetFlow IPv6 support for destinations
o dhcrelay: add logging into its own space
o firmware: prefer ZFS over UFS in upgrade message
o firmware: remove unneeded Unbound DNS database upgrade script
o firmware: remove stale Squid plugin upgrade script
o isc-dhcp: allow root domain input as "." (contributed by Skyler Mantysaari)
o kea-dhcp: support static DNS mappings (contributed by Markus Reiter)
o kea-dhcp: add description field to subnets
o kea-dhcp: add next-server option to subnets (contributed by Harm Kroon)
o kea-dhcp: fix privileges for page ACL
o openvpn: add "float" option to instances (contributed by Christian Kohlstedde)
o mvc: refactored and improved checkAndThrowSafeDelete() as checkAndThrowValueInUse()
o ui: remove aria-hidden from dialogs (contributed by Jason Fayre)
o plugins: os-OPNcentral 1.10
o plugins: os-OPNWAF 1.5
o plugins: os-bind 1.32[1]
o plugins: os-caddy 1.6.0[2]
o plugins: os-ddclient 1.22[3]
o plugins: os-nginx 1.33[4]
o plugins: os-theme-cicada 1.36 (contributed by Team Rebellion)
o plugins: os-theme-vicuna 1.46 (contributed by Team Rebellion)
o plugins: os-zabbix-agent 1.14[5]
o plugins: os-zabbix-proxy 1.11[6]
o ports: curl 8.8.0[7]
o ports: dhcp6c 20240710 additions for WAN tracking, interface ID specification, etc.
o ports: openldap 2.6.8[8]
o ports: php 8.2.20[9]
o ports: py-duckdb 1.0.0[10]
o ports: py-netaddr 1.3.0[11]
o ports: sqlite 3.46.0[12]


Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/24.1/dns/bind/pkg-descr
[2] https://github.com/opnsense/plugins/blob/stable/24.1/www/caddy/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/24.1/dns/ddclient/pkg-descr
[4] https://github.com/opnsense/plugins/blob/stable/24.1/www/nginx/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/24.1/net-mgmt/zabbix-agent/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/24.1/net-mgmt/zabbix-proxy/pkg-descr
[7] https://curl.se/changes.html#8_8_0
[8] https://www.openldap.org/software/release/changes.html
[9] https://www.php.net/ChangeLog-8.php#8.2.20
[10] https://github.com/duckdb/duckdb/releases/tag/v1.0.0
[11] https://netaddr.readthedocs.io/en/latest/changes.html#release-1-3-0
[12] https://sqlite.org/releaselog/3_46_0.html

14

Announcements / Cedrik Pischem joins Deciso

« on: August 09, 2024, 04:08:03 pm »

We are delighted to announce that Cedrik Pischem has joined Deciso B.V. to work on OPNsense full-time.

Cedrik is better known to users as "Monviech". He is the author of the Caddy plugin and has helped numerous people in the forum using OPNsense. We value his dedication, ideas for the project and already enjoy working with him.

Cedrik's main focus will be on support and development of OPNsense and its commercial offerings.

Growing the team helps us expanding OPNsense even more than we already did and reach more and more people around the globe. Let's go make OPNsense even better.


Stay safe,
OPNsense / Deciso

15

24.7 Production Series / [CALL FOR TESTING] PPPoE restructuring and IPv6 improvements

« on: August 09, 2024, 09:11:31 am »

Hi,

Due to a user prompt we're going to restructure PPP for the next major release 25.1 in order to be able to allow IPv6-only deployments including using DHCPv6 which isn't possible at all at the moment.

A POC already exists and appears to work, but I'd like to take this a bit further due to related issues such as the infamous "Use IPv4 connectivity" setting. The idea here is to remove it and make it the default, because

(a) everyone including developers have trouble wrapping their head around the concept,
(b) when in reality the opt-in setting is really the default behaviour of PPP-based setups to begin with,
(c) and to achieve running DHCPv6 on the hardware interface beneath PPP simply assign the hardware interface and set it to DHCPv6.

The goal is to finish this change on the development version coming with 24.7.2 for general consumption, but it would be very beneficial to merge backwards-compatible changes to 24.7.x without removing "Use IPv4 connectivity" usage as this progresses and matures. The final code change for 25.1 will then be much smaller and easier to review.

And this is where the call for testing takes off at the moment for everyone running 24.7.1:

https://github.com/opnsense/core/commit/3a9f98843b

# opnsense-patch 3a9f98843b

If you have an PPP(oE) deployment with or without IPv6 try this patch and see if it works like before. I'd like to know of behavioural changes or drop in IPv6 connectivity if previously working so we can refine this together, add it to a 24.7.x release and work on the next batch.


Thanks,
Franco