Topics

286

Announcements / OPNsense 16.7.8 released

« on: November 16, 2016, 11:56:57 am »

Ladies and gentlemen!

Today we present to you the latest stable iteration of the 16.7 series focusing on improved reliability and security in all areas and major feature upgrades.

Big news this week are the inclusion of two new fully-featured plugins for Tinc VPN and FTP proxying, the latter being kindly sponsored by EURO-LOG AG[1]. Together with the community we are continuing the trend towards a comprehensive plugins environment based on top of our distinctive MVC GUI framework, with more plugins already in direct development.

Speaking of such, the MVC framework received fine-grained versioning and constraint support as well as a completely revamped API error handling and plugin-compatible authentication handling.

Last but not least, enclosed within are third-party software updates, most importantly the latest versions of LibreSSL, Bind, Sudo, OpenVPN, Suricata, PHP and Curl.

A reboot is not strictly necessary, but recommended.

There are the full patch notes:

o system: trigger xmlrpc sync before service action
o system: header redirection security through url_safe()
o system: "work in progress" indicator for service controls
o system: always restart apinger to fix configuration apply
o system: use Etc/UTC when timezone was removed from tzdata
o system: fix infinite console menu loop on tty close (contributed by Stephane Lesimple)
o system: SSH launcher rework
o firmware: only do console update reboot when update went ok
o firmware: improved usefulness of several GUI status messages
o firmware: allow inline use of opnsense-update -t
o firmware: allow to resolve ABI using opnsense-verify -a
o interfaces: set txcsum6 and rxcsum6 like their IPv4 counterparts
o firewall: traffic shaper address lists and inversion support
o firewall: revamped bogons download and verification
o firewall: properly set NAT reflection helper for IPv6
o firewall: allow pluggable rules anchors
o captive portal: increase the database timeout to 30 seconds
o captive portal: allow custom values for voucher validity and quantity
o captive portal: fix spurious error on successful login
o dynamic dns: fix race in page, reminiscent of previous widget correction
o dynamic dns: log r53 errors to system log file
o intrusion detection: fix ET open ruleset content
o openvpn: missing p2p shared key settings for local subnets
o universal plug and play: prepare for move into plugins
o mvc: implemented model constraints and migrations
o mvc: improved error reporting of API failures (contributed by Per von Zweigbergk)
o mvc: add spinner for row toggle (contributed by Frank Brendel)
o mvc: pluggable authentication framework
o mvc: added update-only field type
o plugins: first release of FTP Proxy (contributed by Frank Brendel)
o plugins: first release of Tinc VPN
o ports: pkg 1.9.3[2][3][4][5]
o ports: bind 9.10.4P4[6]
o ports: curl 7.51.0[7]
o ports: libressl 2.4.4[8]
o ports: lighttd 1.4.43[9]
o ports: openvpn 2.3.13[10]
o ports: pecl-radius 1.4.0b1[11]
o ports: php 5.6.28[12]
o ports: sudo 1.8.18p1[13]
o ports: suricata 3.1.3[14]


Stay safe,
Your OPNsense team

--
[1] http://www.eurolog.com/
[2] https://github.com/freebsd/freebsd-ports/commit/4d1a48fbd7
[3] https://github.com/freebsd/freebsd-ports/commit/b8c8b82a0
[4] https://github.com/freebsd/freebsd-ports/commit/5a3fa5bbce
[5] https://github.com/freebsd/freebsd-ports/commit/d2104b2c85
[6] https://kb.isc.org/article/AA-01435/81/BIND-9.10.4-P4-Release-Notes.html
[7] https://curl.haxx.se/changes.html
[8] https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.4.4-relnotes.txt
[9] https://www.lighttpd.net/2016/10/31/1.4.43/
[10] https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.13
[11] https://pecl.php.net/package-changelog.php?package=radius&release=1.4.0b1
[12] http://php.net/ChangeLog-5.php#5.6.28
[13] https://www.sudo.ws/stable.html#1.8.18p1
[14] https://suricata-ids.org/2016/11/01/suricata-3-1-3-released/

287

Announcements / OPNsense 16.7.7

« on: October 27, 2016, 03:40:15 pm »

Hi everyone,

This update brings several reliability and security improvements as usual. Our LibreSSL fans will notice the version 2.3 has finally been replaced with 2.4 and we switched to position independent executables in our base system to make good use of HardenedBSD ASLR.

Another hot topic is the addition of a Czech translation into the release. Many thanks to pavelb for making that happen!

Overall progress towards OPNsense 17.1 is steady: native PAM support is through the testing phase and major FreeBSD upgrade support is already enclosed within this very update. Our next step is the release of beta images some time during November.

Here are the full patch notes:

o captive portal: add expire voucher option
o intrusion detection: added support for compressed rule files
o web proxy: basic auth support for remote ACLs
o web proxy: fix ICAP config write for MIME-types (contributed by Fabian Franz)
o ipsec: fix spacing and type for shared secrets on Windows 7+
o ipsec: restart must only restart, not completely reconfigure
o ipsec: correctly set 28673 option to "yes"
o openvpn: reintroduce zip usage instead of 7z
o interfaces: fix performance issues on status page
o interfaces: fix ARP and NDP to show all entries
o rc: revamp the handling of /boot/loader.conf to be fully pluggable
o firmware: opnsense-update can now perform major FreeBSD updates
o plugins: multiple fixes for HAProxy plugin (contributed by Frank Wall)
o plugins: new PT research rule set intrusion detection plugin
o lang: new language Czech at 54% completed (contributed by pavelb)
o lang: updates for German and French
o ports: libressl 2.4.3[1]
o ports: isc-dhcp 4.3.5[2]
o ports: php 5.6.27[3]
o ports: lighttpd 1.4.42[4]
o src: base system now uses position independent executables
o src: tzdata updated to version 2016h[5]
o src: revised dummynet patches for NAT, also includes IPv6 support
o src: Fix bspatch heap overflow vulnerability[6]
o src: Fix multiple libarchive vulnerabilities[7]
o src: Fix virtual memory subsystem bugs[8]
o src: Fix incorrect argument validation in sysarch(2)[9]


Stay safe,
Your OPNsense team

--
[1] https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.4.3-relnotes.txt
[2] https://kb.isc.org/article/AA-01430/82/DHCP-4.3.5-Release-Notes.html
[3] http://php.net/ChangeLog-5.php#5.6.27
[4] https://www.lighttpd.net/2016/10/16/1.4.42/
[5] http://mm.icann.org/pipermail/tz-announce/2016-October/000042.html
[6] https://www.freebsd.org/security/advisories/FreeBSD-SA-16:29.bspatch.asc
[7] https://www.freebsd.org/security/advisories/FreeBSD-SA-16:31.libarchive.asc
[8] https://www.freebsd.org/security/advisories/FreeBSD-EN-16:17.vm.asc
[9] https://www.freebsd.org/security/advisories/FreeBSD-SA-16:15.sysarch.asc

288

Announcements / Try OPNsense 16.7.6 on ARM with the Raspberry Pi 1 Model B

« on: October 14, 2016, 10:18:12 am »

Hi all,

We proudly announce the availability of a one-time release of the latest OPNsense for the Raspberry Pi 1 Model B for ARM.

The reasons for choosing a one-time test of the old RPI model is that OPNsense 16.7 is based on FreeBSD 10.3, and it's the only RPI that is supported. PRI2 will be included in FreeBSD 11.0 and we are planning to use this version in OPNsense 17.1.

While old RPI is slower than we hoped for, we want to eventually support a suitable model in the ARM world. This is why there will be no updates to this build. It is strictly for testing purposes.

Now let's install this, shall we.

Requirements:

o Raspberry Pi 1 Model B with USB power cable
o at least a 2 GB SD card (may work with USB, too)
o FreeBSD-10.3-RELEASE-arm-armv6-RPI-B.img -> e.g. ftp://ftp.freebsd.org/pub/FreeBSD/releases/arm/armv6/ISO-IMAGES/10.3/FreeBSD-10.3-RELEASE-arm-armv6-RPI-B.img.xz
o Ethernet cable + connection
o HDMI cable + screen
o USB keyboard

The SD card needs to be flashed with the FreeBSD image, then boot and plug in a network cable so that the PRI has access to the Internet for fetching the OPNsense sets. Log in as root / root, then:

# cd /tmp
# mkdir -p /root/tmp
# ln -s ../root/tmp opnsense-bootstrap
# fetch --no-verify-peer https://raw.githubusercontent.com/opnsense/update/9d5ccfac89/bootstrap/opnsense-bootstrap.sh
# sh ./opnsense-bootstrap.sh -i

The last operation takes about 1 hour to complete and will automatically reboot.

OPNsense is now installed with ue0 being used as LAN with IP 192.168.1.1 and DHCP server running. If you want to use it as a DHCP client log in as root / opnsense, then:

Choose (1) Assign Interfaces
On VLAN press enter
On WAN type "ue0" and press enter
On LAN press enter
On confirmation type "y" and press enter

After completion reboot for the settings to take effect as a bug will cause WAN to grab an IP off the DHCP server which wasn't killed in time.

If you have questions or comments or hints, please don't hesitate to let us know.


Stay safe and have fun,
Your OPNsense team

289

Announcements / OPNsense 16.7.6 released

« on: October 11, 2016, 12:20:16 pm »

Hi all,

This update is preparation for the upcoming major release firmware upgrades, because FreeBSD 11.0 just came out (yay!). The intended target for this version is OPNsense 17.1, so it feels only natural to add the bits and bolts for it as early as possible. Seamless upgrades from any major release to the next is our mission. 

A few security-related ports got updated to their latest versions and we have fixed the PSK-related IPsec regression that sneaked into 16.7.5.

Here are the full patch notes:

o system: add language selection to initial wizard
o system: allow disabling the root user
o firmware: new mirror in Serbia (contributed by FourDots[1])
o firmware: assorted changes for upcoming major upgrade
o interfaces: wait for DHCP6 client to properly exit
o firewall: allow route-to to loopback gateways
o openvpn: fix download of config file for iOS
o ipsec: fix mobile / PSK regressions of 16.7.5
o intrusion detection: added syslog support
o dns: improve forwarder interface listening generation
o rc: silence backup warnings about stripped leading slashes
o ports: libressl 2.3.8[2], bind 9.10.4-P3[3]
o ports: ca_root_nss 3.27.1[4], unbound 1.5.10[5]


Stay safe,
Your OPNsense team

--
[1] https://fourdots.com/
[2] http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.8-relnotes.txt
[3] ftp://ftp.isc.org/isc/bind9/9.10.4-P3/RELEASE-NOTES-bind-9.10.4-P3.html
[4] https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.27.1_release_notes
[5] http://www.unbound.net/download.html

290

Announcements / OPNsense 16.7.5 released

« on: September 28, 2016, 02:12:21 pm »

Hey everyone,

Now that we got the chance to ship not one, but two OpenSSL bumps at the same time we barely missed the LibreSSL updates. That is life. But we still have a few great things to offer this week.

First and foremost, users noted that the captive portal did not work with the transparent proxy. This lead to internal investigation into the operating system kernel itself, where a number of issues with using several packet filters in a row can lead to shortcuts in packet paths through the networking stack.

This circled back to a simple fix for the captive portal: you can now edit each zone to enable the proxy for HTTP (port 3128) or HTTPS (port 3129) for captive portal use without requiring the firewall redirect. You only have to make sure you actually have your captive portal interface set up as an interface in the proxy.

We will continue to look into the remaining kernel issues and give updates and calls for testing when we reach new milestones.

In other news, both OpenVPN and IPsec received several improvements for interoperability and the occasional bug with the missing firewall rules tab for their respective interfaces.

Here are the full patch notes:

o captive portal: handle transparent proxy from within the zone configuration
o openvpn: adapt to cipher output changes in OpenVPN 2.3.12
o openvpn: improve plugin probing for virtual interface
o openvpn: added missing IPv6 tunnel network to overrides
o ipsec: human-readable format of authentication method in overview
o ipsec: refine behaviour of enable/apply on main page
o ipsec: deduplicate leftsubnet/rightsubnet for meshed IKEv2
o ipsec: more elegant interface and service plugging
o ipsec: added unmeshed "tunnel isolation" mode for IKEv2
o ipsec: cleanup pass over backend code
o ipsec: allow Camellia for IKEv2
o ipsec: allow %any in phase 1
o ipsec: allow EAP-MSCHAPV2
o system: load if_bridge on boot to correctly set its sysctl values
o system: do not explicitly call plugins_interfaces() anymore
o services: DNS resolver translation fixes (contributed by Fabian Franz)
o services: fix a race in the DynDNS widget display
o ports: curl 7.50.3[1], sudo 1.8.18[2], php 5.6.26[3], openssl 1.0.2j[4][5]
o src: Multiple OpenSSL vulnerabilities[5]
o src: updated tzdata to 2016f[6]

Stay safe,
Your OPNsense team

--
[1] https://curl.haxx.se/mail/lib-2016-09/0040.html
[2] https://www.sudo.ws/stable.html#1.8.18
[3] http://php.net/ChangeLog-5.php#5.6.26
[4] https://www.openssl.org/news/secadv/20160922.txt
[5] https://www.openssl.org/news/secadv/20160926.txt
[6] https://www.freebsd.org/security/advisories/FreeBSD-SA-16:26.openssl.asc
[7] http://mm.icann.org/pipermail/tz-announce/2016-July/000040.html

291

17.1 Legacy Series / [MERGED INTO 16.7.7] Base PIE

« on: September 22, 2016, 06:05:21 pm »

Hi all,

We have a new CFT ready for you now. We are looking for feedback for these three issues below:

(a) Shawn has added Position Independent Executable flags to the FreeBSD 10.3 base utilities, which means this patch will make good use of ASLR by randomising all the things (pardon the lack of expertise). The main thread for this change is below, having to do with a possible performance impact on i386 installations:

https://forum.opnsense.org/index.php?topic=3101.msg9695#msg9695

(b) We have a working patch for people having trouble with Mutli-WAN setups which ignore the Captive Portal.

(c) We also have a working patch for people having trouble with the transparent proxy which ignores the Captive Portal, too. It is closely related to (b), but a different code path.

The kernel patch for (b) and (c) can be found here:

https://github.com/opnsense/src/commit/83fd8a61b9

A new kernel patch is currently tested, approaching the problem from a different perspective. It should be available next week. Testing Base PIE is still possible and highly appreciated.

To upgrade your installation just run the following:

# opnsense-update -br 16.7.2-pie-route && /usr/local/etc/rc.reboot

and let us know what fix you were looking for and if that solved your issue and/or if new issues appeared.

The patches have gone through a few days of testing and tinkering and are likely targets for an upcoming 16.7.x update pending your approval.


Thanks,
Franco

292

Announcements / OPNsense 16.7.4 released

« on: September 22, 2016, 10:10:59 am »

Dear all,

We are deliberately skipping waiting for OpenSSL to announce their new version today as the roundtrip time for incorporating patches and updates into FreeBSD and maybe also LibreSSL will likely delay an update to next week. We will simply do a 16.7.5 next week as well and let 16.7.4 stand on its own feet.

The prominent theme of this update is CARP. We have identified a number of issues with the way it was being set up and reverted the process back to what BSD standards recommend. We have a shiny new test lab to preview and scrutinise these changes in a larger environment. The tests were promising. Let us know what you think!

Another thing is the introduction of the Intel Gigabit driver plugin based on the stock driver code version 7.6.2 as multiple reports popped up regarding driver reliability. If you are having trouble with CARP or intrusion detection IPS mode with your em(4) driver, try installing the new plugin and reboot to activate.

The full list of changes is a follows:

o system: SSH-enabled installer and associated changes
o system: deprecate DSA keys as per OpenSSH recommendation
o system: reworked config import / export for consistency
o system: reboot after config import is now selectable
o system: fix improper escape of HTML entities in log file filter
o system: handle legal boolean return result from searchUsers() (contributed by Evgeny Bevz)
o system: add dynamic DNS update to cron
o system: fix race in php.ini setup
o system: always keep repository configurations on core package deinstall
o system: properly trigger filter reload on HA peer
o system: add ordering to rc.syshook scripting facility
o system: add missing parameter for LDAPS authentication server
o firewall: change CARP to operate using BSD standards to fix several edge cases and reported issues
o firewall: fix validation of redirection in NAT
o firewall: redirect target IP selection can now use aliases
o firewall: simplify empty rules message in interface rules tabs
o interfaces: do not attempt to fix the MAC address of a broken NIC
o interfaces: adapt validation of PPP to not require idle timeout to be set
o interfaces: add missing help toggle to settings page
o services: DHCP lease pages show MAC manufacturers without Nmap install
o services: improve cleanup of multiple captive portal zones
o services: fix writing empty DNS resolver ACL
o reporting: automatic database repair added
o lang: translation improvements (contributed by Simon Brunet, Antonio Prado and Fabian Franz)
o lang: updates for French, German, Italian and Spanish
o plugins: add stock Intel e1000 driver version 7.6.2 as "os-intel-em" (requires a reboot)
o plugins: lower early start priorities of VMware and Xen plugins
o ports: haproxy 1.6.9[1], hyperscan 4.3.1[2], suricata 3.1.2[3], phalcon 3.0.1[4], samplicator 1.3.8rc1


Stay safe,
Your OPNsense team

--
[1] http://www.haproxy.org/download/1.6/src/CHANGELOG
[2] https://github.com/01org/hyperscan/blob/master/CHANGELOG.md
[3] https://suricata-ids.org/2016/09/07/suricata-3-1-2-released/
[4] https://github.com/phalcon/cphalcon/releases

293

17.1 Legacy Series / [MERGED INTO 16.7.4] Phalcon 3.0

« on: September 01, 2016, 09:51:55 am »

Hi everyone,

Phalcon 3.0 came out recently, equipped with PHP 7.0 support and rewrites in multiple areas. We've been testing 3.0.0 and 3.0.1 for a bit and it looks like the authors did an awesome job!

https://phalconphp.com/en/

Before we bring it into the 16.7.x release we'd like to do an open test round to collect user feedback. The following works on both 17.1-ALPHA and 16.7-RELEASE.

Phalcon for amd64:

# pkg add -f https://pkg.opnsense.org/snapshots/amd64/phalcon-3.0.1.txz

Phalcon for i386:

# pkg add -f https://pkg.opnsense.org/snapshots/i386/phalcon-3.0.1.txz

Reverting to the Phalcon 2.0 release is simple:

# pkg install -f phalcon

Expected outcome: everything works as usual.

Please check back after a few days to let us know if you have seen or you haven't seen (very important for us) anything.

If there are questions please let me know.


Thank you,
Franco

294

Announcements / OPNsense 16.7.3 released

« on: August 31, 2016, 10:03:08 am »

Hi everyone,

We bring to your attention this update with a batch of enhancements and the occasional bugfix intertwined. It is interesting to note that the enhancements vs. bugfix ratio is as high as 5:1.

Brand new is the general availability of the Italian translation thanks to the work of Antonio Prado. The work is still ongoing and all help is highly appreciated. Also, the web font has been updated to enhance display of Cyrillic letters. We just love fostering the translations!

Here are the full patch notes:

o system: allow selection of secondary console
o system: added EFI as a console option
o system: fixed status display of tiered gateway groups
o system: allow to configure sudo usage for administrators
o system: package manager can no longer uninstall the GUI package (marked as "vital")
o system: also beep on factory reset
o system: added opnsense-code command line utility
o interfaces: do not store packet captures in /root
o interfaces: sort interface listings by name only
o interfaces: do not prevent configuring an IP used by the PPTP and L2TP plugins
o firewall: add normalisation options for source port and direction
o firewall: improved parsing of alias input
o firewall: fixed nesting of aliases with underscores in their names
o openvpn: fix script mismatch on export page
o openvpn: added reneg-sec option to server to allow persistent TOTP sessions
o openvpn: added option to prevent usage of username-as-common-name
o services: fix WOL widget link
o services: aligned backend calls of DNS and DHCP
o services: fix writing of DNS resolver host entries
o services: simplify configuring of DNS resolver listening addresses
o services: allow proxy to match against SSL URLs only (contributed by Fabio Mello)
o lang: updated Source Sans Pro font to improve the cyrillic experience
o lang: Italian is now a release language (contributed by Antonio Prado)
o lang: minor updates for Russian (contributed by Smart-Soft Ltd.)
o lang: minor updates for German and French
o ports: haproxy 1.6.8[1], php 5.6.25[2], sqlite 3.14.1[3]
o ports: openvpn 2.3.12[4], libxml 2.9.4[5]


Stay safe,
Your OPNsense team

--
[1] http://www.haproxy.org/download/1.6/src/CHANGELOG
[2] http://php.net/ChangeLog-5.php#5.6.25
[3] https://www.sqlite.org/releaselog/3_14_1.html
[4] https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.12
[5] http://xmlsoft.org/news.html

295

Announcements / OPNsense 16.7.2 released

« on: August 18, 2016, 01:29:33 pm »

Hi everyone,

The release schedule is being stretched bit by bit to see how long we can go without an update. Well, we did not want to wait any longer to share with you the following bits... so here they are.

FreeBSD incorporated several reliability fixes for Hyper-V and we had to back out an ICMP stable commit that was not fully working for trace route output over the network. There are several important ports updates, namely Lighttpd, Strongswan and OpenSSH all brought to their latest versions.

On our side, multi-point VPN plugins have been corrected to properly group to their respective firewall rule interface. For anyone waiting to migrate their VPNs from 16.1.20 to 16.7, now is the time to do so! Also, the stale OpenVPN windows binaries have been removed. Note that we gracefully support configuration file export in several formats.

Here are the full patch notes:

o src: revert fix ICMP translation in pf[1]
o src: better handle unknown options received from a DHCP server[2]
o src: void using spin locks for channel message locks[3]
o src: enable INQUIRY result check only on Windows 10 host systems[4]
o src: register time counter early enough for TSC freq calibration[5]
o src: disable incorrect callout in hv_storvsc(4)[6]
o src: better handle the GPADL setup failure in Hyper-V[7]
o src: fix SCSI INQUIRY checks and error handling[8]
o ports: lighttpd 1.4.41[9], strongswan 5.5.0[10], curl 7.50.1[11]
o ports: ca_root_nss 3.26, openssh 7.3p1[12]
o ports: enabled LDAP SASL bindings
o system: remove source maps to prevent further Chrome breakage during API calls
o system: switch to individual registration of PHP extensions
o system: added UO field to CSR
o interfaces: properly remove PPPoE server from list of firewall interfaces when deactivated
o interfaces: extended logging for 4G modems
o interfaces: correct download of large packet captures
o interfaces: add lacp_fast_timeout flag support for LAGG
o interfaces: fix clearing the DHCP config file when override file is gone
o interfaces: improve dmesg probe on interface listing (contributed by Per von Zweigbergk)
o firewall: double-check file availability after alias URL download
o services: corrected DNS forwarder settings save in mobile layout
o dashboard: fix gateway widget status text update
o plugins: corrected firewall interface usage for multi-point VPNs
o vpn: removed the stale OpenVPN windows installer binaries
o vpn: default to IPsec main mode
o lang: assorted translation fixes (contributed by Fabian Franz and Antonio Prado)
o lang: translation updates for Chinese, French, German and Japanese


Stay safe,
Your OPNsense team

--
[1] https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=201519
[2] https://www.freebsd.org/security/advisories/FreeBSD-EN-16:10.dhclient.asc
[3] https://www.freebsd.org/security/advisories/FreeBSD-EN-16:11.vmbus.asc
[4] https://www.freebsd.org/security/advisories/FreeBSD-EN-16:12.hv_storvsc.asc
[5] https://www.freebsd.org/security/advisories/FreeBSD-EN-16:13.vmbus.asc
[6] https://www.freebsd.org/security/advisories/FreeBSD-EN-16:14.hv_storvsc.asc
[7] https://www.freebsd.org/security/advisories/FreeBSD-EN-16:15.vmbus.asc
[8] https://www.freebsd.org/security/advisories/FreeBSD-EN-16:16.hv_storvsc.asc
[9] https://www.lighttpd.net/download/
[10] https://wiki.strongswan.org/projects/strongswan/wiki/Changelog55
[11] https://curl.haxx.se/changes.html#7_50_1
[12] http://www.openssh.com/txt/release-7.3

296

Announcements / OPNsense 16.7.1 released

« on: August 04, 2016, 03:05:37 pm »

Hi everyone,

Thanks again for the warm welcome of the 16.7 series! The feedback has been overwhelming, quite positively so. It was partly addressed in to be released code, shall be weaved into the upcoming roadmap or will be further discussed in our forums. Every wee bit counts on our way to 17.1. 

This release addresses a pressing issue with the Intel e1000 driver in conjunction with IPS mode. For now, a piece of code that went into FreeBSD 10.3 has been reverted to bring back stability, but we are working with the author on a more permanent solution.

Here are the full patch notes:

o system: default config now disables hardware offloading features
o system: prevent carp demotion on sender and pfsync failures
o firewall: removed obsolete reflection timeout value
o firewall: added logging option for outbound NAT
o firewall: fix interface address IPv6 outbound NAT
o firewall: fix one-to-one copy feature
o firewall: execute custom scrub rules before auto-generated rules
o firmware: fixed race on base / kernel fetch
o firmware: revoke the obsoleted 16.1 update fingerprint
o interfaces: allow default route on multi-WAN PPPoE
o interfaces: allow to set txpower for WiFi adapters
o interfaces: allow backwards-compatible interface enable
o vpn: fix faulty IPSec authenticator selection in phase 1
o mvc: add missing CRL type in certificates cache
o mvc: set robots meta to nofollow, noindex
o mvc: always show logout button in menu
o src: fix bspatch heap overflow vulnerability[1]
o src: fix ICMP translation in pf
o src: revert extended descriptor format for em(4)[2]
o src: lower spurious log notice to debug in rtsold
o plugins: os-haproxy 1.4 (contributed by Frank Wall)
o ports: libressl 2.3.7[3]


Stay safe,
Your OPNsense team

--
[1] https://www.freebsd.org/security/advisories/FreeBSD-SA-16:25.bspatch.asc
[2] https://github.com/opnsense/src/commit/b0f7ff3
[3] http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.7-relnotes.txt

297

18.1 Legacy Series / [OBSOLETE] How to test the development version

« on: August 03, 2016, 08:34:16 am »

Hello everyone,

The development package is available now for the upcoming 17.1 and updated alongside each stable release. You can read about its most prominent changes here:

https://forum.opnsense.org/index.php?topic=3478.0

With 16.7.1 and up, it's possible to switch to the development version by invoking this command on a shell:

# opnsense-update -t opnsense-devel

Switching back to the release version is done by typing the following instead:

# opnsense-update -t opnsense

On top of using the opnsense-devel package, it's now (as of 16.7.10) possible to upgrade to the next FreeBSD 11.0 underneath as well by invoking the console menu item 12, typing "17.1.b" at the prompt.

THERE IS NO SAFE WAY TO UNDO THIS, PLEASE MAKE SURE YOU BACK UP YOUR CONFIGS, SNAPSHOT YOUR VMS AND/OR USE APPROPRIATE TEST SETUPS.

FURTHERMORE, THE UPDATE SETS ARE UPDATED INFREQUENTLY UNTIL THE RELEASE CANDIDATE PHASE IS REACHED.

It's possible to move back to the stock 16.7, but newer files can linger in the file system preventing the downgrade or proper operation thereof.

# opnsense-update -ur 16.7
# /usr/local/etc/rc.reboot

Switching the top package is also required for using the upgrade mechanism from the git repository to get even newer changes:

# opnsense-code core
# cd /usr/core
# git pull
# opnsense-update -t opnsense-devel
# make upgrade CORE_ABI=17.1


Cheers,
Franco

298

17.1 Legacy Series / 17.1 development milestones

« on: August 03, 2016, 08:34:06 am »

Hi there,

Here is the (gradually growing) list of important changes we've done for the 17.1 series during its development cycle:

o OpenVPN client exporter windows binaries have been removed
o top GUI package is now marked "vital" to make sure it's not being uninstalled (new feature of pkg 1.8)
o authentication methods are now fully pluggable
o secondary console can now be specified individually in serial mode under System: Settings: Administration
o installer now boots up with SSH for headless remote installation
o Italian as a release language (contributed by Antonio Prado)
o individual MVC config models now have their own versioning/migration system
o config.xml import / export consistency rework
o phalcon MVC 3.0
o PAM authentication for far-reaching 2FA usage
o reverting CARP usage back to BSD standards
o IPsec tunnel isolation mode for interoperability (one tunnel per phase 2 entry)
o pluggable boot loader settings
o sanitisation of header redirects using url_safe()
o firmware updates can now perform major system upgrades (e.g. FreeBSD 10.3 to 11.0)
o FTP proxy plugin (contributed by Frank Brendel)
o all system branding moved to the core package
o Czech as a release language (contributed by Pavel Borecki)
o FreeBSD 11-RELEASE with ASLR and PIE additions from HardenedBSD
o first public test build of OPNsense on armv6
o firewall rules are now fully pluggable
o secure fetching of bogons files as a single set
o HardenedBSD's SEGVGUARD
o configuration model constraints
o Tinc VPN Plugin
o selectable domain override for DNS Forwarder/Resolver
o captive portal custom voucher quantity and validity
o rewritten Nano images with growfs support (3G)
o improved password security (blowfish+salt)
o Mute + EFI console support
o PHP 7.0 compatibility and general GUI speed improvements
o improved firmware update user experience with audits, changelogs, licenses, plugins
o exported several base features to plugins (os-snmp, os-igmp-proxy, os-wol, os-upnp, os-relayd)
o added translation for Portuguese/Portugal (contributed by Carlos Meireles)
o added translation for Portuguese/Brazil (contributed by Thiago Basilio)
o fixed link state interrupt stuck on e1000 82574 chipsets broken in FreeBSD 10.3 and up
o cooperative firewall forwarding rework to fix traffic shaper/captive portal + multi-wan
o fixed emulated IPS (netmap) mode broken in FreeBSD 11.0
o replaced the CSRF implementation in the non-MVC pages


Cheers,
Franco

299

General Discussion / Nano images question / Revamp for 17.1

« on: July 29, 2016, 06:41:18 pm »

Hi guys,

So the second slice on the Nano-Images has been dormant since having been (re)added to OPNsense, holding 2 GB of extra space. I'm asking whether you want see the superfluous slice removed to salvage the space for the actual installation and / or shrinking the image to the minimum and auto-expand on first boot?

The latter may not work without GPT so that's something to research further. The way we build the nano now is very complicated and so far a fixed 4GB seemed to fit the requirements of the past year quite alright.

Or is anyone using that second slice?

What do you think about the firmware upgrades in general on Nano, sane enough so far? I remember we've had trouble until early 15.7, and the last remaining issue of persistent updates vs. low RAM was fixed with 16.7 yesterday.

Nano deserves a face-lift now.


Cheers,
Franco

300

Announcements / OPNsense 16.7 released

« on: July 28, 2016, 10:03:28 am »

Welcome everyone,

It is time for the next major iteration in open-source security! After 6 months and 20 minor releases we hereby declare the general availability of OPNsense 16.7, nick-named "Dancing Dolphin". The highlights of this major release include:

o Suricata 3.1.1 with Intel Hyperscan support
o NetFlow-based reporting and export
o Traffic shaping using CoDel / FQ-CoDel
o Two-factor authentication based on RFC 6238 (TOTP)
o HTTPS and ICAP support in the proxy server
o FreeBSD 10.3 with full integration of HardenedBSD ASLR
o UEFI boot and installation modes
o Substantial updates to our language packs: Japanese, Russian, German, French, Chinese

We thank all contributors, testers and users for their relentless support and invaluable feedback. The release candidate phase has been the most fun we have had so far.

Attention: An incompatibility in Chrome may prevent the firmware update from running. Try a different browser to upgrade to 16.7 where a workaround has been added to avoid the problem in the future.

All images can be found on the mirrors below with checksums attached to the end of this announcement:

https://opnsense.org/download/

Please stay in touch, tell us what you think about OPNsense and how we can improve it further! You can find us in any of these popular locations:

Twitter: https://twitter.com/opnsense
Forum: https://forum.opnsense.org/
GitHub: https://github.com/opnsense
IRC: Freenode #OPNsense

Lastly, here are the full changes since 16.7-RC2:

o installer: fix UI glitch with overlong disk name selections
o installer: warn on low RAM as install phase can fail
o ports: suricata 3.1.1[1], php 5.6.24[2]
o system: Etc/UTC is now the default time zone
o system: prevent user from deleting itself
o interfaces: register groups in the system immediately
o firmware: add subscription option for private repositories[3]
o firmware: work around API POST problem on Chrome by deleting css source map pointer
o firewall: allow cron to set arbitrary syslog times for alias updates
o proxy: add syslog target for access_log
o reporting: can now individually flush health reports
o reporting: can now flush insight and NetFlow data
o reporting: translate interface names on health page
o reporting: shut down insight service on backup to prevent database corruption
o lang: Russian is now 97% completed (contributed by Smart-Soft Ltd.)
o lang: minor updates in all other languages


Stay safe,
Your OPNsense team

--
[1] https://suricata-ids.org/2016/07/13/suricata-3-1-1-released/
[2] http://php.net/ChangeLog-5.php#5.6.24
[3] https://forum.opnsense.org/index.php?topic=3408.0

# SHA256 (OPNsense-16.7-OpenSSL-cdrom-amd64.iso.bz2) = 3808ebf4519beef9122f32b2919c9fad337efd4971529621c6d4a7eede7433db
# SHA256 (OPNsense-16.7-OpenSSL-nano-amd64.img.bz2) = 48e70fc263efeb27c8d8ac0f6e3284505833977f3ba2dfe200d83109cd0ce511
# SHA256 (OPNsense-16.7-OpenSSL-serial-amd64.img.bz2) = 2346cb43389600f544505c48b4fc8c1648e74eae457f97ca6ae613c6b4ca8482
# SHA256 (OPNsense-16.7-OpenSSL-vga-amd64.img.bz2) = 0c93d516a33b0a33fb9f98e7709d3270d472fa96136611751bcbf795c399a95a
# SHA256 (OPNsense-16.7-OpenSSL-cdrom-i386.iso.bz2) = 9a1e7c13c9ed70fdc758781048ef8806c44e375bfeb1c7b788602e38b9d635cf
# SHA256 (OPNsense-16.7-OpenSSL-nano-i386.img.bz2) = 3a6c47927c3005714eddeadcab21a5833394e09cd3516e576a61d5f257b8fdc4
# SHA256 (OPNsense-16.7-OpenSSL-serial-i386.img.bz2) = b193c21dec852aaf90d1172c7d41ac63e403ff6c832a10217daea03d2d1725b0
# SHA256 (OPNsense-16.7-OpenSSL-vga-i386.img.bz2) = 086cc24ca8eed27e504cdc1b48e15f8bf5640304f3f8874938d0973b72a47b9a

# MD5 (OPNsense-16.7-OpenSSL-cdrom-amd64.iso.bz2) = 96a11a6892bde8b1d10a45b39f2fa47e
# MD5 (OPNsense-16.7-OpenSSL-nano-amd64.img.bz2) = 21e94d5ebf3fba92d71ff5a3074f0f29
# MD5 (OPNsense-16.7-OpenSSL-serial-amd64.img.bz2) = bcaa7d4cf5a9bb29bc7fa32a8fcfb2b7
# MD5 (OPNsense-16.7-OpenSSL-vga-amd64.img.bz2) = 8149bad48d1825cbb8641d9d1f4f1bc3
# MD5 (OPNsense-16.7-OpenSSL-cdrom-i386.iso.bz2) = f7136f20169b746e95ffdd867ee40ce3
# MD5 (OPNsense-16.7-OpenSSL-nano-i386.img.bz2) = a9c9fe086b015bf13fa32d201940b80f
# MD5 (OPNsense-16.7-OpenSSL-serial-i386.img.bz2) = fc5c6e39b2c2017290f67a12605e9924
# MD5 (OPNsense-16.7-OpenSSL-vga-i386.img.bz2) = 292ef2aaa10853264cc8045c857b4e67