OPNsense 23.1.10 released

[franco]

Dear all,

As summer is approaching we release this minor update in preparation for
the upcoming 23.7 series.  We are planning the upgrade to FreeBSD 13.2
as well as offering an MVC variant of the OpenVPN integration amongst
many other improvements some of which already shipped in previous 23.1.x
releases.

There may be another kernel update before the final 23.7 arrives but that
is for next week to decide.  For now enjoy the sun and stay hydrated!

Here are the full patch notes:

o system: do not delete dpinger PID file
o system: improve RRD collector PID/service handling
o system: do not touch /var/run/booting if it exists (contributed by William Desportes)
o system: do a full transition on gateway group apply
o system: automatically create core dump with installed debug kernel
o interfaces: minor fixes in IP address status read
o interfaces: additions for legacy_interface_stats()
o interfaces: use interfaces_primary_address() during IPv4 renewal
o firewall: remove duplicate table defintions
o firewall: prevent VIP address adding /32 on IPv6 rule selection
o firmware: opnsense-update: move -K option to -x
o firmware: opnsense-update: support deferred kernel set install
o firmware: opnsense-update: use -w option with -a option in fetch(1)
o firmware: opnsense-update: ensure kernel directory consistency
o firmware: shift subscription key extract to "-x" option
o firmware: use post-upgrade hook and stage kernel as well for clean abort
o firmware: sort plugins before store
o dhcp: fix IPv6 lease page undefined vars and other issues
o dhcp: share DUID parsing code via dhcpd_parse_duid()
o dhcp: revamp the prefix route handling also adding support for statically mapped downstream routers
o monit: fix "not on" validation
o openvpn: fix typo in widget for client timestamp display
o web proxy: syslog parsing cleanup
o ui: remove noodp and noydir from HTML meta robots tag (contributed by William Desportes)
o plugins: os-crowdsec 1.0.6[1]
o plugins: os-nginx 1.32.1[2]
o ports: curl 8.1.2[3]
o ports: krb5 1.21[4]
o ports: nss 3.90[5]
o ports: ntp 4.2.8p17[6]
o ports: openssl 1.1.1u[7]
o ports: openvpn 2.6.5[8]
o ports: php 8.1.20[9]
o ports: phalcon 5.2.2[10]
o ports: python 3.9.17[11]
o ports: squid 5.9[12]
o ports: strongswan upstream fix for VICI stalls[13]
o ports: suricata 6.0.13[14]


Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/23.1/security/crowdsec/pkg-descr
[2] https://github.com/opnsense/plugins/blob/stable/23.1/www/nginx/pkg-descr
[3] https://curl.se/changes.html#8_1_2
[4] https://web.mit.edu/kerberos/krb5-1.21/
[5] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_90.html
[6] https://www.ntp.org/support/securitynotice/
[7] https://www.openssl.org/news/openssl-1.1.1-notes.html
[8] https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn26#Changesin2.6.5
[9] https://www.php.net/ChangeLog-8.php#8.1.20
[10] https://github.com/phalcon/cphalcon/releases/tag/v5.2.2
[11] https://docs.python.org/release/3.9.17/whatsnew/changelog.html
[12] http://www.squid-cache.org/Versions/v5/squid-5.9-RELEASENOTES.html
[13] https://github.com/opnsense/core/issues/6308
[14] https://suricata.io/2023/06/15/suricata-6-0-13-released/

[franco]

A hotfix release was issued as 23.1.10_1:

o firewall: align rule validation with port forward validation
o plugins: os-nginx fix for missing load_module directive after nginx update to 1.24