OPNsense business edition 23.4 released

[franco]

The OPNsense business edition transitions to this 23.4 release including
Unbound DNS statistics, PHP 8.1, assorted FreeBSD networking updates,
further MVC/API conversions, WireGuard kernel module plugin plus much more.

Please make sure to read the migration notes before upgrading.

Download link is as follows.  An installation guide[1] and the checksums for
the images can be found below as well.

https://downloads.opnsense.com/

This business release is based on the OPNsense 23.1.5 community version
with additional reliability improvements.

Here are the full patch notes:

o system: replaced log_error() use with log_msg() and adjusted logging levels accordingly
o system: introduced a service boot log
o system: simplify gateway monitoring setup code
o system: add option to skip gateway monitor host route
o system: populate /etc/hosts file with IPv6 addresses too
o system: simplify and guard host route creation
o system: merge system_staticroutes_configure() into system_routing_configure()
o system: do not yield process after calling shutdown command
o system: apply tunables during late boot in case a module was loaded depending on them to be set to a specific value
o system: show size of ZFS ARC (adaptive replacement cache) in system widget
o system: introduce support tier annotations for core and plugins[2]
o system: add cron tasks for scrubbing and trimming ZFS pools (contributed by Iain Henderson)
o system: fix 6rd/6to4 gateway interface detection (contributed by Frans J Elliott)
o system: incorrect link to CARP status page on dashboard widget
o system: replace single exec_command() with new shell_safe() wrapper
o system: fix assorted PHP 8.1 deprecation notes
o system: remove overreaching "Reconfigure a plugin facility" cron job and backend command that has no visible users
o system: use singleton boot detection everywhere
o system: protect against more stray scripts on boot
o system: several shell_safe() conversions
o system: when applying auto-far default route make sure the local address is not empty
o system: refactor system_default_route() to prevent empty $gateway
o system: create system_resolver_configure() and cron job support
o system: add simple script and configd action to list current group membership (configctl auth list groups)
o system: prevent alias reload in routing reconfiguration like we do in rc.syshook monitor reload
o system: address a number of web GUI startup problems
o system: service handling refactor, tweaks and improvements
o system: rework killbypid()/killbyname() behaviour
o system: use system_resolver_configure() everywhere
o system: timezone parsing issue for zones west of UTC using "-"
o system: migrate services page and widget to MVC/API
o system: move web GUI service definition to correct file
o system: add service_by_filter() service search extension
o system: pin down the auto-far gateway selection and routing log adjustments
o system: prevent applying tunables which are already set
o system: use data attribute to find existing rows in service widget to avoid special character issues (contributed by Alexander O'Mara)
o system: handle empty DNS server gateway (contributed by Nicolas Thumann)
o system: remove /31 subnet restriction in wizard
o reporting: add Unbound DNS statistics frontend including client drill-down
o reporting: make all status mapping colors configurable for themes in the Unbound DNS page
o reporting: simplify state collection for system-states.rrd
o reporting: translate invalid interface name characters for NetFlow/Netgraph use
o interfaces: heavy cleanup of the wireless device integration
o interfaces: use 802.1ad protocol for stacked VLAN parent (QinQ)
o interfaces: GIF and GRE now support subnet-based IPv6 configurations instead of always falling back to a point-to-point (/128) setup
o interfaces: GIF and GRE now disable IPv6 on IPv4 tunnels (contributed by Maurice Walker)
o interfaces: add isolated PPPoEv6 mode to selectively enable IPv6 CP negotiation and turn it off when no IPv6 mode is set
o interfaces: add support for SLAAC WAN interfaces without DHCPv6 (contributed by Maurice Walker)
o interfaces: register LAGG, PPP, VLAN and wireless devices as plugins
o interfaces: simplified get_real_interface() function
o interfaces: removed obsolete "defaultgw" files
o interfaces: simplified rc.linkup script
o interfaces: improve IP address cache behaviour in rc.newwanip(v6) scripts
o interfaces: converted virtual IPs to MVC/API
o interfaces: add MAC filtering to packet capture
o interfaces: convert ARP/NDP pages to server-side searchable variant
o interfaces: create null route for DHCPv6 delegated prefix
o interfaces: tighten the concept of hardware interfaces and pull supported plugin devices into assignments page automatically
o interfaces: make description field show for all types of VIP (contributed by FingerlessGloves)
o interfaces: protect against empty GIF host route
o interfaces: fix parsing of device names with a dot in packet capture
o interfaces: force newip calls through DHCP/PPP/OVPN on IPv4
o interfaces: force newip calls through DHCP/PPP on IPv6
o interfaces: fix an issue with a batch killbyname() in static ARP case
o interfaces: make sure output buffering is disabled when downloading a packet capture
o interfaces: lock gateway save button while the request is being processed
o interfaces: fix IP alias with VHID validation issue
o interfaces: allow to set PCP value on IPv4 DHCP traffic to address recent Orange FR changes
o firewall: remove deprecated "Dynamic state reset" mechanic
o firewall: invalidate port forward rule entry when no target is specified
o firewall: hide deprecated source OS rule setting under advanced
o firewall: add group option to prevent grouping in interfaces menu
o firewall: safeguard against missing name from the alias API call
o firewall: prevent possible infinite loop in alias parsing (contributed by kulikov-a)
o firewall: do not calculate local port range for alias (contributed by kulikov-a)
o firewall: update validation of alias names to be slightly more restrictive
o firewall: safeguard download_geolite() and log errors
o firewall: fix NAT dropdowns ignoring VIPs
o firewall: show all applicable floating rules when inspecting interface rules
o firewall: prevent networks from being sent to DNS resolver in update_tables.py
o firewall: fix mismatch of options in new automatic listing of floating rules in interface rules
o firewall: refactor alias update scripts
o firewall: fix progress bar default value (contributed by Nicolas Thumann)
o captive portal: enforce a database repair during operation if necessary
o captive portal: remove mod_evasion use which was discontinued by lighttpd
o dhcp: several plumbing improvements in service handling
o dhcp: add missing double quotes in hostname handling
o dnsmasq: add dns_forward_max, cache_size and local_ttl options to GUI (contributed by Dr. Uwe Meyer-Gruhl)
o dnsmasq: remove now unused host configuration and refactor
o firmware: move single-call function to reporter page
o firmware: responsiveness fix (contributed by kulikov-a)
o firmware: move settings handling to full-fledged model
o firmware: add advanced/help toggles, cancel button, subscription errors
o firmware: deal with subscription preset in factory reset
o intrusion detection: keep grid to prevent widgets being removed
o intrusion detection: reload grid after log drop (contributed by kulikov-a)
o intrusion detection: add verbose logging mode selector
o ipsec: disable charon.install_routes completely in case upstream would implement it for FreeBSD later on
o ipsec: move user PSK (pre-shared key) and static PSK items to new MVC/API implementation
o ipsec: migrate existing configuration from ipsec.conf to swanctl.conf
o ipsec: add a new independent connections MVC/API component to manage IPsec in a layout matching swanctl.conf syntax more closely
o ipsec: rewrote lease status page in MVC/API
o ipsec: add configurable "unique" setting to phase 1
o ipsec: missing correct phase 1 to collect "Network List" option
o ipsec: missing a bracket for aggressive mode selection
o ipsec: mute a spurious boot warning
o ipsec: myid may be be optional
o ipsec: allow "@" character in eap_id fields for new connections
o ipsec: missing remapping pool UUID to name for new connections
o ipsec: change status column sizing and hide local/remote auth by default
o ipsec: fix username parsing in lease status
o ipsec: refactor widget to use new data format
o ipsec: migrate duplicated cron job
o ipsec: faulty unique constraint in pre-shared keys
o ipsec: fix eap_id placement for eap-mschapv2
o ipsec: reqid should not be provided on mobile sessions
o ipsec: validate pool names on connections page
o ipsec: add connection data to XMLRPC sync
o ipsec: "Dynamic gateway" (rightallowany) option should be translated to 0.0.0.0/0,::/0
o ipsec: "Allow any remote gateway to connect" should suffix all in order to connect to the other end
o ipsec: store proper log values in advanced settings
o ipsec: add a routing hook and execute it for all VTI devices during reconfiguration
o ipsec: replace status call with portable alternative
o monit: support start timeout setting (contributed by spoutin)
o monit: add permanent include statement for custom configuration files (contributed by codiflow)
o network time: remove "disable monitor" to get rid of log warnings (contributed by Dr. Uwe Meyer-Gruhl)
o openvpn: add unique daemon name to each instance
o openvpn: replace authentication handler to prepare for upcoming OpenVPN 2.6 with deferred authentication
o openvpn: rename -cipher option to --data-ciphers-fallback and adjust GUI accordingly
o openvpn: add ovpn_status.py script and configd action to fetch connected clients
o openvpn: reintroduce "cipher" keyword for older clients
o openvpn: fix client output for widget (contributed by kulikov-a)
o openvpn: migrate connection status page and widget to MVC/API
o openvpn: fix typo in widget missing virtual address display
o unbound: add statistics database backend
o unbound: add exact domain blocking
o unbound: simplify logger logic for required queries
o unbound: add SafeSearch option to blocklists
o unbound: match white/blocklist action exactly from reporting page
o unbound: always prioritize whitelists over blocklists
o unbound: various UX improvements in reporting page
o unbound: add serve-expired, log-servfail, log-local-actions and val-log-level advanced settings
o unbound: drop unnecessary index from reporting database and other optimizations to lower CPU usage
o unbound: add HTTPS record type to reporting
o unbound: remember reporting page logarithmic setting
o unbound: wait for pipe in logger (contributed by kulikov-a)
o unbound: fix typo in logger and create a pipe early in dnsbl_module.py (contributed by kulikov-a)
o unbound: fix type cast to prevent unnecessary updateBlocklist action
o unbound: add missing blocklist
o unbound: adhere to restart logic during hosts configure and wait for service to start
o unbound: add infra-keep-probing advanced option
o unbound: lowercase domain for case insensitive search in blocklists
o unbound: replace status call with portable alternative
o unbound: bring back missing advanced page ACL entry
o unbound: implement wildcard blocking and refactor DNSBL module
o unbound: account for CNAME redirection in DNSBL module
o unbound: prevent logging SERVFAIL twice in DNSBL module
o unbound: allow scripts to extend blocklist functionality
o unbound: translate empty values to empty strings in DNSBL module
o mvc: call plugins_interfaces() optionally on service reconfigure
o mvc: match UUID for multiple values (contributed by kulikov-a)
o mvc: convert setBase() to an upsert operation
o mvc: add TextField tests (contributed by agh1467)
o mvc: implement required getRealInterface() variant
o mvc: fix PHP warnings and dance around null/0.0.0 ambiguity in migration code
o mvc: add MaskPerItem toggle to allow regex validation per entry in CSVListField
o mvc: add strict option to NetworkField
o ui: assorted improvements in bootgrid and form controls
o ui: switch to pure JSON data in bootgrids
o ui: solve deprecation in PHP via html_safe() wrapper
o ui: add a fail() handler to disable action button spinner
o wizard: unbound hardened DNSSEC setting moved
o plugins: os-OPNBEcore 1.1
o plugins: os OPNcentral 1.0.6
o plugins: os-acme-client 3.16[3]
o plugins: os-api-backup 1.1[4]
o plugins: os-bind 1.25[5]
o plugins: os-crowdsec 1.0.2[6]
o plugins: os-ddclient 1.11[7]
o plugins: os-freeradius 1.9.22[8]
o plugins: os-frr 1.33[9]
o plugins: os-haproxy 4.1[10]
o plugins: os-openconnect 1.4.4[11]
o plugins: os-puppet-agent 1.1[12]
o plugins: os-qemu-guest-agent 1.2[13]
o plugins: os-rfc2136 1.8[14]
o plugins: os-sslh 1.0[15] (contributed by agh1467)
o plugins: os-theme-cicada 1.34 (contributed by Team Rebellion)
o plugins: os-theme-tukan 1.27 (contributed by Team Rebellion)
o plugins: os-theme-vicuna 1.45 (contributed by Team Rebellion)
o plugins: os-upnp 1.5[16]
o plugins: os-wireguard switches to kernel module with a separate os-wireguard-go variant available for installation to keep the old behaviour
o src: assorted FreeBSD 13 stable fixes for e.g. bpf, bridge, bsdinstall ifconfig, iflib, ipfw, ipsec, lagg, netmap, pf, route and vlan components
o src: ipsec: clear pad bytes in PF_KEY messages
o src: fib_algo: set vnet when destroying algo instance
o src: if_ipsec: handle situations where there are no policy or SADB entry for if
o src: if_ipsec: protect against user supplying unknown address family
o src: if_me: use dedicated network privilege
o src: vxlan: add support for socket ioctls SIOC[SG]TUNFIB
o src: introduce and use the NET_EPOCH_DRAIN_CALLBACKS() macro
o src: iflib: Add null check to iflib_stop()
o src: pfctl: rule.label is a two-dimensional array
o src: pf: fix syncookies in conjunction with tcp fast port reuse
o src: pf: fix panic on deferred packets
o src: ipfw: Add missing 'va' code point name
o src: netmap: try to count packet drops in emulated mode
o src: netmap: fix a queue length check in the generic port rx path
o src: netmap: tell the compiler to avoid reloading ring indices
o src: pfsync: support deferring IPv6 packets
o src: pfsync: add missing bucket lock
o src: pfsync: ensure 'error' is always initialised
o src: pfsync: fix pfsync_undefer_state() locking
o src: pfsync: add missing unlock in pfsync_defer_tmo()
o src: epair: merged assorted fixes
o ports: curl 7.88.1[17]
o ports: dnsmasq 2.89[18]
o ports: dpinger 3.3[19]
o ports: filterlog 0.7 fixes unknown TCP option print
o ports: lighttpd 1.4.69[20]
o ports: monit 5.33.0[21]
o ports: nss 3.89[22]
o ports: openldap 2.6.4[23]
o ports: openssh 9.2p1[24]
o ports: openssl fix for CVE-2023-0464
o ports: phalcon 5.2.1[25]
o ports: php 8.1.17[26]
o ports: phpseclib 3.0.19[27]
o ports: py-vici 5.9.10
o ports: radvd fix for SIGHUP behaviour
o ports: sqlite 3.41.0[28]
o ports: squid 5.8[29]
o ports: strongswan 5.9.10[30]
o ports: sudo 1.9.13p3[31]

Migration notes, known issues and limitations:

o StrongSwan IPsec configuration now uses the preferred swanctl.conf instead of the deprecated ipsec.conf which could lead to connectivity issues in ambiguous cases.
o The new IPsec connections pages and API create an independent set of connections following the design of swanctl.conf.  Legacy tunnel settings cannot be managed from the API and are not migrated.
o Rate limiting was removed from the captive portal which was set to 250 connections by the same IP to the captive portal itself.  This can be easily replaced by a manual firewall rule with advanced options set, e.g.  "Max established" set to 250 with destination "This Firewall".


The public key for the 23.4 series is:

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4J0k7cPtunUYiR4vbRof
AiNTnkkByaWpjTeKneR/CBAaImUxpED5EnFprwM0mm4BX3Vqkf1KYQtRSawNxeXz
NiPT5Ykv0Vus0tYafBzIPsOCdUz/gtuJmtjih0uNvFSdwDRNE42MpX2RFeTm652H
fNE5Rxv23liLYdm3RNDFcM7tJEMs+zr01Lrn3McDv4OUACl3YTwFKS1BJGkBqpDI
gX1HsJMz934zNItrLxj6B2tDIR4oGrqowzW+1owT4+a8EoaimY48RAb8AUWezAZu
tQcGQ0wuZ8qy2WClYvrogsmAEUpfv1Y0YcSfpdxopOx4KyE0KEzAooRF95iFLu94
PODk1oPTr0N9qXn7XsLkpaufk+EpNecZSvbqrj3IWMyCLEBO60YuFpcFFI6SVJBC
i5OG7JVQaE8hu4CY50tMOO0M54umM8lPIOW8AuIH2PlmQWJ4tPb7j8HHnV1cM1Sf
Ha/EAJQlKEEyj4hbzSb6aKATv++qvh4jwgADsTsDtbCrtxrcBV7i+iLUM7DdxrPZ
QnLELdJPjyFxtClzi4Tf1svrF5K6NGd/nJQ1pLSkM64dKPA0iTiMMzjQMHnN8++G
UdhRzswRZ/BtB8ha1ZRRvnEHe+tcEtsXFZZSTgcR60lXlZzPY/0h+xfbgOApYlqq
MIMJsdvZkuxYrGQ5eL2nk0UCAwEAAQ==
-----END PUBLIC KEY-----


Stay safe,
Your OPNsense team

--
SHA256 (OPNsense-business-23.4-dvd-amd64.iso.bz2) = 7136d0d78e643b59bbee8866f7aa1498325bd5513af30a9ace6005aeb1638707
SHA256 (OPNsense-business-23.4-nano-amd64.img.bz2) = 84b4a5ede947aae38273c4b57ddea2122764508e5309d3e1bbb816128097ce35
SHA256 (OPNsense-business-23.4-serial-amd64.img.bz2) = 9da2a93f6ad246c2f02655a1d5468755b1af6b500ff2e1846c0506c956c8f84b
SHA256 (OPNsense-business-23.4-vga-amd64.img.bz2) = 982a47835be03787f0a8d408aff0e117a3a5bccd810aa510808c4804abab66c4

[1] https://docs.opnsense.org/manual/install.html
[2] https://docs.opnsense.org/support.html
[3] https://github.com/opnsense/plugins/blob/stable/23.1/security/acme-client/pkg-descr
[4] https://github.com/opnsense/plugins/blob/stable/23.1/sysutils/api-backup/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/23.1/dns/bind/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/23.1/security/crowdsec/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/23.1/dns/ddclient/pkg-descr
[8] https://github.com/opnsense/plugins/blob/stable/23.1/net/freeradius/pkg-descr
[9] https://github.com/opnsense/plugins/blob/stable/23.1/net/frr/pkg-descr
[10] https://github.com/opnsense/plugins/blob/stable/23.1/net/haproxy/pkg-descr
[11] https://github.com/opnsense/plugins/blob/stable/23.1/security/openconnect/pkg-descr
[12] https://github.com/opnsense/plugins/blob/stable/23.1/sysutils/puppet-agent/pkg-descr
[13] https://github.com/opnsense/plugins/blob/stable/23.1/emulators/qemu-guest-agent/pkg-descr
[14] https://github.com/opnsense/plugins/blob/stable/23.1/dns/rfc2136/pkg-descr
[15] https://github.com/opnsense/plugins/blob/stable/23.1/net/sslh/pkg-descr
[16] https://github.com/opnsense/plugins/blob/stable/23.1/net/upnp/pkg-descr
[17] https://curl.se/changes.html#7_88_1
[18] https://www.thekelleys.org.uk/dnsmasq/CHANGELOG
[19] https://github.com/dennypage/dpinger/releases/tag/v3.3
[20] https://www.lighttpd.net/2023/2/10/1.4.69/
[21] https://mmonit.com/monit/changes/
[22] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_89.html
[23] https://www.openldap.org/software/release/changes.html
[24] https://www.openssh.com/txt/release-9.2
[25] https://github.com/phalcon/cphalcon/releases/tag/v5.2.1
[26] https://www.php.net/ChangeLog-8.php#8.1.17
[27] https://github.com/phpseclib/phpseclib/releases/tag/3.0.19
[28] https://sqlite.org/releaselog/3_41_0.html
[29] http://www.squid-cache.org/Versions/v5/squid-5.8-RELEASENOTES.html
[30] https://github.com/strongswan/strongswan/releases/tag/5.9.10
[31] https://www.sudo.ws/stable.html#1.9.13p3