OPNsense 23.7.6 released

[franco]

Hi,

This update is a maintenance release improving the DS-Lite use via separate
GIF tunnels on top of IPv6-only connectivity.  We are still continuing the
efforts to provide better MVC integration for the gateways abstraction as
well as working towards better MVC model consistency.

We would like to thank GitHub user Monviech for his special contributions
in the documentation on the subject of reflection and hairpin NAT[1].

Here are the full patch notes:

o system: do not mark "defunct" gateway as "disabled" as well
o system: skip all unusable gateways for monitoring
o system: simplify the code in dpinger_status()
o system: rewrite configuration history using MVC/API
o interfaces: drop obsolete PPP default route handling
o interfaces: change GRE/GIF to split reload per address family on dynamic connectivity
o interfaces: prevent reading stale configuration data in interfaces_has_prefix_only()
o interfaces: for consistency bootstrap the implicit 'none' value of the IP address modes
o interfaces: prevent extended array data from being passed in interface_bring_down()
o interfaces: fix warning due to use of an unassigned variable
o firewall: quote "a/n" protocol in pf.conf to avoid a syntax error
o firewall: fix wrong link to virtual IP page
o firewall: add "Interface / Invert" rule toggle
o firewall: fix help button in dialog for categories
o firewall: update alias and shaper models
o captive portal: update model
o dhcp: fix "ends never" parsing in DHCPv6 lease page
o dhcp: add scope to link-local DHCPv6 static mapping when creating route for delegated prefix (contributed by Maurice Walker)
o dhcp: merge_ipv6_address() was too intrusive
o intrusion detection: update model and persist values for transparency
o intrusion detection: improve locking during sqlite database creation
o ipsec: add IP4_DNS and IP6_DNS configuration payloads to connection pools (contributed by Monviech)
o ipsec: require setting a connection pool name
o ipsec: update models
o monit: update model
o openvpn: allow instances authentication without certificates when verify_client_cert is set to none
o openvpn: add role to "proto" for TCP sessions as required for TAP type tunnels
o openvpn: missing "selectpicker" class on VHID selector
o openvpn: update model
o backend: template reload wildcard was returning "OK" on partial failures
o mvc: emit correct message on required validation in BaseField
o mvc: throw on template reload issues in mutable service controller
o mvc: inline one time use of $parentKey
o mvc: set Required=Y for GroupNameField
o mvc: remove special validation messages likely never seen
o mvc: introduce isVolatile() for BaseModel
o mvc: propagate isFieldChanged() from connected children in ArrayField
o ui: remove the bootstrap-select version from the provided file in the default theme
o plugins: remove the bootstrap-select version from the provided file in all themes
o plugins: os-crowdsec 1.0.7[2]
o plugins: os-smart reverts the use of smartctl to gather disks
o plugins: os-telegraf 1.12.9[3]
o plugins: os-theme-rebellion 1.8.9 fixes Unbound DNS reporting page
o plugins: os-wireguard 2.3[4]
o ports: php 8.2.11[5]
o ports: syslog-ng 4.4.0[6]


Stay safe,
Your OPNsense team

--
[1] https://docs.opnsense.org/manual/how-tos/nat_reflection.html
[2] https://github.com/opnsense/plugins/blob/stable/23.7/security/crowdsec/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/23.7/net-mgmt/telegraf/pkg-descr
[4] https://github.com/opnsense/plugins/blob/stable/23.7/net/wireguard/pkg-descr
[5] https://www.php.net/ChangeLog-8.php#8.2.11
[6] https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.4.0