OPNsense 24.1.5 released

[franco]

Good time-of-your-day,

Today the kernel receives a number of minor updates that have accumulated
since 24.1.2 was released.  The primary focus for the time being is adding
fixes and MVC improvements for upcoming feature backports into the next
24.1.x versions.

The update presents itself as a hotfix 24.1.5_1 but that is only due to
catching an issue during the last QA stage with an update of the gettext
library.

Here are the full patch notes:

o system: fix PHP warnings and spurious validation in route model
o system: fix translation of static PHP pages with newer gettext
o interfaces: support a primary interface in LAGG failover mode
o interfaces: stop caching IPv6 address to decide if reload is required
o firmware: opnsense-revert: fix issue with downloaded package install
o ipsec: fix typo in config generation for AH proposals
o unbound: duckduckgo.com blocklist fix
o wireguard: add a peer configuration generator with QR code capability
o wireguard: improve overall configuration UX
o mvc: add "safe" filter in Phalcon volt templates
o mvc: feed current language into view to replace hardcoded "en-US"
o mvc: fix minor regression with "allownew" not having a default
o mvc: extend model implementation to support volatile fields
o mvc: add setBaseHook() to ApiMutableModelControllerBase
o rc: fix wrong order in service startup (contributed by Frank Wall)
o ui: move cache_safe() functions to appropriate include
o ui: add a "statusled" formatter to bootgrid
o ui: add a "grid-reload" helper to SimpleActionButton
o plugins: os-bind 1.21[1]
o plugins: os-caddy 1.5.3[2]
o src: wg: fix handling of errors in wg_transmit()
o src: wg: use proper barriers around pkt->p_state
o src: kern: fix panic with disabled ttys
o src: opencrypto: advance the correct pointer in crypto_cursor_copydata()
o src: opencrypto: handle end-of-cursor conditions in crypto_cursor_segment()
o src: opencrypto: respect alignment constraints in xor_and_encrypt()
o src: ccr,ccp: fix argument order to sglist_append_vmpages
o src: ossl: add missing labels to bsaes-armv7.S
o src: ipsec esp: avoid dereferencing freed secasindex
o src: irdma: upgrade to 1.2.36-k
o src: irdma: remove artificial completion generator
o src: tcp: cubic - restart epoch after RTO
o src: tcp: prevent div by zero in cc_htcp
o src: net80211: adjust more VHT structures/fields
o ports: curl 8.7.1[3]
o ports: expat 2.6.2[4]
o ports: libucl 0.9.1
o ports: lighttpd 1.4.75[5]
o ports: nss 3.99[6]
o ports: openssh-portable 9.7p1[7]
o ports: openvpn 2.6.10[8]
o ports: php 8.2.17[9]
o ports: py-duckdb 0.10.1[10]
o ports: py-netaddr 1.2.1[11]


Stay safe,
Your OPNsense team
--

[1] https://github.com/opnsense/plugins/blob/stable/24.1/dns/bind/pkg-descr
[2] https://github.com/opnsense/plugins/blob/stable/24.1/www/caddy/pkg-descr
[3] https://curl.se/changes.html#8_7_1
[4] https://github.com/libexpat/libexpat/blob/R_2_6_2/expat/Changes
[5] https://www.lighttpd.net/2024/3/13/1.4.75/
[6] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_99.html
[7] https://www.openssh.com/txt/release-9.7
[8] https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn26#Changesin2.6.10
[9] https://www.php.net/ChangeLog-8.php#8.2.17
[10] https://github.com/duckdb/duckdb/releases/tag/v0.10.1
[11] https://netaddr.readthedocs.io/en/latest/changes.html#release-1-2-1

[franco]

A hotfix release was issued as 24.1.5_2:

o wireguard: store attached instance during peer generation

[franco]

A hotfix release was issued as 24.1.5_3:

o reporting: top talkers fix for backend required by new py-netaddr