Why is custom options for Unbound removed in 21.7 ?

[chemlud]

I repeat: switch to development, use the new code, do the upgrade, switch back to community.

(I don't want to force hundreds of lines into an EoL release for maximum convenience.)

OK, switched to DEVELOPMENT in the GUI and had a look for updates:

Code Select Expand

***GOT REQUEST TO CHECK FOR UPDATES***
Fetching changelog information, please wait... done
Updating OPNsense repository catalogue...
Fetching meta.conf: . done
Fetching packagesite.txz: .......... done
Processing entries: .......... done
OPNsense repository update completed. 681 packages processed.
All repositories are up to date.
Checking integrity... done (0 conflicting)
Your packages are up to date.
Checking for upgrades (29 candidates): .......... done
Processing candidates (29 candidates): .......... done
The following 29 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
ca_root_nss: 3.63 -> 3.68
curl: 7.77.0 -> 7.78.0
filterlog: 0.4 -> 0.4_2
nspr: 4.31 -> 4.32
nss: 3.67 -> 3.68
opnsense: 21.1.8_1 -> 21.1.9
opnsense-installer: 0.10 -> 21.7
php74: 7.4.20 -> 7.4.21
php74-ctype: 7.4.20 -> 7.4.21
php74-curl: 7.4.20 -> 7.4.21
php74-dom: 7.4.20 -> 7.4.21
php74-filter: 7.4.20 -> 7.4.21
php74-gettext: 7.4.20 -> 7.4.21
php74-json: 7.4.20 -> 7.4.21
php74-ldap: 7.4.20 -> 7.4.21
php74-mbstring: 7.4.20 -> 7.4.21
php74-openssl: 7.4.20 -> 7.4.21
php74-pdo: 7.4.20 -> 7.4.21
php74-session: 7.4.20 -> 7.4.21
php74-simplexml: 7.4.20 -> 7.4.21
php74-sockets: 7.4.20 -> 7.4.21
php74-sqlite3: 7.4.20 -> 7.4.21
php74-xml: 7.4.20 -> 7.4.21
php74-zlib: 7.4.20 -> 7.4.21
py37-cffi: 1.14.5 -> 1.14.6
py37-sqlite3: 3.7.10_7 -> 3.7.11_7
python37: 3.7.10_1 -> 3.7.11
syslog-ng: 3.32.1 -> 3.33.2

Installed packages to be REINSTALLED:
monit-5.28.0 (options changed)

Number of packages to be upgraded: 28
Number of packages to be reinstalled: 1

31 MiB to be downloaded.
pkg: No packages available to install matching 'opnsense-devel' have been found in the repositories
***DONE***

Problem with LibreSSL flavor?

[franco]

My bad, let me fix that.

[franco]

It's there now.


Cheers,
Franco

[chemlud]

Looks good now!

***GOT REQUEST TO UPDATE***
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (29 candidates): .......... done
Processing candidates (29 candidates): .......... done
The following 29 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
   ca_root_nss: 3.63 -> 3.68
   curl: 7.77.0 -> 7.78.0
   filterlog: 0.4 -> 0.4_2
   nspr: 4.31 -> 4.32
   nss: 3.67 -> 3.68
   opnsense: 21.1.8_1 -> 21.1.9
   opnsense-installer: 0.10 -> 21.7
   php74: 7.4.20 -> 7.4.21
   php74-ctype: 7.4.20 -> 7.4.21
   php74-curl: 7.4.20 -> 7.4.21
   php74-dom: 7.4.20 -> 7.4.21
   php74-filter: 7.4.20 -> 7.4.21
   php74-gettext: 7.4.20 -> 7.4.21
   php74-json: 7.4.20 -> 7.4.21
   php74-ldap: 7.4.20 -> 7.4.21
   php74-mbstring: 7.4.20 -> 7.4.21
   php74-openssl: 7.4.20 -> 7.4.21
   php74-pdo: 7.4.20 -> 7.4.21
   php74-session: 7.4.20 -> 7.4.21
   php74-simplexml: 7.4.20 -> 7.4.21
   php74-sockets: 7.4.20 -> 7.4.21
   php74-sqlite3: 7.4.20 -> 7.4.21
   php74-xml: 7.4.20 -> 7.4.21
   php74-zlib: 7.4.20 -> 7.4.21
   py37-cffi: 1.14.5 -> 1.14.6
   py37-sqlite3: 3.7.10_7 -> 3.7.11_7
   python37: 3.7.10_1 -> 3.7.11
   syslog-ng: 3.32.1 -> 3.33.2

Installed packages to be REINSTALLED:
   monit-5.28.0 (options changed)

Number of packages to be upgraded: 28
Number of packages to be reinstalled: 1

31 MiB to be downloaded.
[1/29] Fetching syslog-ng-3.33.2.txz: .......... done
[2/29] Fetching python37-3.7.11.txz: .......... done
[3/29] Fetching py37-sqlite3-3.7.11_7.txz: .... done
[4/29] Fetching py37-cffi-1.14.6.txz: .......... done
[5/29] Fetching php74-zlib-7.4.21.txz: ... done
[6/29] Fetching php74-xml-7.4.21.txz: ... done
[7/29] Fetching php74-sqlite3-7.4.21.txz: ... done
[8/29] Fetching php74-sockets-7.4.21.txz: ..... done
[9/29] Fetching php74-simplexml-7.4.21.txz: ... done
[10/29] Fetching php74-session-7.4.21.txz: ..... done
[11/29] Fetching php74-pdo-7.4.21.txz: ...... done
[12/29] Fetching php74-openssl-7.4.21.txz: ........ done
[13/29] Fetching php74-mbstring-7.4.21.txz: .......... done
[14/29] Fetching php74-ldap-7.4.21.txz: .... done
[15/29] Fetching php74-json-7.4.21.txz: ... done
[16/29] Fetching php74-gettext-7.4.21.txz: . done
[17/29] Fetching php74-filter-7.4.21.txz: ... done
[18/29] Fetching php74-dom-7.4.21.txz: ....... done
[19/29] Fetching php74-curl-7.4.21.txz: .... done
[20/29] Fetching php74-ctype-7.4.21.txz: . done
[21/29] Fetching php74-7.4.21.txz: .......... done
[22/29] Fetching opnsense-installer-21.7.txz: ... done
[23/29] Fetching opnsense-21.1.9.txz: .......... done
[24/29] Fetching nss-3.68.txz: .......... done
[25/29] Fetching nspr-4.32.txz: .......... done
[26/29] Fetching monit-5.28.0.txz: .......... done
[27/29] Fetching filterlog-0.4_2.txz: ...... done
[28/29] Fetching curl-7.78.0.txz: .......... done
[29/29] Fetching ca_root_nss-3.68.txz: .......... done
Checking integrity... done (0 conflicting)
[1/29] Upgrading python37 from 3.7.10_1 to 3.7.11...
[1/29] Extracting python37-3.7.11: .......... done
[2/29] Upgrading py37-cffi from 1.14.5 to 1.14.6...
[2/29] Extracting py37-cffi-1.14.6: .......... done
[3/29] Upgrading php74 from 7.4.20 to 7.4.21...
[3/29] Extracting php74-7.4.21: .......... done
[4/29] Upgrading nspr from 4.31 to 4.32...
[4/29] Extracting nspr-4.32: .......... done
[5/29] Upgrading ca_root_nss from 3.63 to 3.68...
[5/29] Extracting ca_root_nss-3.68: ...... done
[6/29] Upgrading php74-session from 7.4.20 to 7.4.21...
[6/29] Extracting php74-session-7.4.21: .......... done
[7/29] Upgrading php74-pdo from 7.4.20 to 7.4.21...
[7/29] Extracting php74-pdo-7.4.21: .......... done
[8/29] Upgrading php74-mbstring from 7.4.20 to 7.4.21...
[8/29] Extracting php74-mbstring-7.4.21: .......... done
[9/29] Upgrading php74-json from 7.4.20 to 7.4.21...
[9/29] Extracting php74-json-7.4.21: .......... done
[10/29] Upgrading nss from 3.67 to 3.68...
[10/29] Extracting nss-3.68: .......... done
[11/29] Upgrading curl from 7.77.0 to 7.78.0...
[11/29] Extracting curl-7.78.0: .......... done
[12/29] Upgrading syslog-ng from 3.32.1 to 3.33.2...
[12/29] Extracting syslog-ng-3.33.2: .......... done
[13/29] Upgrading py37-sqlite3 from 3.7.10_7 to 3.7.11_7...
[13/29] Extracting py37-sqlite3-3.7.11_7: ........ done
[14/29] Upgrading php74-zlib from 7.4.20 to 7.4.21...
[14/29] Extracting php74-zlib-7.4.21: ....... done
[15/29] Upgrading php74-xml from 7.4.20 to 7.4.21...
[15/29] Extracting php74-xml-7.4.21: ........ done
[16/29] Upgrading php74-sqlite3 from 7.4.20 to 7.4.21...
[16/29] Extracting php74-sqlite3-7.4.21: ........ done
[17/29] Upgrading php74-sockets from 7.4.20 to 7.4.21...
[17/29] Extracting php74-sockets-7.4.21: .......... done
[18/29] Upgrading php74-simplexml from 7.4.20 to 7.4.21...
[18/29] Extracting php74-simplexml-7.4.21: ......... done
[19/29] Upgrading php74-openssl from 7.4.20 to 7.4.21...
[19/29] Extracting php74-openssl-7.4.21: ....... done
[20/29] Upgrading php74-ldap from 7.4.20 to 7.4.21...
[20/29] Extracting php74-ldap-7.4.21: ....... done
[21/29] Upgrading php74-gettext from 7.4.20 to 7.4.21...
[21/29] Extracting php74-gettext-7.4.21: ....... done
[22/29] Upgrading php74-filter from 7.4.20 to 7.4.21...
[22/29] Extracting php74-filter-7.4.21: ........ done
[23/29] Upgrading php74-dom from 7.4.20 to 7.4.21...
[23/29] Extracting php74-dom-7.4.21: .......... done
[24/29] Upgrading php74-curl from 7.4.20 to 7.4.21...
[24/29] Extracting php74-curl-7.4.21: ....... done
[25/29] Upgrading php74-ctype from 7.4.20 to 7.4.21...
[25/29] Extracting php74-ctype-7.4.21: ....... done
[26/29] Upgrading opnsense-installer from 0.10 to 21.7...
[26/29] Extracting opnsense-installer-21.7: .......... done
[27/29] Reinstalling monit-5.28.0...
[27/29] Extracting monit-5.28.0: ....... done
[28/29] Upgrading filterlog from 0.4 to 0.4_2...
[28/29] Extracting filterlog-0.4_2: .... done
[29/29] Upgrading opnsense from 21.1.8_1 to 21.1.9...
[29/29] Extracting opnsense-21.1.9: .......... done
Stopping configd...done
Resetting root shell
Updating /etc/shells
Unhooking from /etc/rc
Unhooking from /etc/rc.shutdown
Updating /etc/shells
Registering root shell
Hooking into /etc/rc
Hooking into /etc/rc.shutdown
Starting configd.
>>> Invoking update script 'refresh'
Keep version OPNsense\Monit\Monit (1.0.9)
Keep version OPNsense\Firewall\Alias (1.0.0)
Keep version OPNsense\Firewall\Category (1.0.0)
Keep version OPNsense\OpenVPN\Export (0.0.1)
Keep version OPNsense\CaptivePortal\CaptivePortal (1.0.0)
Keep version OPNsense\Core\Firmware (1.0.0)
Keep version OPNsense\Interfaces\Loopback (1.0.0)
Keep version OPNsense\Interfaces\VxLan (1.0.1)
Keep version OPNsense\Unboundplus\Dnsbl (0.0.1)
Keep version OPNsense\Unboundplus\Miscellaneous (0.0.2)
Keep version OPNsense\Cron\Cron (1.0.2)
Keep version OPNsense\IPsec\IPsec (1.0.0)
Keep version OPNsense\Backup\NextcloudSettings (1.0.0)
Keep version OPNsense\TrafficShaper\TrafficShaper (1.0.3)
Keep version OPNsense\Syslog\Syslog (1.0.0)
Keep version OPNsense\IDS\IDS (1.0.6)
Keep version OPNsense\Proxy\Proxy (1.0.4)
Keep version OPNsense\Diagnostics\Netflow (1.0.1)
Keep version OPNsense\Diagnostics\Lvtemplate (0.0.1)
Keep version OPNsense\Routes\Route (1.0.0)
Keep version OPNsense\Wol\Wol (1.0.0)
Keep version OPNsense\Wireguard\General (0.0.1)
Keep version OPNsense\Wireguard\Server (0.0.2)
Keep version OPNsense\Wireguard\Client (0.0.6)
Writing firmware setting...done.
Writing trust files...done.
Configuring login behaviour...done.
Configuring system logging...done.
You may need to manually remove /usr/local/etc/ssl/cert.pem if it is no longer needed.
You may need to manually remove /usr/local/openssl/cert.pem if it is no longer needed.
You may need to manually remove /usr/local/etc/syslog-ng.conf if it is no longer needed.
=====
Message from opnsense-21.1.9:

--
What are you looking at?
Checking integrity... done (0 conflicting)
Nothing to do.
Checking all packages: .......... done
The following package files will be deleted:
   /var/cache/pkg/syslog-ng-3.33.2~6c376e7982.txz
   /var/cache/pkg/py37-sqlite3-3.7.11_7.txz
   /var/cache/pkg/syslog-ng-3.33.2.txz
   /var/cache/pkg/python37-3.7.11~024bceafdb.txz
   /var/cache/pkg/python37-3.7.11.txz
   /var/cache/pkg/py37-sqlite3-3.7.11_7~0d8e85655e.txz
   /var/cache/pkg/py37-cffi-1.14.6~c4813eb4af.txz
   /var/cache/pkg/py37-cffi-1.14.6.txz
   /var/cache/pkg/php74-zlib-7.4.21~4f9b486419.txz
   /var/cache/pkg/php74-zlib-7.4.21.txz
   /var/cache/pkg/php74-xml-7.4.21~4594992ca8.txz
   /var/cache/pkg/php74-xml-7.4.21.txz
   /var/cache/pkg/php74-sqlite3-7.4.21~1087a6de8e.txz
   /var/cache/pkg/php74-pdo-7.4.21~9d780ce64e.txz
   /var/cache/pkg/php74-sqlite3-7.4.21.txz
   /var/cache/pkg/php74-sockets-7.4.21~318a593065.txz
   /var/cache/pkg/php74-sockets-7.4.21.txz
   /var/cache/pkg/php74-simplexml-7.4.21~dda830ced1.txz
   /var/cache/pkg/php74-simplexml-7.4.21.txz
   /var/cache/pkg/php74-session-7.4.21~2e0763e575.txz
   /var/cache/pkg/php74-session-7.4.21.txz
   /var/cache/pkg/php74-openssl-7.4.21.txz
   /var/cache/pkg/php74-pdo-7.4.21.txz
   /var/cache/pkg/php74-openssl-7.4.21~a69b02fae2.txz
   /var/cache/pkg/php74-mbstring-7.4.21~b8f22e462d.txz
   /var/cache/pkg/php74-ldap-7.4.21.txz
   /var/cache/pkg/php74-dom-7.4.21~02da277685.txz
   /var/cache/pkg/php74-mbstring-7.4.21.txz
   /var/cache/pkg/php74-ldap-7.4.21~91fae3e20d.txz
   /var/cache/pkg/php74-json-7.4.21~a92fc4043f.txz
   /var/cache/pkg/php74-json-7.4.21.txz
   /var/cache/pkg/php74-gettext-7.4.21~87373c9611.txz
   /var/cache/pkg/php74-gettext-7.4.21.txz
   /var/cache/pkg/php74-filter-7.4.21~6afc3f9d7a.txz
   /var/cache/pkg/php74-filter-7.4.21.txz
   /var/cache/pkg/php74-dom-7.4.21.txz
   /var/cache/pkg/php74-curl-7.4.21~1645fc8853.txz
   /var/cache/pkg/php74-curl-7.4.21.txz
   /var/cache/pkg/php74-ctype-7.4.21~e77813bd37.txz
   /var/cache/pkg/php74-7.4.21~c40f688ed7.txz
   /var/cache/pkg/php74-ctype-7.4.21.txz
   /var/cache/pkg/nss-3.68~a578c55368.txz
   /var/cache/pkg/php74-7.4.21.txz
   /var/cache/pkg/opnsense-installer-21.7~73cdb1077f.txz
   /var/cache/pkg/opnsense-21.1.9~9135bb9250.txz
   /var/cache/pkg/opnsense-installer-21.7.txz
   /var/cache/pkg/opnsense-21.1.9.txz
   /var/cache/pkg/monit-5.28.0.txz
   /var/cache/pkg/nss-3.68.txz
   /var/cache/pkg/nspr-4.32~c6d3c30cb5.txz
   /var/cache/pkg/nspr-4.32.txz
   /var/cache/pkg/monit-5.28.0~506ff4319e.txz
   /var/cache/pkg/filterlog-0.4_2~24277c303c.txz
   /var/cache/pkg/curl-7.78.0~51364ee8df.txz
   /var/cache/pkg/filterlog-0.4_2.txz
   /var/cache/pkg/curl-7.78.0.txz
   /var/cache/pkg/ca_root_nss-3.68~4366694f46.txz
   /var/cache/pkg/ca_root_nss-3.68.txz
The cleanup will free 31 MiB
Deleting files: .......... done
All done
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
The following packages will be fetched:

New packages to be FETCHED:
   opnsense: 21.1.9 (4 MiB: 50.00% of the 8 MiB to download)
   opnsense-devel: 21.7.b_134 (4 MiB: 50.00% of the 8 MiB to download)

Number of packages to be fetched: 2

The process will require 8 MiB more space.
8 MiB to be downloaded.
Fetching opnsense-21.1.9.txz: .......... done
Fetching opnsense-devel-21.7.b_134.txz: .......... done
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
The following 2 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
   opnsense-devel: 21.7.b_134
   suricata-devel: 6.0.3

Number of packages to be installed: 2

The process will require 29 MiB more space.
2 MiB to be downloaded.
[1/1] Fetching suricata-devel-6.0.3.txz: .......... done
Checking integrity... done (2 conflicting)
  - opnsense-devel-21.7.b_134 conflicts with opnsense-21.1.9 on /boot/brand-opnsense.4th
  - suricata-devel-6.0.3 conflicts with suricata-5.0.7 on /usr/local/bin/suricata
Checking integrity... done (0 conflicting)
Conflicts with the existing packages have been found.
One more solver iteration is needed to resolve them.
The following 4 package(s) will be affected (of 0 checked):

Installed packages to be REMOVED:
   opnsense: 21.1.9
   suricata: 5.0.7

New packages to be INSTALLED:
   opnsense-devel: 21.7.b_134
   suricata-devel: 6.0.3

Number of packages to be removed: 2
Number of packages to be installed: 2
[1/4] Deinstalling opnsense-21.1.9...
Stopping configd...done
Resetting root shell
Updating /etc/shells
Unhooking from /etc/rc
Unhooking from /etc/rc.shutdown
[1/4] Deleting files for opnsense-21.1.9: .......... done
[2/4] Deinstalling suricata-5.0.7...
[2/4] Deleting files for suricata-5.0.7: .......... done
==> If you are permanently removing this port, run rm -rf /usr/local/etc/suricata to remove configuration files.
[3/4] Installing suricata-devel-6.0.3...
[3/4] Extracting suricata-devel-6.0.3: .......... done
[4/4] Installing opnsense-devel-21.7.b_134...
[4/4] Extracting opnsense-devel-21.7.b_134: .......... done
Updating /etc/shells
Registering root shell
Hooking into /etc/rc
Hooking into /etc/rc.shutdown
Starting configd.
>>> Invoking update script 'refresh'
Keep version OPNsense\CaptivePortal\CaptivePortal (1.0.0)
Keep version OPNsense\Core\Firmware (1.0.0)
Keep version OPNsense\Cron\Cron (1.0.2)
Keep version OPNsense\Diagnostics\Netflow (1.0.1)
Keep version OPNsense\Diagnostics\Lvtemplate (0.0.1)
Keep version OPNsense\Firewall\Category (1.0.0)
Keep version OPNsense\Firewall\Alias (1.0.0)
Keep version OPNsense\IDS\IDS (1.0.6)
Keep version OPNsense\IPsec\IPsec (1.0.0)
Keep version OPNsense\Interfaces\VxLan (1.0.1)
Keep version OPNsense\Interfaces\Loopback (1.0.0)
Keep version OPNsense\Monit\Monit (1.0.9)
Keep version OPNsense\OpenVPN\Export (0.0.1)
Keep version OPNsense\Proxy\Proxy (1.0.4)
Keep version OPNsense\Routes\Route (1.0.0)
Keep version OPNsense\Syslog\Syslog (1.0.0)
Keep version OPNsense\TrafficShaper\TrafficShaper (1.0.3)
Migrated OPNsense\Unbound\Unbound from <unversioned> to 1.0.0
Keep version OPNsense\Wol\Wol (1.0.0)
Keep version OPNsense\Wireguard\General (0.0.1)
Keep version OPNsense\Wireguard\Server (0.0.2)
Keep version OPNsense\Wireguard\Client (0.0.6)
Writing firmware setting...done.
Writing trust files...done.
Configuring login behaviour...done.
Configuring system logging...done.
You may need to manually remove /usr/local/etc/suricata/classification.config if it is no longer needed.
You may need to manually remove /usr/local/etc/suricata/reference.config if it is no longer needed.
You may need to manually remove /usr/local/etc/suricata/suricata.yaml if it is no longer needed.
=====
Message from suricata-devel-6.0.3:

--
If you want to run Suricata in IDS mode, add to /etc/rc.conf:

   suricata_enable="YES"
   suricata_interface="<if>"

NOTE: Declaring suricata_interface is MANDATORY for Suricata in IDS Mode.

However, if you want to run Suricata in Inline IPS Mode in divert(4) mode,
add to /etc/rc.conf:

   suricata_enable="YES"
   suricata_divertport="8000"

NOTE:
   Suricata won't start in IDS mode without an interface configured.
   Therefore if you omit suricata_interface from rc.conf, FreeBSD's
   rc.d/suricata will automatically try to start Suricata in IPS Mode
   (on divert port 8000, by default).

Alternatively, if you want to run Suricata in Inline IPS Mode in high-speed
netmap(4) mode, add to /etc/rc.conf:

   suricata_enable="YES"
   suricata_netmap="YES"

NOTE:
   Suricata requires additional interface settings in the configuration
   file to run in netmap(4) mode.

RULES: Suricata IDS/IPS Engine comes without rules by default. You should
add rules by yourself and set an updating strategy. To do so, please visit:

http://www.openinfosecfoundation.org/documentation/rules.html
http://www.openinfosecfoundation.org/documentation/emerging-threats.html

You may want to try BPF in zerocopy mode to test performance improvements:

   sysctl -w net.bpf.zerocopy_enable=1

Don't forget to add net.bpf.zerocopy_enable=1 to /etc/sysctl.conf
=====
Message from opnsense-devel-21.7.b_134:

--
Carry on my wayward son
Your system is up to date.
Starting web GUI...done.
Generating RRD graphs...done.
***DONE******GOT REQUEST TO UPDATE***
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
Checking for upgrades (29 candidates): .......... done
Processing candidates (29 candidates): .......... done
The following 29 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
   ca_root_nss: 3.63 -> 3.68
   curl: 7.77.0 -> 7.78.0
   filterlog: 0.4 -> 0.4_2
   nspr: 4.31 -> 4.32
   nss: 3.67 -> 3.68
   opnsense: 21.1.8_1 -> 21.1.9
   opnsense-installer: 0.10 -> 21.7
   php74: 7.4.20 -> 7.4.21
   php74-ctype: 7.4.20 -> 7.4.21
   php74-curl: 7.4.20 -> 7.4.21
   php74-dom: 7.4.20 -> 7.4.21
   php74-filter: 7.4.20 -> 7.4.21
   php74-gettext: 7.4.20 -> 7.4.21
   php74-json: 7.4.20 -> 7.4.21
   php74-ldap: 7.4.20 -> 7.4.21
   php74-mbstring: 7.4.20 -> 7.4.21
   php74-openssl: 7.4.20 -> 7.4.21
   php74-pdo: 7.4.20 -> 7.4.21
   php74-session: 7.4.20 -> 7.4.21
   php74-simplexml: 7.4.20 -> 7.4.21
   php74-sockets: 7.4.20 -> 7.4.21
   php74-sqlite3: 7.4.20 -> 7.4.21
   php74-xml: 7.4.20 -> 7.4.21
   php74-zlib: 7.4.20 -> 7.4.21
   py37-cffi: 1.14.5 -> 1.14.6
   py37-sqlite3: 3.7.10_7 -> 3.7.11_7
   python37: 3.7.10_1 -> 3.7.11
   syslog-ng: 3.32.1 -> 3.33.2

Installed packages to be REINSTALLED:
   monit-5.28.0 (options changed)

Number of packages to be upgraded: 28
Number of packages to be reinstalled: 1

31 MiB to be downloaded.
[1/29] Fetching syslog-ng-3.33.2.txz: .......... done
[2/29] Fetching python37-3.7.11.txz: .......... done
[3/29] Fetching py37-sqlite3-3.7.11_7.txz: .... done
[4/29] Fetching py37-cffi-1.14.6.txz: .......... done
[5/29] Fetching php74-zlib-7.4.21.txz: ... done
[6/29] Fetching php74-xml-7.4.21.txz: ... done
[7/29] Fetching php74-sqlite3-7.4.21.txz: ... done
[8/29] Fetching php74-sockets-7.4.21.txz: ..... done
[9/29] Fetching php74-simplexml-7.4.21.txz: ... done
[10/29] Fetching php74-session-7.4.21.txz: ..... done
[11/29] Fetching php74-pdo-7.4.21.txz: ...... done
[12/29] Fetching php74-openssl-7.4.21.txz: ........ done
[13/29] Fetching php74-mbstring-7.4.21.txz: .......... done
[14/29] Fetching php74-ldap-7.4.21.txz: .... done
[15/29] Fetching php74-json-7.4.21.txz: ... done
[16/29] Fetching php74-gettext-7.4.21.txz: . done
[17/29] Fetching php74-filter-7.4.21.txz: ... done
[18/29] Fetching php74-dom-7.4.21.txz: ....... done
[19/29] Fetching php74-curl-7.4.21.txz: .... done
[20/29] Fetching php74-ctype-7.4.21.txz: . done
[21/29] Fetching php74-7.4.21.txz: .......... done
[22/29] Fetching opnsense-installer-21.7.txz: ... done
[23/29] Fetching opnsense-21.1.9.txz: .......... done
[24/29] Fetching nss-3.68.txz: .......... done
[25/29] Fetching nspr-4.32.txz: .......... done
[26/29] Fetching monit-5.28.0.txz: .......... done
[27/29] Fetching filterlog-0.4_2.txz: ...... done
[28/29] Fetching curl-7.78.0.txz: .......... done
[29/29] Fetching ca_root_nss-3.68.txz: .......... done
Checking integrity... done (0 conflicting)
[1/29] Upgrading python37 from 3.7.10_1 to 3.7.11...
[1/29] Extracting python37-3.7.11: .......... done
[2/29] Upgrading py37-cffi from 1.14.5 to 1.14.6...
[2/29] Extracting py37-cffi-1.14.6: .......... done
[3/29] Upgrading php74 from 7.4.20 to 7.4.21...
[3/29] Extracting php74-7.4.21: .......... done
[4/29] Upgrading nspr from 4.31 to 4.32...
[4/29] Extracting nspr-4.32: .......... done
[5/29] Upgrading ca_root_nss from 3.63 to 3.68...
[5/29] Extracting ca_root_nss-3.68: ...... done
[6/29] Upgrading php74-session from 7.4.20 to 7.4.21...
[6/29] Extracting php74-session-7.4.21: .......... done
[7/29] Upgrading php74-pdo from 7.4.20 to 7.4.21...
[7/29] Extracting php74-pdo-7.4.21: .......... done
[8/29] Upgrading php74-mbstring from 7.4.20 to 7.4.21...
[8/29] Extracting php74-mbstring-7.4.21: .......... done
[9/29] Upgrading php74-json from 7.4.20 to 7.4.21...
[9/29] Extracting php74-json-7.4.21: .......... done
[10/29] Upgrading nss from 3.67 to 3.68...
[10/29] Extracting nss-3.68: .......... done
[11/29] Upgrading curl from 7.77.0 to 7.78.0...
[11/29] Extracting curl-7.78.0: .......... done
[12/29] Upgrading syslog-ng from 3.32.1 to 3.33.2...
[12/29] Extracting syslog-ng-3.33.2: .......... done
[13/29] Upgrading py37-sqlite3 from 3.7.10_7 to 3.7.11_7...
[13/29] Extracting py37-sqlite3-3.7.11_7: ........ done
[14/29] Upgrading php74-zlib from 7.4.20 to 7.4.21...
[14/29] Extracting php74-zlib-7.4.21: ....... done
[15/29] Upgrading php74-xml from 7.4.20 to 7.4.21...
[15/29] Extracting php74-xml-7.4.21: ........ done
[16/29] Upgrading php74-sqlite3 from 7.4.20 to 7.4.21...
[16/29] Extracting php74-sqlite3-7.4.21: ........ done
[17/29] Upgrading php74-sockets from 7.4.20 to 7.4.21...
[17/29] Extracting php74-sockets-7.4.21: .......... done
[18/29] Upgrading php74-simplexml from 7.4.20 to 7.4.21...
[18/29] Extracting php74-simplexml-7.4.21: ......... done
[19/29] Upgrading php74-openssl from 7.4.20 to 7.4.21...
[19/29] Extracting php74-openssl-7.4.21: ....... done
[20/29] Upgrading php74-ldap from 7.4.20 to 7.4.21...
[20/29] Extracting php74-ldap-7.4.21: ....... done
[21/29] Upgrading php74-gettext from 7.4.20 to 7.4.21...
[21/29] Extracting php74-gettext-7.4.21: ....... done
[22/29] Upgrading php74-filter from 7.4.20 to 7.4.21...
[22/29] Extracting php74-filter-7.4.21: ........ done
[23/29] Upgrading php74-dom from 7.4.20 to 7.4.21...
[23/29] Extracting php74-dom-7.4.21: .......... done
[24/29] Upgrading php74-curl from 7.4.20 to 7.4.21...
[24/29] Extracting php74-curl-7.4.21: ....... done
[25/29] Upgrading php74-ctype from 7.4.20 to 7.4.21...
[25/29] Extracting php74-ctype-7.4.21: ....... done
[26/29] Upgrading opnsense-installer from 0.10 to 21.7...
[26/29] Extracting opnsense-installer-21.7: .......... done
[27/29] Reinstalling monit-5.28.0...
[27/29] Extracting monit-5.28.0: ....... done
[28/29] Upgrading filterlog from 0.4 to 0.4_2...
[28/29] Extracting filterlog-0.4_2: .... done
[29/29] Upgrading opnsense from 21.1.8_1 to 21.1.9...
[29/29] Extracting opnsense-21.1.9: .......... done
Stopping configd...done
Resetting root shell
Updating /etc/shells
Unhooking from /etc/rc
Unhooking from /etc/rc.shutdown
Updating /etc/shells
Registering root shell
Hooking into /etc/rc
Hooking into /etc/rc.shutdown
Starting configd.
>>> Invoking update script 'refresh'
Keep version OPNsense\Monit\Monit (1.0.9)
Keep version OPNsense\Firewall\Alias (1.0.0)
Keep version OPNsense\Firewall\Category (1.0.0)
Keep version OPNsense\OpenVPN\Export (0.0.1)
Keep version OPNsense\CaptivePortal\CaptivePortal (1.0.0)
Keep version OPNsense\Core\Firmware (1.0.0)
Keep version OPNsense\Interfaces\Loopback (1.0.0)
Keep version OPNsense\Interfaces\VxLan (1.0.1)
Keep version OPNsense\Unboundplus\Dnsbl (0.0.1)
Keep version OPNsense\Unboundplus\Miscellaneous (0.0.2)
Keep version OPNsense\Cron\Cron (1.0.2)
Keep version OPNsense\IPsec\IPsec (1.0.0)
Keep version OPNsense\Backup\NextcloudSettings (1.0.0)
Keep version OPNsense\TrafficShaper\TrafficShaper (1.0.3)
Keep version OPNsense\Syslog\Syslog (1.0.0)
Keep version OPNsense\IDS\IDS (1.0.6)
Keep version OPNsense\Proxy\Proxy (1.0.4)
Keep version OPNsense\Diagnostics\Netflow (1.0.1)
Keep version OPNsense\Diagnostics\Lvtemplate (0.0.1)
Keep version OPNsense\Routes\Route (1.0.0)
Keep version OPNsense\Wol\Wol (1.0.0)
Keep version OPNsense\Wireguard\General (0.0.1)
Keep version OPNsense\Wireguard\Server (0.0.2)
Keep version OPNsense\Wireguard\Client (0.0.6)
Writing firmware setting...done.
Writing trust files...done.
Configuring login behaviour...done.
Configuring system logging...done.
You may need to manually remove /usr/local/etc/ssl/cert.pem if it is no longer needed.
You may need to manually remove /usr/local/openssl/cert.pem if it is no longer needed.
You may need to manually remove /usr/local/etc/syslog-ng.conf if it is no longer needed.
=====
Message from opnsense-21.1.9:

--
What are you looking at?
Checking integrity... done (0 conflicting)
Nothing to do.
Checking all packages: .......... done
The following package files will be deleted:
   /var/cache/pkg/syslog-ng-3.33.2~6c376e7982.txz
   /var/cache/pkg/py37-sqlite3-3.7.11_7.txz
   /var/cache/pkg/syslog-ng-3.33.2.txz
   /var/cache/pkg/python37-3.7.11~024bceafdb.txz
   /var/cache/pkg/python37-3.7.11.txz
   /var/cache/pkg/py37-sqlite3-3.7.11_7~0d8e85655e.txz
   /var/cache/pkg/py37-cffi-1.14.6~c4813eb4af.txz
   /var/cache/pkg/py37-cffi-1.14.6.txz
   /var/cache/pkg/php74-zlib-7.4.21~4f9b486419.txz
   /var/cache/pkg/php74-zlib-7.4.21.txz
   /var/cache/pkg/php74-xml-7.4.21~4594992ca8.txz
   /var/cache/pkg/php74-xml-7.4.21.txz
   /var/cache/pkg/php74-sqlite3-7.4.21~1087a6de8e.txz
   /var/cache/pkg/php74-pdo-7.4.21~9d780ce64e.txz
   /var/cache/pkg/php74-sqlite3-7.4.21.txz
   /var/cache/pkg/php74-sockets-7.4.21~318a593065.txz
   /var/cache/pkg/php74-sockets-7.4.21.txz
   /var/cache/pkg/php74-simplexml-7.4.21~dda830ced1.txz
   /var/cache/pkg/php74-simplexml-7.4.21.txz
   /var/cache/pkg/php74-session-7.4.21~2e0763e575.txz
   /var/cache/pkg/php74-session-7.4.21.txz
   /var/cache/pkg/php74-openssl-7.4.21.txz
   /var/cache/pkg/php74-pdo-7.4.21.txz
   /var/cache/pkg/php74-openssl-7.4.21~a69b02fae2.txz
   /var/cache/pkg/php74-mbstring-7.4.21~b8f22e462d.txz
   /var/cache/pkg/php74-ldap-7.4.21.txz
   /var/cache/pkg/php74-dom-7.4.21~02da277685.txz
   /var/cache/pkg/php74-mbstring-7.4.21.txz
   /var/cache/pkg/php74-ldap-7.4.21~91fae3e20d.txz
   /var/cache/pkg/php74-json-7.4.21~a92fc4043f.txz
   /var/cache/pkg/php74-json-7.4.21.txz
   /var/cache/pkg/php74-gettext-7.4.21~87373c9611.txz
   /var/cache/pkg/php74-gettext-7.4.21.txz
   /var/cache/pkg/php74-filter-7.4.21~6afc3f9d7a.txz
   /var/cache/pkg/php74-filter-7.4.21.txz
   /var/cache/pkg/php74-dom-7.4.21.txz
   /var/cache/pkg/php74-curl-7.4.21~1645fc8853.txz
   /var/cache/pkg/php74-curl-7.4.21.txz
   /var/cache/pkg/php74-ctype-7.4.21~e77813bd37.txz
   /var/cache/pkg/php74-7.4.21~c40f688ed7.txz
   /var/cache/pkg/php74-ctype-7.4.21.txz
   /var/cache/pkg/nss-3.68~a578c55368.txz
   /var/cache/pkg/php74-7.4.21.txz
   /var/cache/pkg/opnsense-installer-21.7~73cdb1077f.txz
   /var/cache/pkg/opnsense-21.1.9~9135bb9250.txz
   /var/cache/pkg/opnsense-installer-21.7.txz
   /var/cache/pkg/opnsense-21.1.9.txz
   /var/cache/pkg/monit-5.28.0.txz
   /var/cache/pkg/nss-3.68.txz
   /var/cache/pkg/nspr-4.32~c6d3c30cb5.txz
   /var/cache/pkg/nspr-4.32.txz
   /var/cache/pkg/monit-5.28.0~506ff4319e.txz
   /var/cache/pkg/filterlog-0.4_2~24277c303c.txz
   /var/cache/pkg/curl-7.78.0~51364ee8df.txz
   /var/cache/pkg/filterlog-0.4_2.txz
   /var/cache/pkg/curl-7.78.0.txz
   /var/cache/pkg/ca_root_nss-3.68~4366694f46.txz
   /var/cache/pkg/ca_root_nss-3.68.txz
The cleanup will free 31 MiB
Deleting files: .......... done
All done
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
The following packages will be fetched:

New packages to be FETCHED:
   opnsense: 21.1.9 (4 MiB: 50.00% of the 8 MiB to download)
   opnsense-devel: 21.7.b_134 (4 MiB: 50.00% of the 8 MiB to download)

Number of packages to be fetched: 2

The process will require 8 MiB more space.
8 MiB to be downloaded.
Fetching opnsense-21.1.9.txz: .......... done
Fetching opnsense-devel-21.7.b_134.txz: .......... done
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
All repositories are up to date.
The following 2 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
   opnsense-devel: 21.7.b_134
   suricata-devel: 6.0.3

Number of packages to be installed: 2

The process will require 29 MiB more space.
2 MiB to be downloaded.
[1/1] Fetching suricata-devel-6.0.3.txz: .......... done
Checking integrity... done (2 conflicting)
  - opnsense-devel-21.7.b_134 conflicts with opnsense-21.1.9 on /boot/brand-opnsense.4th
  - suricata-devel-6.0.3 conflicts with suricata-5.0.7 on /usr/local/bin/suricata
Checking integrity... done (0 conflicting)
Conflicts with the existing packages have been found.
One more solver iteration is needed to resolve them.
The following 4 package(s) will be affected (of 0 checked):

Installed packages to be REMOVED:
   opnsense: 21.1.9
   suricata: 5.0.7

New packages to be INSTALLED:
   opnsense-devel: 21.7.b_134
   suricata-devel: 6.0.3

Number of packages to be removed: 2
Number of packages to be installed: 2
[1/4] Deinstalling opnsense-21.1.9...
Stopping configd...done
Resetting root shell
Updating /etc/shells
Unhooking from /etc/rc
Unhooking from /etc/rc.shutdown
[1/4] Deleting files for opnsense-21.1.9: .......... done
[2/4] Deinstalling suricata-5.0.7...
[2/4] Deleting files for suricata-5.0.7: .......... done
==> If you are permanently removing this port, run rm -rf /usr/local/etc/suricata to remove configuration files.
[3/4] Installing suricata-devel-6.0.3...
[3/4] Extracting suricata-devel-6.0.3: .......... done
[4/4] Installing opnsense-devel-21.7.b_134...
[4/4] Extracting opnsense-devel-21.7.b_134: .......... done
Updating /etc/shells
Registering root shell
Hooking into /etc/rc
Hooking into /etc/rc.shutdown
Starting configd.
>>> Invoking update script 'refresh'
Keep version OPNsense\CaptivePortal\CaptivePortal (1.0.0)
Keep version OPNsense\Core\Firmware (1.0.0)
Keep version OPNsense\Cron\Cron (1.0.2)
Keep version OPNsense\Diagnostics\Netflow (1.0.1)
Keep version OPNsense\Diagnostics\Lvtemplate (0.0.1)
Keep version OPNsense\Firewall\Category (1.0.0)
Keep version OPNsense\Firewall\Alias (1.0.0)
Keep version OPNsense\IDS\IDS (1.0.6)
Keep version OPNsense\IPsec\IPsec (1.0.0)
Keep version OPNsense\Interfaces\VxLan (1.0.1)
Keep version OPNsense\Interfaces\Loopback (1.0.0)
Keep version OPNsense\Monit\Monit (1.0.9)
Keep version OPNsense\OpenVPN\Export (0.0.1)
Keep version OPNsense\Proxy\Proxy (1.0.4)
Keep version OPNsense\Routes\Route (1.0.0)
Keep version OPNsense\Syslog\Syslog (1.0.0)
Keep version OPNsense\TrafficShaper\TrafficShaper (1.0.3)
Migrated OPNsense\Unbound\Unbound from <unversioned> to 1.0.0
Keep version OPNsense\Wol\Wol (1.0.0)
Keep version OPNsense\Wireguard\General (0.0.1)
Keep version OPNsense\Wireguard\Server (0.0.2)
Keep version OPNsense\Wireguard\Client (0.0.6)
Writing firmware setting...done.
Writing trust files...done.
Configuring login behaviour...done.
Configuring system logging...done.
You may need to manually remove /usr/local/etc/suricata/classification.config if it is no longer needed.
You may need to manually remove /usr/local/etc/suricata/reference.config if it is no longer needed.
You may need to manually remove /usr/local/etc/suricata/suricata.yaml if it is no longer needed.
=====
Message from suricata-devel-6.0.3:

--
If you want to run Suricata in IDS mode, add to /etc/rc.conf:

   suricata_enable="YES"
   suricata_interface="<if>"

NOTE: Declaring suricata_interface is MANDATORY for Suricata in IDS Mode.

However, if you want to run Suricata in Inline IPS Mode in divert(4) mode,
add to /etc/rc.conf:

   suricata_enable="YES"
   suricata_divertport="8000"

NOTE:
   Suricata won't start in IDS mode without an interface configured.
   Therefore if you omit suricata_interface from rc.conf, FreeBSD's
   rc.d/suricata will automatically try to start Suricata in IPS Mode
   (on divert port 8000, by default).

Alternatively, if you want to run Suricata in Inline IPS Mode in high-speed
netmap(4) mode, add to /etc/rc.conf:

   suricata_enable="YES"
   suricata_netmap="YES"

NOTE:
   Suricata requires additional interface settings in the configuration
   file to run in netmap(4) mode.

RULES: Suricata IDS/IPS Engine comes without rules by default. You should
add rules by yourself and set an updating strategy. To do so, please visit:

http://www.openinfosecfoundation.org/documentation/rules.html
http://www.openinfosecfoundation.org/documentation/emerging-threats.html

You may want to try BPF in zerocopy mode to test performance improvements:

   sysctl -w net.bpf.zerocopy_enable=1

Don't forget to add net.bpf.zerocopy_enable=1 to /etc/sysctl.conf
=====
Message from opnsense-devel-21.7.b_134:

--
Carry on my wayward son
Your system is up to date.
Starting web GUI...done.
Generating RRD graphs...done.
***DONE***

Entered 3 servers on the DoT page and set the tick box under "Advanced" for "strict Qname minisation"

Is it necessary to set the tick box "DNS query forwarding" under "General"?

Many thanks in advance!

[franco]

"DNS query forwarding" adds the system's domain servers as forwarding servers to ask so you don't want to enable that. Forwarding for DoT is automatically enabled when you have at least one enabled DoT server.


Cheers,
Franco

[chemlud]

I made a mistake. After switching back to "Community" I pressed the update button and switched back to ... whatever... 21.1.9 is shown in the GUI.

***GOT REQUEST TO AUDIT HEALTH***
Currently running OPNsense 21.1.9 (amd64/LibreSSL) at Wed Jul 28 08:38:19 CEST 2021
>>> Check installed kernel version
Version 21.1.8 is correct.
>>> Check for missing or altered kernel files
No problems detected.
>>> Check installed base version
Version 21.1.8 is correct.
>>> Check for missing or altered base files
No problems detected.
>>> Check for missing package dependencies
Checking all packages: .......... done
>>> Check for missing or altered package files
Checking all packages: .......... done
>>> Check for core packages consistency
Core package "opnsense" has 66 dependencies to check.
Checking packages: .................................................................... done
***DONE***

Worst thing: Now the SSD it 90% full (see attachment) and I have no idea with what...

And the DoT tab in unbound is gone. No idea which configuration of unbound is valid at that time. Will updating to 21.7 later today resolve this mess?

[Taomyn]

Worst thing: Now the SSD it 90% full (see attachment) and I have no idea with what...

That's a known issue with the upgrade to 21.1.9, and a reboot should fix it, at least it did for me

https://forum.opnsense.org/index.php?topic=24095.0

[chemlud]

Worst thing: Now the SSD it 90% full (see attachment) and I have no idea with what...

That's a known issue with the upgrade to 21.1.9, and a reboot should fix it, at least it did for me

https://forum.opnsense.org/index.php?topic=24095.0

Not the CPU, the SSD. Reboot helps nothing....

[Taomyn]

Not the CPU, the SSD. Reboot helps nothing....

Mine was doing it to both which I only noticed afterwards when I checked my Zabbix logs which showed my SSD being hammered, though I first spotted the issue due to the CPU fan going mad.

[chemlud]

no zabbix here...

[chemlud]

According to the unbound log, port 853 and my configured servers are used for DNS queries. But I can see/configure the related pages in the GUI.

What filled up 90% of my SSD would be nice to know/remove...

[franco]

> After switching back to "Community"

But why:

> I repeat: switch to development, use the new code, do the upgrade, switch back to community.

I meant 21.7 obviously. Switching back to a version that does not have the code makes no sense.


Cheers,
Franco

[chemlud]

I only wanted to check for updates, but all of a sudden the "up"date (downgrade?) started... sigh...

We are here now, what's next?

[chemlud]

Fresh install with 21.7 later? Or any other ideas? :-)

[franco]

Nothing starts suddenly without a confirmation prompt. I'm sorry, I don't have time for this as I need to prepare the 21.7 release now.


Cheers,
Franco