OPNsense 23.1.6 released

[franco]

Howdy,

Two major improvements being shipped today are standalone core DNS
support for Bind and Dnscrypt-Proxy plugins as well as OpenVPN group
firewall alias type.  The latter makes it easier to manage distinct
policies for connected VPN users.  For more details please refer to
the documentation listed below.

The other honorable mention is the netmap work we have been doing
with Zenarmor and Klara on the FreeBSD kernel side which brings
bridge device support as well as a considerable improvement to the
emulated mode where several packet stalls and mbuf leaks have been
identified and subsequently fixed.  This should have an operational
impact on Suricata (IPS mode) and Zenarmor.  The state is much better
now but please do not hesitate to contact us about issues that you
might still be having with netmap-based packet flows as the topic is
a rather complex one.

Orange FR users be aware that your ISP now requires strict VLAN PCP
on all DHCPv4 requests so please do set 'Use VLAN priority' interface
setting for both DHCPv4 and DHCPv6.  The 'Option Modifiers' override
for "vlan-pcp" in DHCPv4 can be removed and the documentation was
updated accordingly.

Here are the full patch notes:

o system: register DNS service ports for unified use across core and plugins
o system: serialize deferred requests for web GUI restart
o system: relocate API messages to backend log target as they currently end up in captive portal logs
o system: remove /31 subnet restriction in wizard
o system: use data attribute to find existing rows in service widget to avoid special character issues (contributed by Alexander O'Mara)
o system: allow non-system group delete after faulty PHP 8 warning fix (contributed by kulikov-a)
o system: handle empty DNS server gateway (contributed by Nicolas Thumann)
o reporting: translate invalid interface name characters for NetFlow/Netgraph use
o reporting: sort interfaces by description in health graphs
o interfaces: ping diagnostic tool was rewritten using MVC/API
o interfaces: allow to set PCP value on IPv4 DHCP traffic to address recent Orange FR changes
o firewall: allow to create aliases for logged-in OpenVPN users[1]
o firewall: leave out fractional seconds from timestamps in aliases
o firewall: fix progress bar default value (contributed by Nicolas Thumann)
o dhcp: fix too many addresses issue in radvd RDNSS setting
o dhcp: add missing double quotes in hostname handling
o firmware: remove flavouring support from update tools
o ipsec: pull data for dashboard widget exclusively from backend
o ipsec: move XAuth out of "IKE Extensions" block
o ipsec: add connection child as option for manual SPDs
o ipsec: another small GUI fix for basic log option in advanced settings
o openvpn: fix dashboard widget and add missing byte data to status call
o plugins: os-bind 1.26[2]
o plugins: os-crowdsec 1.0.4[3]
o plugins: os-ddclient 1.12[4]
o plugins: os-dnscrypt-proxy 1.13[5]
o plugins: os-nginx 1.32[6]
o plugins: os-upnp now allows subnet mask 0 in rules (contributed by Reiko Asakura)
o src: bridge: add support for emulated netmap mode[7]
o src: epair: also remove vlan metadata from mbufs
o src: ifconfig: fix configuring if_bridge with additional operating parameters
o src: netmap: fix queue stalls with generic interfaces[8]
o src: netmap: assorted upstream stable patches
o src: sched_ule: assorted fixes to address issues on newer AMD platforms
o ports: curl 8.0.1[9]
o ports: ifinfo now also prints interface index (contributed by Nicolas Thumann)
o ports: php 8.1.18[10]


Stay safe,
Your OPNsense team

--
[1] https://docs.opnsense.org/manual/aliases.html#openvpn-group
[2] https://github.com/opnsense/plugins/blob/stable/23.1/dns/bind/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/23.1/security/crowdsec/pkg-descr
[4] https://github.com/opnsense/plugins/blob/stable/23.1/dns/ddclient/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/23.1/dns/dnscrypt-proxy/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/23.1/www/nginx/pkg-descr
[7] https://github.com/opnsense/src/commit/eebd4b140f
[8] https://github.com/opnsense/src/commit/cc92d78fa5
[9] https://curl.se/changes.html#8_0_1
[10] https://www.php.net/ChangeLog-8.php#8.1.18