OPNsense 23.7 released

[franco]

Hi there,

For more than 8 and a half years now, OPNsense is driving innovation
through modularising and hardening the open source firewall, with simple
and reliable firmware upgrades, multi-language support, fast adoption
of upstream software updates as well as clear and stable 2-Clause BSD
licensing.

23.7, nicknamed "Restless Roadrunner", features numerous MVC/API conversions
including the new OpenVPN "instances" configuration option, OpenVPN group
alias support, deferred authentication for OpenVPN, FreeBSD 13.2, PHP 8.2
plus much more.

Download links, an installation guide[1] and the checksums for the images
can be found below as well.

o Europe: https://opnsense.c0urier.net/releases/23.7/
o US East Coast: https://mirror.wdc1.us.leaseweb.net/opnsense/releases/23.7/
o US West Coast: https://mirror.sfo12.us.leaseweb.net/opnsense/releases/23.7/
o South America: http://mirror.ueb.edu.ec/opnsense/releases/23.7/
o East Asia: https://mirror.ntct.edu.tw/opnsense/releases/23.7/
o Full mirror list: https://opnsense.org/download/

Here are the full patch notes against 23.1.11:

o system: use parse_url() to validate if the provided login redirect string is actually parseable to prevent redirect
o system: fix assorted PHP 8.2 deprecation notes
o system: fix assorted permission-after-write problems
o system: introduce a gateway watcher service and fix issue with unhandled "loss" trigger when "delay" is also reported
o system: enabled web GUI compression (contributed by kulikov-a)
o system: disable PHP deprecation notes due to Phalcon emitting such messages breaking the API responses
o system: allow "." DNS search domain override
o system: on boot let template generation wait for configd socket for up to 10 seconds
o system: do not allow state modification on GET for power off and reboot actions
o system: better validation and escaping for cron commands
o system: better validation for logging user input
o system: improve configuration import when interfaces or console settings do not match
o system: name unknown tunables as "environment" as they could still be supported by e.g. the boot loader
o system: sanitize $act parameter in trust pages
o system: add severity filter in system log widget (contributed by kulikov-a)
o system: mute openssl errors pushed to stderr
o system: add opnsense-crypt utility to encrypt/decrypt a config.xml
o system: call opnsense-crypt from opnsense-import to deal with encrypted imports
o interfaces: extend/modify IPv6 primary address behaviour
o interfaces: fix bug with reported number of flapping LAGG ports (contributed by Neil Greatorex)
o interfaces: introduce a lock and DAD timer into newwanip for IPv6
o interfaces: rewrite LAGG pages via MVC/API
o interfaces: allow manual protocol selection for VLANs
o interfaces: remove null_service toggle as empty service name in PPPoE works fine
o interfaces: on forceful IPv6 reload do not lose the event handling
o interfaces: allow primary address function to emit device used
o firewall: move all automatic rules for interface connectivity to priority 1
o firewall: rewrote group handling using MVC/API
o firewall: clean up AliasField to use new getStaticChildren()
o firewall: "kill states in selection" button was hidden when selecting only a rule for state search
o firewall: cleanup port forward page and only show the associated filter rule for this entry
o captive portal: safeguard template overlay distribution
o dhcp: rewrote both IPv4 and IPv6 lease pages using MVC/API
o dhcp: allow underscores in DNS names from DHCP leases in Dnsmasq and Unbound watchers (contributed by bugfixin)
o dhcp: align router advertisements VIP code and exclude /128
o dhcp: allow "." for DNSSL in router advertisements
o dhcp: print interface identifier and underlying device in "found no suitable address" warnings
o firmware: opnsense-version: remove obsolete "-f" option stub
o firmware: properly escape crash reports shown
o firmware: fix a faulty JSON construction during partial upgrade check
o firmware: fetch bogons/changelogs from amd64 ABI only
o ipsec: add missing config section for HA sync
o ipsec: add RADIUS server selection for "Connections" when RADIUS is not defined in legacy tunnel configuration
o ipsec: only write /var/db/ipsecpinghosts if not empty
o ipsec: check IPsec config exists before use (contributed by agh1467)
o ipsec: fix RSA key pair generation with size other than 2048
o ipsec: deprecating tunnel configuration in favour of new connections GUI
o ipsec: clean up SPDField and VTIField types to use new getStaticChildren()
o ipsec: add passthrough networks when specified to prevent overlapping "connections" missing them
o monit: fix alert script includes
o openvpn: rewrote OpenVPN configuration as "Instances" using MVC/API available as a separate configuration option[2]
o openvpn: rewrote client specific overrides using MVC/API
o unbound: rewrote general settings and ACL handling using MVC/API
o unbound: add forward-tcp-upstream in advanced settings
o unbound: move unbound-blocklists.conf to configuration location
o unbound: add database import/export functions for when DuckDB version changes on upgrades
o unbound: add cache-max-negative-ttl setting (contributed by hp197)
o unbound: fix upgrade migration when database is not enabled
o unbound: minor endpoint cleanups for DNS reporting page
o wizard: restrict to validating only IPv4 addresses
o backend: minor regression in deeper nested command structures in configd
o mvc: fill missing keys when sorting in searchRecordsetBase()
o mvc: properly support multi clause search phrases
o mvc: allow legacy services to hook into ApiMutableServiceController
o mvc: implement new Trust class usage in OpenVPN client export, captive portal and Syslog-ng
o mvc: add generic static record definition for ArrayField
o ui: introduce collapsible table headers for MVC forms
o plugins: os-acme-client 3.18[3]
o plugins: os-bind 1.27[4]
o plugins: os-dnscrypt-proxy 1.14[5]
o plugins: os-dyndns removed due to unmaintained code base
o plugins: os-frr 1.34[6]
o plugins: os-firewall 1.3 allows floating rules without interface set (contributed by Michael Muenz)
o plugins: os-telegraf 1.12.8[7]
o plugins: os-zabbix62-agent removed due to Zabbix 6.2 EoL
o plugins: os-zabbix62-proxy removed due to Zabbix 6.2 EoL
o src: axgbe: enable RSF to prevent zero-length packets while in Netmap mode
o src: axgbe: only set CSUM_DONE when IFCAP_RXCSUM enabled
o src: ipsec: add PMTUD support
o src: FreeBSD 13.2-RELEASE[8]
o ports: krb 1.21.1[9]
o ports: nss 3.91[10]
o ports: phalcon 5.2.3[11]
o ports: php 8.2.8[12]
o ports: py-duckdb 0.8.1
o ports: py-vici 5.9.11
o ports: sudo 1.9.14p3[13]
o ports: suricata now enables Netmap V14 API

Migration notes, known issues and limitations:

o The Unbound ACL now defaults to accept all traffic and no longer generates automatic entries.  This was done to avoid connectivity issues on dynamic address setups -- especially with VPN interfaces.  If this is undesirable you can set it to default to block instead and add your manual entries to pass.
o Dpinger no longer triggers alarms on its own as its mechanism is too simplistic for loss and delay detection as provided by apinger a long time ago.  Delay and loss triggers have been fixed and logging was improved.  The rc.syshook facility "monitor" still exists but is only provided for compatibility reasons with existing user scripts.
o IPsec "tunnel settings" GUI is now deprecated and manual migration to the "connections" GUI is recommended.  An appropriate EoL announcement will be made next year.
o The new OpenVPN instances pages and API create an independent set of instances more closely following the upstream documentation of OpenVPN.  Legacy client/server settings cannot be managed from the API and are not migrated, but will continue to work independently.
o The old DynDNS plugin was removed in favor of the newer MVC/API plugin for ddclient.  We are aware of the EoL state of ddclient which was unfortunately announced only one year after we started working on the new plugin.  We will try to add upstream fixes that have not been released yet and already offer our own ddclient-less Python backend in the same plugin as an alternative.

The public key for the 23.7 series is:

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAu90d9OlhEEqfPTRC5tVp
XK1KAtvzKPVf2jvmTtWgFRFCB3fuYQcO7oNefXJoK0LaHNQgiOsBTvepVMicl2aI
zrehgdbljjNFmp6KzEM55x05zOfZV8Gi8AEaJzEbb3rkWLkiXHnANfhHGvtHOrGr
Hct84NMCcfCZZerwaQMqi+SAjgUzA+asmhAvjN0fbdH2SLx/ZMNzDcyPRFGtGiC7
RQCzgCGz39ppJP4qordzRSy5YiwCxNe/SL/4ZG04eMVti47BPTCtioBzuASHqALJ
BVOFzZpr1WZ89PT/T5W6xYzoyWemOyv9Rh+rhaTAhnq+OO4yudaytpPCAtXBULr/
VOlDOX//qaZR8qbQOC9y9kIETH8Iivis5tonBAQmYPIJiqcxfjM4/R7yP2Q7mEsr
PLNyP6HNe77JGoW1axNZlB/OL1XUI3r+Kksc2woIqTQ5sq95tHbddNqGIDg4cEOX
FM5Y7tdvVEwl/nutaAzP07sqEyF8uNScLGsQwpBxHwV/qGGc+PbGqmbmWg3+Kt+e
UeNcMvrgayhRt+lpVCAorVVjUTp0Y2+1x+V/IpukOaS2oldPIF0iXLZsQ90KYP3X
QtmuxbiC2Em+eGHB6nSg1UZgUEaAb3xP1fpuLbi9McoUPxMXxVdfihSfSfUFXJTH
SmqdO1BdG7VSwiQq9Ekbu5UCAwEAAQ==
-----END PUBLIC KEY-----

Please let us know about your experience!


Stay safe,
Your OPNsense team

--
[1] https://docs.opnsense.org/manual/install.html
[2] https://docs.opnsense.org/manual/vpnet.html
[3] https://github.com/opnsense/plugins/blob/stable/23.7/security/acme-client/pkg-descr
[4] https://github.com/opnsense/plugins/blob/stable/23.7/dns/bind/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/23.7/dns/dnscrypt-proxy/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/23.7/net/frr/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/23.7/net-mgmt/telegraf/pkg-descr
[8] https://www.freebsd.org/releases/13.2R/relnotes/
[9] https://web.mit.edu/kerberos/krb5-1.21/
[10] https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_91.html
[11] https://github.com/phalcon/cphalcon/releases/tag/v5.2.3
[12] https://www.php.net/ChangeLog-8.php#8.2.8
[13] https://www.sudo.ws/stable.html#1.9.14p3

SHA256 (OPNsense-23.7-dvd-amd64.iso.bz2) = bf67374d04fb00a29d80f9870ac86491b0a87d5dd386c2bd97def0691547e263
SHA256 (OPNsense-23.7-nano-amd64.img.bz2) = 4adbbd69d0ce1766395555475ea29713f9043735a0c9067206d9945cb626200a
SHA256 (OPNsense-23.7-serial-amd64.img.bz2) = 03c774f53520414c73cdcaa4fe3b34c4165395963bef74c533c3878a07b80138
SHA256 (OPNsense-23.7-vga-amd64.img.bz2) = 8a235d2cba717b9b2ea4d5588028c087adc6ff472ae8efd381a26a9640298c67