OPNsense 24.1 released

[franco]

Hi there,

For more than 9 years now, OPNsense is driving innovation through
modularising and hardening the open source firewall, with simple
and reliable firmware upgrades, multi-language support, fast adoption
of upstream software updates as well as clear and stable 2-Clause BSD
licensing.

24.1, nicknamed "Savvy Shark", features ports-based OpenSSL 3, Suricata 7,
several MVC/API conversions, a new neighbor configuration feature for ARP/NDP,
core inclusion of the os-firewall and os-wireguard plugins, CARP VHID tracking
for OpenVPN and WireGuard, functional Kea DHCPv4 server with HA support plus
much more.

Download links, an installation guide[1] and the checksums for the images
can be found below as well.

o Europe: https://opnsense.c0urier.net/releases/24.1/
o US East Coast: https://mirror.wdc1.us.leaseweb.net/opnsense/releases/24.1/
o US West Coast: https://mirror.sfo12.us.leaseweb.net/opnsense/releases/24.1/
o South America: http://mirror.ueb.edu.ec/opnsense/releases/24.1/
o East Asia: https://mirror.ntct.edu.tw/opnsense/releases/24.1/
o Full mirror list: https://opnsense.org/download/

Here are the full patch notes against 23.7.12:

o system: prevent activating shell for non-admins
o system: add OCSP trust extensions and improved authorities implementation
o system: migrate single gateway configuration to MVC/API
o system: use new backend streaming functionality in the log viewer
o system: limit file system /conf/config.xml and backups access to administrators
o system: migrate gateways model to match new class introduced in 23.7.x
o system: refactor get_single_sysctl()
o system: update cron model
o system: fix migration issue in new gateways model
o system: handle case insensitivity while reading groups
o system: shuffle authentication templates to the end of login configuration
o system: add "maxfilesize" option to enforce a log rotate when files exceed their limit
o reporting: print status message when Unbound DNS database was not found during firmware upgrade
o reporting: update NetFlow model
o interfaces: implement new neighbor configuration for ARP and NDP entries using MVC/API
o interfaces: refactor interface_bring_down() into interface_reset() and interface_suspend()
o interfaces: migrate the overview page to MVC/API
o interfaces: add optional local/remote port to VXLAN
o interfaces: remove unused code from native dhclient-script
o interfaces: do not flush states on clear event
o firewall: add automation category for filter rules and source NAT using MVC/API, formerly known as os-firewall plugin
o firewall: migrate NPTv6 page to MVC/API
o firewall: add a track interface selection to NPTv6 as an alternative to the automatic rule interface fallback when dealing with dynamic prefixes
o captive portal: fix integer validation in vouchers
o captive portal: update model
o dhcp: clean up duplicated domain-name-servers option
o dhcp: cleanup get_lease6 script and fix parsing issue
o dhcp: add Kea DHCPv4 server option with HA capabilities as an alternative to the end of life ISC DHCP
o dhcp: deduplicate records in Kea leases
o intrusion detection: show rule origin in rule adjustments grid
o ipsec: extend connection proposals tooltip to children and fix tooltip style issue
o lang: added traditional Chinese translation (contributed by Jason Cheng)
o monit: update model
o openvpn: allow optional OCSP checking per instance
o openvpn: emit device name upon creation
o openvpn: add workaround for net30/p2p smaller than /29 networks
o openvpn: add optional "route-metric" push option for server instances
o web proxy: integration moved to os-squid plugin
o wireguard: installed by default using the bundled FreeBSD 13.2 kernel module
o backend: constrain execution of user add/change/list actions to members of the wheel group
o backend: only parse stream results when configd socket could be opened
o backend: wait for all configd results and add it to the log message when detached
o mvc: remove legacy Phalcon migration glue
o mvc: add configdStream action to ApiControllerBase
o mvc: support array structures for better search functionality in ApiControllerBase
o mvc: scope xxxBase validations to the item in question in ApiMutableModelControllerBase
o mvc: remove Phalcon syslog implementation with a simple wrapper
o mvc: add a DescriptionField type
o mvc: add a MacAddressField type
o mvc: add IsDNSName to support DNS names as specified by RFC2181 in HostnameField
o ui: include meta tags for standalone/full-screen on Android and iOS (contributed by Shane Lord)
o ui: add double click event with grid dialog in tree view to show a row layout instead
o ui: auto-trim MVC input fields when being pasted
o ui: increase standard search delay from 250 ms to 1000 ms
o ui: make modal dialogs draggable
o ui: support key/value combinations for error messages in do_input_validation()
o plugins: os-acme-client 4.0[2]
o plugins: os-api-backup was discontinued due to overlapping functionality in core
o plugins: os-firewall moved to core
o plugins: os-haproxy 4.2[3]
o plugins: os-nrpe updated to NRPE 4.1.x
o plugins: os-postfix updated to Postfix 3.8.x
o plugins: os-squid 1.0 offers the removed web proxy core functionality
o plugins: os-wireguard moved to core
o plugins: os-wireguard-go was discontinued
o src: NFS client data corruption and kernel memory disclosure[4]
o src: pf: merge extended support for SCTP and related stable changes
o src: e1000: merge assorted driver improvements for hardware capabilities
o src: bsdinstall: merge assorted stable changes
o src: tuntap: merge assorted stable changes
o src: wireguard: add experimental netmap support
o src: sys: Use mbufq_empty instead of comparing mbufq_len against 0
o src: e1000/igc: remove disconnected sysctl
o ports: libxml 2.11.6[5]
o ports: openssl 3.0.12[6]
o ports: php 8.2.15[7]
o ports: py-duckdb 0.9.2
o ports: sqlite 3.45.0[8]
o ports: suricata 7.0.2[9]

Migration notes, known issues and limitations:

o Audits and certifications are requiring us to restrict system accounts for non-administrators (without wheel group in particular).  It will no longer be able to use non-adminstrator accounts with shell access and permissions for sensitive files have been tightened to not be world-readable.  This may cause custom tooling to stop working, but can easily be fixed by giving these required accounts the full administration rights.
o ISC DHCP functionality is slowly being deprecated with the introduction of Kea as an alternative.  The work to replace the tooling of ISC DHCP is ongoing, but feature sets will likely differ for a long time therefore.
o The move to the FreeBSD ports version of OpenSSL 3.0 is included and may disrupt third party repository use until those have been fixed and rebuilt accordingly.  Please note that we do not vet third party repositories and do not have control over them so their response time may vary.
o The Squid web proxy functionality moves to a plugin and will no longer be installed by default for new installations. However, if you have Squid enabled the plugin will automatically be installed during the upgrade.  There is no code difference in the implementation and integration of the plugin compared to the core version.

The public key for the 24.1 series is:

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArjthZplSNhbgab8VYDYl
jn3rNni+Fson28prwolUac0EHlu1e9ckM03BjYfRYUcpHRdNTglPr+likmgQ3K7j
01oq0/H2krvXUbxUq8CQDYgHUM9QDBubdC06/oQ/S20YGHlHJ+odexUbLF0YvW04
RfzlEozBW0eUjc3LLYAvr1RwXoiZyB/Qit5bBC7No6fKIlCD9uZ3+7b1pO+Gjfq0
mPF01kE7P55Y9WqaEU9odS4xE+viGlj+k1+YZBsEWWzX+J3z5zGDhWcsWWskd92z
eMOUkJyVeiIWkW4draQ7CC0tJ4e+f/1PUkkLRfMMO55pGeunu3xwEgD4ALyD1A+y
029sKMXF6OSWgDQDrxDOe4bA7RW4yUba3EhSz8UyAvL3HIKQ0OuOJaGYkRee9DBQ
DmCjIvPs6yCdAiuDbwO7V6RsH4k3yIONotST3qwf3sJXU3vvwsHi1n3ssccZBzw4
sKwQ1xQN1eIc5+At+OJ6bzkdb/vg+UrFUfuCknqxuxvwg99+3Wx6vvemW7yqIUY4
Vkhqs7WUZ0ucwo1zjLM12K4yS7kEQbOzHykYQzXXYxhzJIai+BZAJFytSER+Wl7Z
AyIioWGKwTD/WTEzyfK5svnSmosWlikagMhl3+XyF2cma1rPqOOyuFpcFhmV6nlR
vWhn568tDgJAyWqOCCHZqOMCAwEAAQ==
-----END PUBLIC KEY-----


Stay safe,
Your OPNsense team

--
[1] https://docs.opnsense.org/manual/install.html
[2] https://github.com/opnsense/plugins/blob/stable/24.1/security/acme-client/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/24.1/net/haproxy/pkg-descr
[4] https://www.freebsd.org/security/advisories/FreeBSD-SA-23:18.nfsclient.asc
[5] http://www.xmlsoft.org/news.html
[6] https://www.openssl.org/news/cl30.txt
[7] https://www.php.net/ChangeLog-8.php#8.2.15
[8] https://sqlite.org/releaselog/3_45_0.html
[9] https://forum.suricata.io/t/suricata-7-0-2-released/4069

SHA256 (OPNsense-24.1-dvd-amd64.iso.bz2) = 6d1e22713bf031d0a36a73b3820cd1564f426cae9c67a6ade4b7fa6518afa2d5
SHA256 (OPNsense-24.1-nano-amd64.img.bz2) = 6bc86a13bda81702382383b1e9b31550177bafe88fa599e0c2ed8064040461b1
SHA256 (OPNsense-24.1-serial-amd64.img.bz2) = c4c53e5dd80660cc67b349fa588b3ca11efd9f45d09f6cb391d8e19b48dd7fcc
SHA256 (OPNsense-24.1-vga-amd64.img.bz2) = ec08755245017cd449a8d174b6ea7c4e2038c454a8abecfad0d0378729d8b331

[franco]

Service announcement: Suricata 7 appears to have severe issues with Netmap mode, alerting is likely affected. We'll be reverting back to Suricata 6 tomorrow and recommend disabling IPS mode on 24.1 for now. Best done prior to executing the upgrade!