OPNsense Serie 24.1 Savvy Shark veröffentlich mit Hotfix 24.1_1 veröffentlicht

Seit mehr als 9 Jahren gibt es OPNsense. Die Community Edition der Open-Source Firewall OPnsense 23.7 „Restless Roadrunner“ ist End of Life und wird durch das neue Release 24.1 alias „Savvy Shark“ abgelöst. Highlights des neuen Releases sind:

• ports-based OpenSSL 3
• Suricata 7
• zahlreiche MVC/API Anpassungen
• neue Konfiguration für ARP/NDP
• OS-Firewall im Core aufgenommen
• OS-Wireguard Plugins
• CARP VHID Tracking für OpenVPN und WireGuard
• Kea DHCPv4 Server mit HA Support
• uvm.

Das Update kann direkt über die WebUI durchgeführt werden, was mehere Neustarts durchführt.

Eine Neuinstallation mit OPNsense 24.1 kann ebenso mittels Export und Import der vorhandenen Konfiguration durchgeführt werden. Hier kann die Disk entweder als UFS oder ZFS formatiert werden.

Wer eher in der Konsole unterwegs ist, kann das Upgrade von Serie 23.7 auf 24.1 mittels SSH und der Option 12 im Menü und der Eingabe 24.1 ausgeführt werden.

Vor dem Upgrade sollten die Release Notes gelesen werden, da es Änderungen gibt die ggf. berücksichtigt werden müssen, hier z.B. die Umstellung von der Installation von Squid mit OPNsense zum eigenen Plugin für Squid. Ein Backup ist ebenso empfehlenswert.

OPNsense 24.1 Release Notes against 23.7.12

• system: prevent activating shell for non-admins
• system: add OCSP trust extensions and improved authorities implementation
• system: migrate single gateway configuration to MVC/API
• system: use new backend streaming functionality in the log viewer
• system: limit file system /conf/config.xml and backups access to administrators
• system: migrate gateways model to match new class introduced in 23.7.x
• system: refactor get_single_sysctl()
• system: update cron model
• system: fix migration issue in new gateways model
• system: handle case insensitivity while reading groups
• system: shuffle authentication templates to the end of login configuration
• system: add „maxfilesize“ option to enforce a log rotate when files exceed their limit
• reporting: print status message when Unbound DNS database was not found during firmware upgrade
• reporting: update NetFlow model
• interfaces: implement new neighbor configuration for ARP and NDP entries using MVC/API
• interfaces: refactor interface_bring_down() into interface_reset() and interface_suspend()
• interfaces: migrate the overview page to MVC/API
• interfaces: add optional local/remote port to VXLAN
• interfaces: remove unused code from native dhclient-script
• interfaces: do not flush states on clear event
• firewall: add automation category for filter rules and source NAT using MVC/API, formerly known as os-firewall plugin
• firewall: migrate NPTv6 page to MVC/API
• firewall: add a track interface selection to NPTv6 as an alternative to the automatic rule interface fallback when dealing with dynamic prefixes
• captive portal: fix integer validation in vouchers
• captive portal: update model
• dhcp: clean up duplicated domain-name-servers option
• dhcp: cleanup get_lease6 script and fix parsing issue
• dhcp: add Kea DHCPv4 server option with HA capabilities as an alternative to the end of life ISC DHCP
• dhcp: deduplicate records in Kea leases
• intrusion detection: show rule origin in rule adjustments grid
• ipsec: extend connection proposals tooltip to children and fix tooltip style issue
• lang: added traditional Chinese translation (contributed by Jason Cheng)
• monit: update model
• openvpn: allow optional OCSP checking per instance
• openvpn: emit device name upon creation
• openvpn: add workaround for net30/p2p smaller than /29 networks
• openvpn: add optional „route-metric“ push option for server instances
• web proxy: integration moved to os-squid plugin
• wireguard: installed by default using the bundled FreeBSD 13.2 kernel module
• backend: constrain execution of user add/change/list actions to members of the wheel group
• backend: only parse stream results when configd socket could be opened
• backend: wait for all configd results and add it to the log message when detached
• mvc: remove legacy Phalcon migration glue
• mvc: add configdStream action to ApiControllerBase
• mvc: support array structures for better search functionality in ApiControllerBase
• mvc: scope xxxBase validations to the item in question in ApiMutableModelControllerBase
• mvc: remove Phalcon syslog implementation with a simple wrapper
• mvc: add a DescriptionField type
• mvc: add a MacAddressField type
• mvc: add IsDNSName to support DNS names as specified by RFC2181 in HostnameField
• ui: include meta tags for standalone/full-screen on Android and iOS (contributed by Shane Lord)
• ui: add double click event with grid dialog in tree view to show a row layout instead
• ui: auto-trim MVC input fields when being pasted
• ui: increase standard search delay from 250 ms to 1000 ms
• ui: make modal dialogs draggable
• ui: support key/value combinations for error messages in do_input_validation()
• plugins: os-acme-client 4.0[2]
• plugins: os-api-backup was discontinued due to overlapping functionality in core
• plugins: os-firewall moved to core
• plugins: os-haproxy 4.2[3]
• plugins: os-nrpe updated to NRPE 4.1.x
• plugins: os-postfix updated to Postfix 3.8.x
• plugins: os-squid 1.0 offers the removed web proxy core functionality
• plugins: os-wireguard moved to core
• plugins: os-wireguard-go was discontinued
• src: NFS client data corruption and kernel memory disclosure[4]
• src: pf: merge extended support for SCTP and related stable changes
• src: e1000: merge assorted driver improvements for hardware capabilities
• src: bsdinstall: merge assorted stable changes
• src: tuntap: merge assorted stable changes
• src: wireguard: add experimental netmap support
• src: sys: Use mbufq_empty instead of comparing mbufq_len against 0
• src: e1000/igc: remove disconnected sysctl
• ports: libxml 2.11.6[5]
• ports: openssl 3.0.12[6]
• ports: php 8.2.15[7]
• ports: py-duckdb 0.9.2
• ports: sqlite 3.45.0[8]
• ports: suricata 7.0.2[9]

OPNsense Hotfix 24.1_1 Release Notes

• ports: revert back to suricata 6.0.15 for the time being

Migration notes, known issues and limitations:

• Audits and certifications are requiring us to restrict system accounts for non-administrators (without wheel group in particular). It will no longer be able to use non-adminstrator accounts with shell access and permissions for sensitive files have been tightened to not be world-readable. This may cause custom tooling to stop working, but can easily be fixed by giving these required accounts the full administration rights.
• ISC DHCP functionality is slowly being deprecated with the introduction of Kea as an alternative. The work to replace the tooling of ISC DHCP is ongoing, but feature sets will likely differ for a long time therefore.
• The move to the FreeBSD ports version of OpenSSL 3.0 is included and may disrupt third party repository use until those have been fixed and rebuilt accordingly. Please note that we do not vet third party repositories and do not have control over them so their response time may vary.
• The Squid web proxy functionality moves to a plugin and will no longer be installed by default for new installations. However, if you have Squid enabled the plugin will automatically be installed during the upgrade. There is no code difference in the implementation and integration of the plugin compared to the core version.

Quelle: https://forum.opnsense.org/index.php?topic=38427.0