mirror of https://github.com/opnsense/docs
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1164 lines
60 KiB
ReStructuredText
1164 lines
60 KiB
ReStructuredText
5 years ago
|
===========================================================================================
|
||
|
16.1 "Crafty Coyote" Series
|
||
|
===========================================================================================
|
||
|
|
||
|
|
||
|
|
||
|
No, we would not say it was easy getting here, but booting into 16.1
|
||
|
for the first time sure is as relieving (and exciting) as it could get
|
||
|
for our project growing beyond what we had ever imagined. It has been
|
||
|
more than a year since OPNsense first came out. Back then it was
|
||
|
FreeBSD 10.0. Not even two months after, 10.1 was introduced along
|
||
|
with the opnsense-update utility. Today is the day for FreeBSD 10.2,
|
||
|
the latest and greatest release currently available for broader driver
|
||
|
support and stability improvements.
|
||
|
|
||
|
16.1 is nicknamed "Crafty Coyote" in honour of our beloved childhood
|
||
|
TV sessions. It is the accumulation of 6 months of work, having had
|
||
|
our focus on reengineering the captive portal, native intrusion
|
||
|
prevention, plugin support, and transforming the reporting frontend
|
||
|
into something more modern and flexible just to name a few `[1] <https://opnsense.org/about/road-map/>`__ . Apart
|
||
|
from the recently published security advisories (see patch notes below),
|
||
|
we have included a quick navigation feature which can be activated by
|
||
|
pressing (TAB) followed by search keywords and hitting (ENTER) to go to
|
||
|
the desired page. Last but not least, a larger batch of improvements
|
||
|
and fixes went into assorted sections of the GUI that certainly help
|
||
|
to get your work done without ending up dazed and confused.
|
||
|
|
||
|
Speaking of clearing things up, there is more... While Ad, Franco
|
||
|
and a couple of amazing external contributors have been busy writing
|
||
|
and reviewing code, Jos worked in the shadows to bring to you a fully
|
||
|
revised set of project documentation in the form of an online
|
||
|
handbook `[2] <https://docs.opnsense.org/>`__ . More content will follow as we slow down development
|
||
|
speed a bit in order to catch up. We will have to see how that works
|
||
|
out. ;)
|
||
|
|
||
|
Another thing we have noticed is that translations are hard! We have
|
||
|
planned to finish a translation for this iteration, but the sheer
|
||
|
amount of work overwhelmed even the sizeable German translation team.
|
||
|
The German translation is now at 77% percent completed with Japanese,
|
||
|
Chinese and French chasing tails. If you want to help drop us a line
|
||
|
at project@opnsense.org for details on how to contribute.
|
||
|
|
||
|
All images have been pushed as well, although may take a bit more time
|
||
|
to reach a mirror near you. You can find the checksums attached at the
|
||
|
end of this announcement.
|
||
|
|
||
|
https://opnsense.org/download/
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.20 (July 22, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
We are pushing out 16.1.20 a little earlier than expected to fix a
|
||
|
GUI regression that can affect users with IPv6. Sorry about that.
|
||
|
|
||
|
Since this is the last 16.1 series release, the firmware page offers
|
||
|
an overview of migration hints for the 16.7 series. We are expecting
|
||
|
to be right on schedule, namely July 28. Oh, and by the way, the next
|
||
|
release will be called "Dancing Dolphin".
|
||
|
|
||
|
Here are the full patch notes:
|
||
|
|
||
|
* firmware: end-of-life announcement and preparation for 16.7 upgrade
|
||
|
* services: fix a missing dependency for the DHCPv6 service probing
|
||
|
|
||
|
|
||
|
Stay safe,
|
||
|
Your OPNsense team
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.19 (July 21, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
It is time for a last full stable release before we offer our
|
||
|
16.1.20 end-of-life version, which then can be used to upgrade
|
||
|
to the 16.7 series.
|
||
|
|
||
|
Most changes presented today were either long-running development
|
||
|
additions for 16.7 or small reports that came up during the 16.7-RC
|
||
|
testing period. Another prominent fix addresses an issue with
|
||
|
sporadic premature captive portal authentication timeouts that
|
||
|
one of our awesome forum members helped to debug.
|
||
|
|
||
|
Here are the full patch notes:
|
||
|
|
||
|
* ports: suricata 3.0.2 `[1] <https://suricata-ids.org/2016/06/20/suricata-3-0-2-released/>`__ , squid 3.5.20 `[1] <https://suricata-ids.org/2016/06/20/suricata-3-0-2-released/>`__ , expat 2.2.0 `[3] <http://expat.sourceforge.net/>`__ ,
|
||
|
haproxy 1.6.7 `[4] <http://www.haproxy.org/download/1.6/src/CHANGELOG>`__ , bind 9.10.4-P2 `[5] <https://kb.isc.org/article/AA-01396/81/BIND-9.10.4-P2-Release-Notes.html>`__
|
||
|
* firewall: hide previously selected nested aliases from the
|
||
|
autocompletion on alias edit
|
||
|
* firewall: fix log view to properly render all of its html
|
||
|
* firewall: fix link to IPv6 disable setting on rules screen
|
||
|
* firewall: remove CARP restriction of matching interface subnet
|
||
|
* interfaces: fix IPv6 subnet bits count on interface status
|
||
|
* interfaces: traffic graphs now show more device types
|
||
|
* gateways: prevent spurious dynamic default gateways from showing up
|
||
|
* gateways: change the creation order of dynamic gateways to allow
|
||
|
overriding their settings correctly
|
||
|
* firmware: refine ignore of temporary error 500 in GUI during upgrades
|
||
|
* firmware: default config has been adapted to set up new style
|
||
|
dashboard entries during e.g. factory reset
|
||
|
* firmware: validate source and destination entries in NPT
|
||
|
* firmware: audited mirror list and disabled non-working entries
|
||
|
* services: do not show disabled DHCPv6 server when prefix delegation
|
||
|
is not used
|
||
|
* services: do not run boot-up routines for proxy server and intrusion
|
||
|
detection when disabled
|
||
|
* services: fix router advertisements subnet bits save
|
||
|
* intrusion detection: improved alert browsing with action filter
|
||
|
* proxy server: ACL setup can now include manual pre and post hooks
|
||
|
* wizard: fixed alignment of page titles and contents
|
||
|
* captive portal: ignore incomplete MAC entries to avoid premature
|
||
|
logout of active user
|
||
|
* openvpn: fix display of selected CRL in server settings
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.18 (June 30, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
Before we get on with the release candidate for 16.7, we are proudly
|
||
|
presenting the latest and greatest stable addition to the 16.1 series.
|
||
|
|
||
|
No time to lose, enjoy the summer!
|
||
|
|
||
|
Here are the full patch notes:
|
||
|
|
||
|
* system: properly run fsck on boot if needed
|
||
|
* system: new Cron page and API now available for general use
|
||
|
* system: QR codes are now generated locally in the browser
|
||
|
(contributed by Fabian Franz)
|
||
|
* system: harden serial config write against power failures
|
||
|
* system: allow serial config to attach to all available ttys
|
||
|
* system: added missing ACL entry for LDAP user import page
|
||
|
* system: reworked log page layout and dependencies
|
||
|
* firmware: detach / reattach support for upgrade page
|
||
|
* firmware: mirror and flavour selection moved to respective page
|
||
|
* interfaces: improvements for 4G devices (sponsored by OSNet.eu `[1] <https://www.osnet.eu/>`__ )
|
||
|
* interfaces: debug mode and logging for rtsold in DHCPv6 mode
|
||
|
* dhcp: separate pages for router advertisements and service control
|
||
|
* dhcp: IPv6 server as a stand-alone process for service control
|
||
|
* dhcp: fixed and improved writing of dynamic DNS configuration
|
||
|
* ports: python 2.7.11_3 `[2] <http://bugs.python.org/issue26171>`__ , unbound 1.5.9 `[3] <https://nlnetlabs.nl/projects/unbound/download/>`__ , curl 7.49.1 `[4] <https://curl.haxx.se/changes.html>`__ ,
|
||
|
openssl 1.0.2_14 `[5] <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177>`__ , sudo 1.8.17p1 `[6] <https://www.sudo.ws/sudo/changes.html>`__ , php 5.6.23 `[7] <https://php.net/ChangeLog-5.php#5.6.23>`__ ,
|
||
|
pcre 8.39 `[8] <http://www.pcre.org/original/changelog.txt>`__ , haproxy 1.6.6 `[9] <http://www.haproxy.org/download/1.6/src/CHANGELOG>`__
|
||
|
* src: tzdata updated to 2016e `[10] <http://mm.icann.org/pipermail/tz-announce/2016-June/000039.html>`__
|
||
|
* src: fix pf fragement timeout `[11] <https://lists.freebsd.org/pipermail/freebsd-pf/2016-May/008044.html>`__
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.17 (June 15, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
Today we offer complementary improvements and fixes to your swinging
|
||
|
installation in the hopes that they will make your daily experience
|
||
|
even better, rounded off with a pinch of SSL crypto updates.
|
||
|
|
||
|
In other news, we are getting ready for a first 16.7 release candidate
|
||
|
after having finished the full work on the FreeBSD 10.3 base system
|
||
|
including the addition of HardenedBSD's ASLR. More on this next week.
|
||
|
|
||
|
Here is the change log for 16.1.17:
|
||
|
|
||
|
* ports: isc-dhcp-server 4.3.4 `[1] <https://kb.isc.org/article/AA-01364/82/DHCP-4.3.4-Release-Notes.html>`__ , syslogd 10.3, libressl 2.3.6 `[2] <http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.6-relnotes.txt>`__ , openssl 1.0.2_13 `[3] <https://github.com/freebsd/freebsd-ports/commit/5ae24c9c91bd>`__
|
||
|
* system: fix OTP QR code link to amend the first request
|
||
|
* system: allow to override TRIM apply at boot time via /etc/fstab `[4] <https://forum.opnsense.org/index.php?topic=3044>`__
|
||
|
* dashboard: fix OpenVPN test data display
|
||
|
* dashboard: gateway widget style updated
|
||
|
* interfaces: allow debug option for dhcp6 client
|
||
|
* interfaces: allow to delete WAN as well
|
||
|
* interfaces: properly restart the respective proxy ARP daemon
|
||
|
* firewall: fixed HTML errors in NAT edit page
|
||
|
* services: fixed unbound custom option handling
|
||
|
* services: allow RA send behaviour to be configured
|
||
|
* services: show correct dynamic DNS type when editing an existing entry
|
||
|
* openvpn: bring back authentication method selector
|
||
|
* openvpn: create interfaces at boot time and even when disabled
|
||
|
* power: separate menu for power off and reboot functions
|
||
|
* intrusion detection: allow to drop/reset log files
|
||
|
* plugins: can now create local logging sockets for chroot environments
|
||
|
* plugins: new HAProxy version 1.3 with assorted fixes (contributed by Frank Wall and Manus Freedom)
|
||
|
* lang: major updates for Russian (contributed by Smart-Soft)
|
||
|
* lang: assorted translation fixes (contributed by Fabian Franz)
|
||
|
* lang: minor updates to Chinese, German and French
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.16 (June 06, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
It has been a long journey for HardenedBSD and OPNsense, and
|
||
|
finally the paths start to merge as the splendid and battle-
|
||
|
proven ASLR implementation gets incorporated into the default
|
||
|
installation! It is just the beginning as we will start to
|
||
|
leverage the extra security by enabling position independent
|
||
|
execution in 16.7 and merge more security-related features.
|
||
|
We thank again the HardenedBSD team for their continued efforts
|
||
|
on making this world a safer place.
|
||
|
|
||
|
In other news, there is a thoroughly revamped dashboard for you
|
||
|
to enjoy and a handful of security fixes in FreeBSD and the ports
|
||
|
ecosystem. LibreSSL has been updated to the latest production
|
||
|
release and the BETA version is progressing nicely as we change
|
||
|
our working mode from "rework all the things" to "polish all the
|
||
|
things". A release candidate is coming up soon.
|
||
|
|
||
|
Here are the patch notes for 16.1.16:
|
||
|
|
||
|
* src: merged and enabled HardenedBSD's ASLR implementation `[1] <https://github.com/opnsense/src/commit/e13c0d42ebbd4>`__
|
||
|
* src: kernel stack disclosure in Linux compatibility layer `[2] <https://www.freebsd.org/security/advisories/FreeBSD-SA-16:20.linux.asc>`__
|
||
|
* src: kernel stack disclosure in 4.3BSD compatibility layer `[3] <https://www.freebsd.org/security/advisories/FreeBSD-SA-16:21.43bsd.asc>`__
|
||
|
* src: directory traversal in cpio `[4] <https://www.freebsd.org/security/advisories/FreeBSD-SA-16:22.libarchive.asc>`__
|
||
4 years ago
|
* ports: libressl 2.3.5 `[5] <http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.5-relnotes.txt>`__ , phalcon 2.0.13 `[6] <https://github.com/phalcon/cphalcon/releases/tag/phalcon-v2.0.13>`__ , dnsmasq 2.76 `[7] <https://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
|
||
5 years ago
|
* ports: apinger 0.7 `[8] <https://github.com/opnsense/apinger/blob/master/NEWS>`__ , curl 7.49 `[9] <https://curl.haxx.se/changes.html>`__ , bind 9.10.4-p1 `[10] <https://kb.isc.org/article/AA-01383/81/BIND-9.10.4-P1-Release-Notes.html>`__
|
||
|
* ports: php 5.6.22 `[11] <https://php.net/ChangeLog-5.php#5.6.22>`__ , sqlite 3.13.0 `[12] <https://sqlite.org/releaselog/3_13_0.html>`__ , ntp 4.2.8p8 `[13] <https://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ChangeLog-stable>`__
|
||
|
* dashboard: movable widgets, multi-column support and improved
|
||
|
look and feel
|
||
|
* system: improved CSRF handling
|
||
|
* system: allow far gateway support for non-subnet gateways
|
||
|
* system: fix null routes add / delete
|
||
|
* system: user/group privilege selection improvements
|
||
|
* system fix missing cron job for GUI lock / expire
|
||
|
* firmware: adds opnsense-patch tool for simple upstream repo patch apply
|
||
|
* dns resolver: fix AAAA record save
|
||
|
* dns forwarder: add custom port option for domain overrides
|
||
|
* firewall: for us bogons do not extend to private networks
|
||
|
* firewall: fix schedule clone when in use
|
||
|
* interfaces: remove explicit ath(4) long distance support
|
||
|
* interfaces: removed SVG traffic graphs in favour of modern replacements
|
||
|
* captive portal: allow to drop all expired vouchers
|
||
|
* cron: fix parameter ignore
|
||
|
* layout: "Stacked-to-horizontal" emulation for mobile view
|
||
|
* layout: consistent tooltip button placement
|
||
|
* layout: fix footer on small screen size
|
||
|
* plugins: fix HAProxy X-Forwarded-For header option
|
||
|
|
||
|
And here is the change log for 16.7 BETA:
|
||
|
|
||
|
* interfaces: interface-based plugin system used by OpenVPN and IPSec
|
||
|
* interfaces: removed complex PPPoE reset handling by optional cron job
|
||
|
* plugins: allow local socket in chroot'ed services
|
||
|
* plugins: removed L2TP, PPTP and PPPoE servers from core
|
||
|
* firmware: allow resume for update page
|
||
|
* firmware: dump / restore package database on shutdown / boot
|
||
|
* firewall: removed proxy NAT reflection mode
|
||
|
* firewall: properly start/stop proxy APR daemons
|
||
|
* firewall: implement flexible scrub / normalisation config pages to
|
||
|
zap hidden scrubbing code
|
||
|
* firewall: removed "match" action from floating rules, no FreeBSD
|
||
|
support
|
||
|
* firewall: removed negate rules that would magically prevent load-
|
||
|
balancing VPN links
|
||
|
* system: migrated new cron handling to do privilege separation where
|
||
|
possible
|
||
|
* system: better branding support for boot loader on package install /
|
||
|
remove
|
||
|
* system: remove single forward GUI item for RFC 2893, can be set in
|
||
|
NAT just as well
|
||
|
* router advertisements: allow to set mode and min / max intervals
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.15 (May 25, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
We are dropping in for a quick update bundling assorted fixes
|
||
|
and general improvements throughout the code. Not much to add
|
||
|
this week, see for yourselves...
|
||
|
|
||
|
Do not forget that ASLR is coming next week. :)
|
||
|
|
||
|
Here are the full patch notes for 16.1.15:
|
||
|
|
||
|
* system: make authentication fallback configurable
|
||
|
* system: settings cleanup and prettify
|
||
|
* system: added explicit ETC timezone selection
|
||
|
* high availability: add page for remote service control
|
||
|
* high availability: properly enforce authentication
|
||
|
* firmware: reboot and poweroff API actions
|
||
|
* firmware: only kill GUI process, not captive portal
|
||
|
* firmware: show errors in update window
|
||
|
* firmware: keep polling for progress even when GUI restarts
|
||
|
* backend: skip failing templates on bootup
|
||
|
* trust: fix CA certificate count in overview
|
||
|
* trust: allow key size up to 8192 bits
|
||
|
* firewall: fix invalid NPT rule generation
|
||
|
* firewall: speed up filter log pages
|
||
|
* firewall: do not allow to change virtual IP mode after creation
|
||
|
* firewall: moved settings page and rearranged settings accordingly
|
||
|
* interfaces: unhook all but the last custom PHP module functions
|
||
|
* interfaces: moved settings page and rearranged settings accordingly
|
||
|
* dhcp: do not override RA settings after save
|
||
|
* dns: resolver outgoing interface section moved to advanced as it
|
||
|
will break setups with dynamic interfaces selected there
|
||
|
* load balancer: sticky mode from firewall / system split off as
|
||
|
separate setting
|
||
|
* snmp: do not allow unicode in system location
|
||
|
* intrusion detection: remove deprecated rbn-malvertisers.rules set
|
||
|
* intrusion detection: add promiscuous mode / physical interface selection
|
||
|
* overall: fix menu width on small size screens
|
||
|
* overall: numerous translation fixes (contributed by Frederic Lietart)
|
||
|
* overall: numerous translation fixes (contributed by Fabian Franz)
|
||
|
* plugins: assorted bugfixes for HAProxy (contributed by Frank Wall)
|
||
|
* mvc: fix translations by adding an escaping wrapper
|
||
|
|
||
|
And here are the patch notes for 16.7 BETA:
|
||
|
|
||
|
* system: reworked the user / group manager privilege selection
|
||
|
* firewall: IPv6 outbound NAT rework
|
||
|
* interfaces: allow debug mode for DHCPv6 client
|
||
|
* interfaces: remove ath(4) long distance helpers
|
||
|
* dns: add custom port option for domain overrides
|
||
|
* gateways/routes: fix for far gateway setups
|
||
|
* overall: add stacked-to-horizontal feature for input forms
|
||
|
|
||
|
|
||
|
Stay safe,
|
||
|
Your OPNsense team
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.14 (May 18, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
It is time for something new. How about an update with your new NetFlow
|
||
|
remote export. Or your local reporting frontend? Well, you can always
|
||
|
use both if you like. Read all about it here:
|
||
|
|
||
|
https://docs.opnsense.org/manual/netflow.html
|
||
|
|
||
|
Furthermore, we have added the brand new AQM CoDel version 0.2.1 to the
|
||
|
mix, yesterday's FreeBSD security advisories, released the HAProxy plugin,
|
||
|
bundled a full Japanese translation. And two-factor authentication support
|
||
|
for our components? Yes, we also have that now. :)
|
||
|
|
||
|
There is also a refreshed website for our general viewing pleasure. Let
|
||
|
us know what you think or what it is missing.
|
||
|
|
||
|
https://opnsense.org/
|
||
|
|
||
|
And now, here is the full change log for 16.1.14:
|
||
|
|
||
|
* src: tzdata updated to 2014d `[1] <http://mm.icann.org/pipermail/tz-announce/2016-April/000038.html>`__
|
||
|
* src: dummynet AQM updated to 0.2.1 `[2] <http://caia.swin.edu.au/freebsd/aqm/patches/ChangeLog-0.2.1.txt>`__
|
||
|
* src: fix multiple OpenSSL vulnerabilities `[3] <https://www.freebsd.org/security/advisories/FreeBSD-SA-16:17.openssl.asc>`__
|
||
|
* src: fix excessive latency in x86 IPI delivery `[4] <https://www.freebsd.org/security/advisories/FreeBSD-EN-16:07.ipi.asc>`__
|
||
|
* src: fix memory leak in ZFS `[5] <https://www.freebsd.org/security/advisories/FreeBSD-EN-16:08.zfs.asc>`__
|
||
|
* src: fix buffer overflow in keyboard driver `[6] <https://www.freebsd.org/security/advisories/FreeBSD-SA-16:18.atkbd.asc>`__
|
||
|
* src: fix incorrect argument handling in sendmsg `[7] <https://www.freebsd.org/security/advisories/FreeBSD-SA-16:19.sendmsg.asc>`__
|
||
|
* ports: sqlite 3.12.2 `[8] <https://sqlite.org/releaselog/3_12_2.html>`__ , openvpn 2.3.11 `[9] <https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.11>`__ , squid 3.5.19 `[10] <http://ftp.meisei-u.ac.jp/mirror/squid/squid-3.5-ChangeLog.txt>`__
|
||
|
* plugins: HAProxy plugin version 1.0 (contributed by Frank Wall)
|
||
|
* lang: Japanese 100% completed
|
||
|
* lang: updates for French and German
|
||
|
* interfaces: removed polling support
|
||
|
* interfaces: allow subnet size of 31 bits
|
||
|
* high availability: can now sync DNS resolver configuration
|
||
|
* cron: reworked job registration
|
||
|
* system: do not unload cryptodev to prevent panics when used by OpenVPN
|
||
|
* system: user expiration date edit now has a fancy date picker
|
||
|
* system: add RFC 6238 (TOTP) support for two-factor authentication
|
||
|
* reporting: added local NetFlow reporting frontend `[11] <https://docs.opnsense.org/manual/how-tos/insight.html>`__
|
||
|
* reporting: added remote NetFlow exporter for multiple sources `[12] <https://docs.opnsense.org/manual/how-tos/netflow_exporter.html>`__
|
||
|
* firewall: fixed schedule cloning
|
||
|
* services: lower intervals for router advertisement messages
|
||
|
|
||
|
And this is the change log for 16.7 BETA:
|
||
|
|
||
|
* firmware: assorted improvements for error reporting and smooth operation
|
||
|
* firmware: partial fix for Nano update issues when RAM is too small
|
||
|
* intrusion detection: promiscuous interface mode for better VLAN operation
|
||
|
* gateways/routes: support for gateways outside of the interface subnet
|
||
|
* routes: fixed null routes / blackholes
|
||
|
* interfaces: SVG traffic graphs replaced by modern alternative
|
||
|
* dashboard: finished the rework, ready for general testing
|
||
|
* firewall: removed the need for custom kernel patches for schedules
|
||
|
* lang: numerous improvements (contributed by Fabian Franz)
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.13 (May 04, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
Ever so swiftly we are adopting the OpenSSL and LibreSSL updates
|
||
|
and welcome the cooperation between both projects on this one.
|
||
|
Way to go guys!
|
||
|
|
||
|
In other news, NTP and Bind were updated to their latest versions.
|
||
|
The gateway monitoring tool Apinger can now properly handle NTP
|
||
|
taking over time from time to time. Er, anyway, language packs
|
||
|
will become pluggable in the long run and the MVC work for the
|
||
|
HAProxy plugin is now completely bundled with the release. Plugin
|
||
|
release is currently scheduled for 16.1.14.
|
||
|
|
||
|
Here is the full change log for 16.1.13:
|
||
|
|
||
|
* ports: ntp 4.2.8p7 `[1] <http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities>`__ , bind 9.10.4 `[2] <https://ftp.isc.org/isc/bind/9.10.4/RELEASE-NOTES-bind-9.10.4.html>`__ , php 5.6.21 `[3] <https://php.net/ChangeLog-5.php#5.6.21>`__ ,
|
||
|
libressl 2.2.7 `[4] <http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.2.7-relnotes.txt>`__ , openssl 1.0.2h `[5] <https://mta.openssl.org/pipermail/openssl-announce/2016-May/000072.html>`__
|
||
|
* languages: newly packaged translations with latest updates
|
||
|
* gateways: apinger monitoring quality is no longer affected by
|
||
|
NTP operation
|
||
|
* backend: lowered configd connection timeout for better response
|
||
|
time when unavailable
|
||
|
* backend: plugged numerous minor crash reports caused by configd
|
||
|
* backup: reworked backup strategies for RRD and DHCP leases
|
||
|
* interfaces: allow bridges with at least one member
|
||
|
* rc: defer recover for packages to avoid database duplication
|
||
|
* intrusion detection: added an eicar test ruleset
|
||
|
* intrusion detection: fixed sort order of rulesets
|
||
|
* captive portal: properly catch exception for accounting
|
||
|
background job
|
||
|
* firewall: annotate deprecated ICMP types in rule filter selection
|
||
|
* firewall: direction arrows in rule overview now have different
|
||
|
colours for easier distinction
|
||
|
* gui: correct HTML escaping in MVC between client-side JavaScript
|
||
|
and server-side API
|
||
|
* gui: various improvements in MVC components required for upcoming
|
||
|
HAProxy plugin
|
||
|
* gui: enable tooltips in MVC base template
|
||
|
* gui: set HTTP-only cookie
|
||
|
|
||
|
And here is what changed in 16.7 Beta:
|
||
|
|
||
|
* dashboard: selectable multi-column count
|
||
|
* dashboard: half-way through widget modernisation
|
||
|
* dashboard: brought back drag and drop for widget reordering
|
||
|
* dashboard: new pluggable API backend for widgets
|
||
|
* languages: added first steps for Turkish
|
||
|
* backend: removed legacy PHP module for interface information collection
|
||
|
* gui: improve and streamline CSRF protection
|
||
|
* netflow: fixed bug with reporting frontend in Safari
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.12 (April 27, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
How are you doing? We have been doing fine, trying new things, moving
|
||
|
on further... The progress for our upcoming version 16.7 now accumulates
|
||
|
to 3 full months. To that end we are making the transition from ALPHA toi
|
||
|
BETA on the 16.7 development series. And since we have been asked to
|
||
|
incorporate development change logs as well, look no further (well, look
|
||
|
below).
|
||
|
|
||
|
Anyway, 16.1.12 brings a handful of anticipated additions like FreeBSD's
|
||
|
package manager version 1.7.2 and the ability to use CoDel / FQ-Codel in
|
||
|
the traffic shaper. We have also started to move services to the plugin
|
||
|
framework instead of having them in the base installation. And, maybe as
|
||
|
a last point, initial work for fixing the trusty apinger utility for
|
||
|
gateway monitoring has surfaced.
|
||
|
|
||
|
Here is the full change log for 16.1.12:
|
||
|
|
||
|
* ports: pkg 1.7.2 `[1] <https://github.com/freebsd/freebsd-ports/commit/aabba637e>`__ `[2] <https://github.com/freebsd/freebsd-ports/commit/d3e9dc5ee>`__ `[3] <https://github.com/freebsd/freebsd-ports/commit/057fbfc94b>`__ , sqlite 3.12.1 `[4] <https://sqlite.org/releaselog/3_12_1.html>`__ , squid 3.5.17 `[5] <http://ftp.meisei-u.ac.jp/mirror/squid/squid-3.5-ChangeLog.txt>`__
|
||
|
* firewall: skip anti-lockout WAN rule when only LAN is connected
|
||
|
* firewall: clean up unused alias tabes
|
||
|
* firewall: improve alias usage validation
|
||
|
* firewall: validate / transform url content before save
|
||
|
* traffic shaper: add Codel / FQ-CoDel support `[6] <https://github.com/opnsense/core/issues/505>`__
|
||
|
* firmware: changed "halt" to "power off"
|
||
|
* firmware: advertise current product and os version in API
|
||
|
* firmware: kernel and base fetch will now advertise download progress
|
||
|
* interfaces: translation fixes (contributed by Fabian Franz)
|
||
|
* system: fix RRD boot error for CPU temperature graph
|
||
|
* gateways: code modernisation for the trusty apinger utility
|
||
|
* ipsec: added service control to log page
|
||
|
* captive portal: cleanse cert output before write
|
||
|
* proxy: cleanse cert output before write
|
||
|
* proxy: do not stop authenticating after an empty string
|
||
|
* proxy: added log page to ACL
|
||
|
* proxy: remove auth local database as default
|
||
|
* smart: removed from base, can be installed as plugin "os-smart"
|
||
|
|
||
|
And this is the change log for 16.7 BETA:
|
||
|
|
||
|
* netflow: finished exporter capable of sending NetFlow to multiple
|
||
|
remote destinations
|
||
|
* netflow: finished local reporting frontend on top of collected
|
||
|
NetFlow data
|
||
|
* interfaces: polling mode has been deprecated and will be phased
|
||
|
out soon
|
||
|
* vpn: L2TP, PPTP and PPPoE servers have been ported to use MPD5
|
||
|
* vpn: legacy servers have been prepared to be moved from base
|
||
|
install to plugins
|
||
|
* cron: code preparations for opening up the MVC cron API
|
||
|
* tests: added a unit test framework and several tests
|
||
|
* backup: reworked the RRD and DHCP leases backup strategies
|
||
|
* backup: added the ability to also backup local NetFlow data
|
||
|
* plugins: added the HAProxy plugin (contributed by Frank Wall)
|
||
|
* kernel: CoDel / FQ-CoDel AQM patch version 0.2
|
||
|
* kernel: HardenedBSD's ASLR
|
||
|
* languages: translations have their own repository and package now
|
||
|
* languages: updated Dutch, French, German, Japanese, Russian
|
||
|
* languages: can now collect strings from all plugins
|
||
|
* languages: first steps for Portuguese
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.11 (April 18, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
We are skipping a bit ahead with 16.1.11 to address a CSRF vulnerability,
|
||
|
which outlines the path we have been on since we started `[1] <https://forum.opnsense.org/index.php?topic=2837.0>`__ and we will
|
||
|
surely continue this security-aware trend.
|
||
|
|
||
|
In other news, this update includes native GeoIP alias support, captive
|
||
|
portal voucher customisations requested by many and the last batch of
|
||
|
Russian, effectively bringing it to 100% completed. Wow!
|
||
|
|
||
|
Here is the full change log:
|
||
|
|
||
|
* services: fix CSRF vulnerability in status_services.php `[2] <https://cxsecurity.com/issue/WLB-2016040106>`__
|
||
|
* www: strengthen CSRF secret generation for legacy pages
|
||
|
* dhcp: bring back usage of the authoritative directive
|
||
|
* system: allow periodic backups of RRD and DHCP for non-MFS
|
||
|
* openvpn: status page would not show the correct process status
|
||
|
* captive portal: add option for less secure passwords, password and username length
|
||
|
* firewall: add GeoIP aliases feature
|
||
|
* languages: completed Russian translation (contributed by Smart-Soft)
|
||
|
* languages: updated French
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.10 (April 14, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
It has been a quite uneventful week. Suricata and Squid have been
|
||
|
upgraded to their latest versions and you can find their individual
|
||
|
change logs below. The next part of the Russian translation brings
|
||
|
it to number one with a dreamy 83% completed. Otherwise only small
|
||
|
fixes and improvements have been made and those will not even require
|
||
|
a reboot.
|
||
|
|
||
|
Here is the full list of changes:
|
||
|
|
||
|
* ports: suricata 3.0.1 `[1] <https://suricata-ids.org/2016/04/04/suricata-3-0-1-released/>`__ , squid 3.5.16 `[2] <http://ftp.meisei-u.ac.jp/mirror/squid/squid-3.5-ChangeLog.txt>`__
|
||
|
* traffic shaper: added individual tabs to quick navigation
|
||
|
* traffic shaper: fix behaviour on pppoe devices
|
||
|
* openvpn: revive windows installer binaries
|
||
|
* firewall: validate alias url download
|
||
|
* system: improved config history and backup pages layout
|
||
|
* system: increased backup count default from 30 to 60
|
||
|
* system: moved several settings to different pages for better technology alignment
|
||
|
* system: /var /tmp MFS awareness for crash dumps added
|
||
|
* trust: add "IP security IKE intermediate" to server key usage
|
||
|
* firmware: moved reboot, halt and defaults pages to new home
|
||
|
* proxy: add redirection rule creation link for HTTPS proxy (contributed by Fabian Franz)
|
||
|
* pptp: prevent service from printing boot messages due to a stale entry in the default config.xml
|
||
|
* interfaces: show LAGG protocol in overview page
|
||
|
* languages: another large batch of Russian, now 83% complete (contributed by Smart-Soft)
|
||
|
* languages: updated French, German and Japanese
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.9 (April 08, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
We expect all of you are doing well? It has been a longer while
|
||
|
since the last update so 16.1.9 has got a bit of everything to
|
||
|
keep the spirits high. :)
|
||
|
|
||
|
There is tremendous progress in the translations. It just so
|
||
|
happens that we now have a comprehensive Russian translation as
|
||
|
well which is going to be completed in the upcoming weeks. Many
|
||
|
thanks to Smart-Soft for making this happen. The contender
|
||
|
is Japanese through the work of Chie Taguchi, who did most of the
|
||
|
translation that we have had for a year. It is going to be a
|
||
|
close race to the finish line for both languages. Then again,
|
||
|
the whole translation team is doing an amazing job.
|
||
|
|
||
|
As polarising as it may be, we have added HTTPS support in the
|
||
|
proxy server. Another noteworthy item is StrongSwan 5.4.0, which
|
||
|
helps to address IPSec status page hangs that some have observed
|
||
|
with complex setups. We are looking for feedback for these items,
|
||
|
please do write in.
|
||
|
|
||
|
Here are the full patch notes:
|
||
|
|
||
|
* src: tzdata updated to 2016c `[1] <http://mm.icann.org/pipermail/tz-announce/2016-March/000037.html>`__
|
||
|
* src: prevent kernel panic on ipfw/dummynet module unload
|
||
|
* src: let ng_ether_attach() only attach to supported types to avoid kernel panics
|
||
|
* ports: curl 7.48.0 `[2] <https://curl.haxx.se/changes.html>`__ , strongswan 5.4.0 `[3] <https://wiki.strongswan.org/projects/strongswan/wiki/Changelog54>`__ , pcre 8.38 (patched CVE-2016-1283) `[4] <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1283>`__ , php 5.6.20 `[5] <https://php.net/ChangeLog-5.php#5.6.20>`__
|
||
|
* languages: added Russian to the release, now 60% complete (contributed by Smart-Soft)
|
||
|
* languages: updated Japanese, now 70% complete (contributed by Chie Taguchi)
|
||
|
* languages: updated German, now 81% complete
|
||
|
* languages: updated French, now 50% complete
|
||
|
* firewall: allow editing of up to 5000 aliases
|
||
|
* firewall: remove link to associated filter rule edit as edit is not allowed
|
||
|
* firewall: add port range check to aliases edit
|
||
|
* firewall: when alias URL SSL verification is off, do not verify the hostname either
|
||
|
* firewall: condense alias pages into a single view
|
||
|
* firewall: remember scrolling position to return to the previous position after edit
|
||
|
* firewall: alias import now supports type selection (network and host types)
|
||
|
* firmware: added German-based mirror (contributed by Alexander Lauster)
|
||
|
* system: load modules before setting tunables to support settings for modules
|
||
|
* system: fix boot issue that prevented SSH from starting up in some instances
|
||
|
* interface: do not show wireless parents on the assignment page as it cannot be assigned
|
||
|
* ipsec: individual collapse/expand for status page
|
||
|
* dhcp: allow backwards-compatibility with imported configs
|
||
|
* captive portal: fix missing busyTimeout on voucher database access
|
||
|
* openvpn: remember scrolling position to return to the previous position after edit
|
||
|
* proxy: HTTPS support added
|
||
|
* proxy: added ability to change the hostname and admin email (contributed by Frederic Lietart)
|
||
|
* proxy: avoid race condition on cache dir creation (contributed by Frederic Lietart)
|
||
|
* development: allow hiding of menu entries using the Visibility="delete" attribute
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.8 (May 23, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
This quick 16.1.8 is not a big update, but it means a lot. We have
|
||
|
finished our full sweep of the GUI to update the look and feel of all
|
||
|
pages and made the code ready for what is to come now: new features
|
||
|
that are on our roadmap for 16.7. The first one will be the HTTPS
|
||
|
proxy, but there is also NetFlow and improved statistics / reporting
|
||
|
on the shortlist.
|
||
|
|
||
|
A day after 16.1.7 was out last week, FreeBSD 10.2-RELEASE-p14 was
|
||
|
announced. Of the four patches enclosed, the two Hyper-V patches we
|
||
|
have already brought to OPNsense over a month ago, the OpenSSH patch
|
||
|
does not apply since we only use the port and already had it up-to-date.
|
||
|
That leaves us with only one patch that we are shipping now to complete
|
||
|
the experience.
|
||
|
|
||
|
Attention to everyone using OpenVPN + cryptodev acceleration: the
|
||
|
cryptodev module along with older crypto drivers has been removed
|
||
|
from the kernel itself, which means that if you need to keep using
|
||
|
it, go to System: Settings: Misc and reconfigure your crypto hardware
|
||
|
including an enable of cryptodev usage.
|
||
|
|
||
|
The refreshed images for 16.1 (based on 16.1.8) have been pushed to
|
||
|
the mirrors. You can find the checksums attached at the end of this
|
||
|
announcement.
|
||
|
|
||
|
https://opnsense.org/download/
|
||
|
|
||
|
Here are the full patch notes:
|
||
|
|
||
|
* src: updated tzdata to version 2016b `[1] <http://mm.icann.org/pipermail/tz-announce/2016-March/000036.html>`__
|
||
|
* src: fix incorrect argument validation in sysarch `[2] <https://www.freebsd.org/security/advisories/FreeBSD-SA-16:15.sysarch.asc>`__
|
||
|
* src: fix pfi_table_update: cannot set new addresses
|
||
|
* src: added APU2 temperature sensor support
|
||
|
* ports: unbound 1.5.8 `[3] <https://nlnetlabs.nl/projects/unbound/download/>`__ , sudo 1.8.16 `[4] <https://www.sudo.ws/stable.html#1.8.16>`__ , pcre 8.38 `[5] <http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup>`__
|
||
|
* proxy: better matching for overlapping URLs
|
||
|
* universal plug and play: refactored pages for improved look and feel
|
||
|
* vpn: refactored L2TP and PPTP pages for improved look and feel
|
||
|
* openvpn: fix missed configure stage for Peer to Peer (TLS/SSL) mode
|
||
|
* system: reworked the behaviour of thermal and crypto modules
|
||
|
* firewall: tweaked a few rule indicator icons to improve clarity
|
||
|
* firewall: improved alias validation on edit
|
||
|
* interfaces: also add previous DHCP override fixes for IPv6
|
||
|
* language: updated French and German
|
||
|
|
||
|
|
||
|
|
||
|
.. code-block::
|
||
|
|
||
|
# SHA256 (OPNsense-16.1.8-OpenSSL-cdrom-amd64.iso.bz2) = 6cdf41e71ad98499bc1c787f03c1e7d055855434c1a7c7917d147a27b18eaecf
|
||
|
# SHA256 (OPNsense-16.1.8-OpenSSL-nano-amd64.img.bz2) = d290d9e4d63b5998573b88b4c5fbcee8a4af8448aaa363476945de075d20efd1
|
||
|
# SHA256 (OPNsense-16.1.8-OpenSSL-serial-amd64.img.bz2) = cbf459c8b0313cbd601af478317f2227e360871e83f60a3891be4b94a4feb948
|
||
|
# SHA256 (OPNsense-16.1.8-OpenSSL-vga-amd64.img.bz2) = 3d75b4e6a24a26e081a267b06b24b71cce15ab965e502cc66575fe6225cb9eb9
|
||
|
|
||
|
.. code-block::
|
||
|
|
||
|
# SHA256 (OPNsense-16.1.8-OpenSSL-cdrom-i386.iso.bz2) = a25550ce5468903eb020da5e7a2bda6e306a92eb5c84949604c12cb3ffafa7f8
|
||
|
# SHA256 (OPNsense-16.1.8-OpenSSL-nano-i386.img.bz2) = 3a00cfba7c43fd63114616d3ee8964c953bbb69c53f284d69617b93d61aaa677
|
||
|
# SHA256 (OPNsense-16.1.8-OpenSSL-serial-i386.img.bz2) = 775ec2fc3a74996d1fa9b083799e25f6c4a28943ff0ce4508fbe44e897879748
|
||
|
# SHA256 (OPNsense-16.1.8-OpenSSL-vga-i386.img.bz2) = 919675cbec826ea81076a68985860c0d18da1a7c81d37636207b4f5e14d44c5b
|
||
|
|
||
|
.. code-block::
|
||
|
|
||
|
# MD5 (OPNsense-16.1.8-OpenSSL-cdrom-amd64.iso.bz2) = f585005298cc39c3ad6629f71e6102ad
|
||
|
# MD5 (OPNsense-16.1.8-OpenSSL-nano-amd64.img.bz2) = 729f5c34254cdca51ae5ae1c50600ab3
|
||
|
# MD5 (OPNsense-16.1.8-OpenSSL-serial-amd64.img.bz2) = bb62af11eb4c3abe03b4f5fa3187ff1a
|
||
|
# MD5 (OPNsense-16.1.8-OpenSSL-vga-amd64.img.bz2) = f2331360601744806e8f34c03fa8c6f2
|
||
|
|
||
|
.. code-block::
|
||
|
|
||
|
# MD5 (OPNsense-16.1.8-OpenSSL-cdrom-i386.iso.bz2) = e9a09094665b1183f49d42b9d5a2b785
|
||
|
# MD5 (OPNsense-16.1.8-OpenSSL-nano-i386.img.bz2) = ecd4c75c1d5aee3189958faa9102c851
|
||
|
# MD5 (OPNsense-16.1.8-OpenSSL-serial-i386.img.bz2) = 8b9429912fd0d7f853e238e5cee4866c
|
||
|
# MD5 (OPNsense-16.1.8-OpenSSL-vga-i386.img.bz2) = 509e381469817ab9c749f7a29956ea94
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.7 (March 16, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
Time for a quick update! We are still polishing our non-MVC GUI pages
|
||
|
to match the modern style of the MVC equivalents and fix a few minor
|
||
|
bugs along the way. In these matters, we ask for your participation in
|
||
|
critically reviewing the changes below in order to catch remaining
|
||
|
issues as soon as possible. We expect to finish our full code sweep
|
||
|
next week. After that we will shift focus to work on new features.
|
||
|
|
||
|
The upgrades from 15.7.25 to 16.1.x briefly stalled with 16.1.6 due to
|
||
|
a dormant incompatibility in the FreeBSD package management tool after
|
||
|
flipping from 10.1 to 10.2, so we went ahead and made it all better.
|
||
|
More precaution in our own update tools will hopefully prevent such
|
||
|
unwanted breakage in the future, but we understand that these things
|
||
|
can slip through. :)
|
||
|
|
||
|
New images are on the way shortly after 16.1.8. We are also introducing
|
||
|
the new "opnsense-stable" firmware path and some cool upgrade features
|
||
|
for our brave testers. More explanations will follow soon.
|
||
|
|
||
|
Here are the full patch notes:
|
||
|
|
||
|
* ports: pecl-radius 1.3.0 `[1] <https://pecl.php.net/package-changelog.php?package=radius>`__ , bind 9.10.3-P4 `[2] <https://kb.isc.org/article/AA-01363/81/BIND-9.10.3-P4-Release-Notes.html>`__ , bsnmp-ucd 0.4.2 `[3] <https://github.com/trociny/bsnmp-ucd/blob/master/CHANGELOG>`__ ,
|
||
|
openssh-portable 7.2p2 `[4] <http://www.openssh.com/txt/release-7.2p2>`__ , sqlite 3.11.1 `[5] <https://sqlite.org/releaselog/3_11_1.html>`__
|
||
|
* captive portal: add session timeout to status info
|
||
|
* firewall: fix non-report of errors when filter reload errors
|
||
|
could not be parsed
|
||
|
* pppoe server: make service control buttons work with multiple
|
||
|
instances
|
||
|
* wake on lan: reworked pages for a polished look and feel
|
||
|
* load balancer: reworked pages for a polished look and feel
|
||
|
* dashboard: better colouring for widget status bars
|
||
|
* dns filter: reworked page for a polished look and feel
|
||
|
* dns rfc2136: reworked pages for a polished look and feel
|
||
|
* igmp proxy: reworked pages for a polished look and feel
|
||
|
* system: routes diagnostics page ported to MVC
|
||
|
* proxy: adjust category visibility as not all of them were shown before
|
||
|
* firmware: fix an overzealous upgrade run when the package tool only
|
||
|
changes options
|
||
|
* firmware: fixed the binary upgrade patch from 15.7.x in FreeBSD's
|
||
|
package tool
|
||
|
* network time: reworked pages for a polished look and feel
|
||
|
* system: removed NTP settings from general settings
|
||
|
* snmp: refactored page for a polished look and feel
|
||
|
* access: let only root access status.php as it leaks too much info
|
||
|
* development: remove the automount features
|
||
|
* development: added in-place package upgrades using the upstream
|
||
|
repository
|
||
|
* development: addition of "opnsense-stable" package on our way to
|
||
|
nightly builds
|
||
|
* development: opnsense-update can now install locally available base
|
||
|
and kernel sets
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.6 (March 09, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
It is update time! This time around, DHCP and DNS have been freshened up
|
||
|
thoroughly, removing both potential and real problems from the GUI and
|
||
|
underneath. Additionally, the proxy server gained ICAP support and a
|
||
|
category-based remote block list selection.
|
||
|
|
||
|
Our firmware mirror support has finally been extended so that it is now
|
||
|
possible to pull all updates from a single mirror, which will very soon
|
||
|
make it possible to run a local mirror for your internal installations.
|
||
|
We are also shipping the original FreeBSD OpenSSL patch, although the
|
||
|
security issues cannot not surface on OPNsense. We just like to be
|
||
|
thorough.
|
||
|
|
||
|
Here are the full patch notes:
|
||
|
|
||
|
* src: Fix multiple vulnerabilities of OpenSSL `[1] <https://github.com/freebsd/freebsd/commit/7d8d4cb5>`__
|
||
|
* src: update tzdata to 2016a `[2] <http://mm.icann.org/pipermail/tz-announce/2016-January/000035.html>`__
|
||
|
* ports: openssh-portable 7.2p1 `[3] <http://www.openssh.com/txt/release-7.2>`__ , isc-dhcp-43 4.3.3P1_1 `[4] <https://www.isc.org/blogs/isc-dhcp-4-3-0-is-live/>`__ ,
|
||
|
php 5.6.19 `[5] <https://php.net/ChangeLog-5.php#5.6.19>`__ , curl 7.41.1 `[6] <https://curl.haxx.se/changes.html>`__
|
||
|
* firmware: mirror selection has been widened to include kernel/base
|
||
|
upgrades
|
||
|
* firmware: bootstrap utility can now directly install e.g. the
|
||
|
development version
|
||
|
* dhcp: all GUI pages have been reworked for a polished look and feel
|
||
|
* proxy: added category-based remote file support if compressed file
|
||
|
contains multiple files
|
||
|
* proxy: added ICAP support (contributed by Fabian Franz)
|
||
|
* proxy: hook up the transparent FTP proxy
|
||
|
* proxy: add intercept on IPv6 for FTP and HTTP proxy options
|
||
|
* logging: syslog facilities, like services, are now fully pluggable
|
||
|
* vpn: stripped an invalid PPTP server configuration from the standard
|
||
|
configuration
|
||
|
* vpn: converted to pluggable syslog, menu and ACL
|
||
|
* dyndns: all GUI pages have been reworked for a polished look and feel
|
||
|
* dyndns: widget now shows IPv6 entries too
|
||
|
* dns forwarder: all GUI pages have been reworked for a polished
|
||
|
look and feel
|
||
|
* dns resolver: all GUI pages have been reworked for a polished
|
||
|
look and feel
|
||
|
* dns resolver: rewrote the dhcp lease registration hooks
|
||
|
* dns resolver: allow parallel operation on non-standard port when dns
|
||
|
forwarder is running as well
|
||
|
* firewall: hide outbound nat rule input for "interface address" option
|
||
|
and toggle bitmask correctly
|
||
|
* interfaces: fix problem when VLAN tags weren't generated properly
|
||
|
* interfaces: improve interface capability reconfigure
|
||
|
* ipsec: fix service restart behaviour from GUI
|
||
|
* captive portal: add missing chain in certificate generation
|
||
|
* configd: improve recovery and reload behaviour
|
||
|
* load balancer: reordered menu entries for clarity
|
||
|
* ntp: reordered menu entries for clarity
|
||
|
* traffic shaper: fix mismatch for direction + dual interfaces setup
|
||
|
* languages: updated German and French
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.5 (March 02, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
It pleases us to say that although we ship the latest OpenSSL 1.0.2g today,
|
||
|
we have had both SSv2 and SSv3 support disabled in our installation for a
|
||
|
long while, so older installations are also not affected by yesterday's
|
||
|
announcement. On a slightly related note, LibreSSL was not affected at all.
|
||
|
|
||
|
With that out of the way, we also happily let you know that we are shipping
|
||
|
RFC 4638 support with this stable release. We also push a fix for an
|
||
|
upstream bug in Unbound and update Squid to the latest version... again. ;)
|
||
|
|
||
|
We have also announced the roadmap for 16.7. Take a look at our upcoming
|
||
|
milestones:
|
||
|
|
||
|
https://opnsense.org/about/road-map/
|
||
|
|
||
|
And now, here are the full patch notes:
|
||
|
|
||
|
* ports: squid 3.5.15 `[1] <http://ftp.meisei-u.ac.jp/mirror/squid/squid-3.5-ChangeLog.txt>`__ , unbound 1.5.7 hotfix `[2] <https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=729>`__ , pkg 1.6.4 hotfix `[3] <https://github.com/freebsd/pkg/issues/1394>`__ ,
|
||
|
openssl 1.0.2g `[4] <https://www.openssl.org/news/secadv/20160301.txt>`__
|
||
|
* services: infrastructure rework for plugin additions
|
||
|
* openvpn: added copy/move to client-specific overrides
|
||
|
* openvpn: allow binding client-specific overrides to specific server(s)
|
||
|
* openvpn: service on/off toggle via overview pages
|
||
|
* openvpn: fix problem with service status display
|
||
|
* openvpn: when services are disabled, make sure a reconfigure will always
|
||
|
stop the associated process
|
||
|
* vpn: transform PPTP, L2TP and PPPoE servers to plugin addition to be
|
||
|
removed from base install for 16.7
|
||
|
* vpn: add proper service probing for PPTP, L2TP and PPPoE servers
|
||
|
* interfaces: added RFC 4638 support (MTU > 1492 in PPPoE)
|
||
|
* ntp: disable when no servers are set
|
||
|
* language: updates for Chinese, French and German
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.4 (February 24, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
We pop in for a short stable update, namely 16.1.4. Squid has been
|
||
|
updated to 3.5.14 and received a GUI entry for maximum_object_size
|
||
|
to define since the default has been reported as a wee bit too small.
|
||
|
|
||
|
In other news, the final roadmap for 16.7 will be unveiled later this
|
||
|
week after much internal discussion. Our main goals are to finish a
|
||
|
full code audit, further alignment with FreeBSD and a few tiny
|
||
|
surprises. Stay tuned for those. :)
|
||
|
|
||
|
Here are the full patch notes:
|
||
|
|
||
|
* ports: squid 3.5.14 `[1] <http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID_3_5_14.html>`__
|
||
|
* dhcp: fix menu expand with IPv6 configuration
|
||
|
* captive portal: fix database timeout lock message
|
||
|
* interfaces: fix expand/collapse on status page for Edge
|
||
|
* proxy: add maximum_object_size setting for squid
|
||
|
* load balancer: improve filter reload to prevent traffic
|
||
|
lockout (contributed by Frank Wall)
|
||
|
* layout: fix searchable dropdown truncation with IE
|
||
|
* firewall: fix action buttons on alias edit
|
||
|
* menu: updated help menu entries
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.3 (February 17, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
It is time for a smaller update to 16.1.3. There is another fix for our
|
||
|
Hyper-V users, the health section finally received its CPU temperature
|
||
|
graph and a few ports have been updated to their latest version. Nothing
|
||
|
of particular interest happened, no issues with glibc from our side today. :)
|
||
|
|
||
|
A number of assorted issues have been flushed from the code thanks to good
|
||
|
use of the crash reporter. A special thank you goes to those of you who
|
||
|
submit email addresses and a brief description along with the report. For
|
||
|
us it is tremendously useful to get as many details as possible and to
|
||
|
verify that our fixed work reliably in a particular use cases before
|
||
|
shipping them.
|
||
|
|
||
|
Enough with the announcing already, here are the full patch notes:
|
||
|
|
||
|
* src: hyperv/kvp: wake up the daemon if it is sleeping due to poll() `[1] <https://github.com/opnsense/core/issues/748>`__
|
||
|
* src: Use correct src/dst ports when removing states in pf `[2] <https://github.com/opnsense/src/pull/9>`__
|
||
|
* src: finish the boot loader branding by adding a shiny logo
|
||
4 years ago
|
* ports: unbound 1.5.7 `[3] <https://nlnetlabs.nl/projects/unbound/download/>`__ , openldap 2.4.44 `[4] <https://www.openldap.org/software/release/changes.html>`__ , ca_root_nss 3.22,
|
||
5 years ago
|
php 5.7.18 `[5] <https://php.net/ChangeLog-5.php#5.6.18>`__ , phalcon 2.0.10 `[6] <https://github.com/phalcon/cphalcon/releases/tag/phalcon-v2.0.10>`__ , pkg 1.6.4 `[7] <https://github.com/freebsd/freebsd-ports/commit/364bf01c846>`__ `[8] <https://github.com/freebsd/freebsd-ports/commit/69fe3e55ff5>`__
|
||
|
* interfaces: collapsible overview for each interface
|
||
|
* shaper: fix issue with model when not able to save an old config
|
||
|
* health: added pages to ACL for configurable user access
|
||
|
* health: record system CPU temperature in additional graph
|
||
|
* firmware: add UK-based mirror (contributed by Will Jones)
|
||
|
* access: force a visible and non-critical page on non-access redirect
|
||
|
* access: make sure "/" is handled like "/index.php"
|
||
|
* configuration: add a number of previously missing config sections for
|
||
|
selection on restore/backup
|
||
|
* firewall: bring back alias nesting
|
||
|
* dhcp: add missing DNS resolver awareness
|
||
|
* dhcp: fix multiple minor crash reports
|
||
|
* radvd: add missing DNS resolver awareness
|
||
|
* captive portal: ensure MAC address is saved in lowercase and improve
|
||
|
validation
|
||
|
* captive portal: fix unicode issue in template generation
|
||
|
* captive portal: correct syslog redirection regression
|
||
|
* crash reporter: limit log size upload to 1MB
|
||
|
* cron: fix validation of hour value
|
||
|
* intrusion detection: show origin link of rule sets in details
|
||
|
* services: add background daemon to known services for easy reload
|
||
|
* services: add captive portal to known services for easy reload
|
||
|
* services: improve redirect on service reload in diagnostics page
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.2 (February 05, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
It is time for a swift update for our dear Hyper-V users. There is a
|
||
|
packet forwarding regression in FreeBSD 10.2 that has not been added
|
||
|
as errata yet so we had to pin it down with the help of three brave
|
||
|
testers. If you happen to want to run Hyper-V without going through
|
||
|
the issue, install from an older 15.7 image and upgrade directly to
|
||
|
avoid the bad version.
|
||
|
|
||
|
To improve upon Suricata 3.0 and the SSL fingerprint lists we are now
|
||
|
enabling users to add user-defined rules for adding and enforcing their
|
||
|
own fingerprints. But wait, that is not all. On top of that the IP
|
||
|
geolocation feature was added as well while at it. :)
|
||
|
|
||
|
Otherwise, only smaller bugs have been addressed to make 16.1 look
|
||
|
even shinier. The FreeBSD security advisory for OpenSSL got integrated
|
||
|
too, but is not of much concern since we consistently use the ports
|
||
|
version for our components. The important fixes have been shipped
|
||
|
with version 16.1.1 back on Monday.
|
||
|
|
||
|
Here are the full patch notes:
|
||
|
|
||
|
* src: OpenSSL SSLv2 ciphersuite downgrade vulnerability `[1] <https://www.freebsd.org/security/advisories/FreeBSD-SA-16:11.openssl.asc>`__
|
||
|
* src: Fix packet forwarding in Hyper-V netvsc driver `[2] <https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=203630>`__
|
||
|
* src: Honour disabled pf(4) log flag on dropped packets with IP options `[3] <https://reviews.freebsd.org/D3222>`__
|
||
|
* ports: curl 7.47.0 `[4] <https://curl.haxx.se/changes.html>`__ , nettle 3.2 `[5] <https://fossies.org/diffs/nettle/3.1.1_vs_3.2/ChangeLog-diff.html>`__
|
||
|
* wizard: fix certificate generation for OpenVPN
|
||
|
* firewall: fix interface selection on post issues in floating rules
|
||
|
* firewall: make category filter multi-select for maximum convenience
|
||
|
* firewall: do not hide gateways from the gateway selection
|
||
|
* firewall: added null routes to the gateway selection
|
||
|
* firewall: rather than hiding associated nat rules, remove their edit
|
||
|
and clone buttons so they can still be deleted manually
|
||
|
* dns resolver: fix $numprocs setting in config according to manual
|
||
|
* dns resolver: do not render illegal output for empty IPv6 addresses
|
||
|
* dhcp: applying static mappings with DNS resolver enabled no longer
|
||
|
seems stuck in apply step
|
||
|
* search: resize box on focus and also propagate proxy server tabs
|
||
|
* system: fix inversion bug of the default pass logging setting
|
||
|
* captive portal: properly log messages to associated log file
|
||
|
* intrusion detection: can now add user rules based on SSL fingerprints
|
||
|
and IP geolocation
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1.1 (February 02, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
Today we are following up on the OpenSSL advisories. LibreSSL was not
|
||
|
affected (surprise, surprise), but received a tiny fix to sync up with
|
||
|
the deprecation of the high-severity SSL_OP_SINGLE_DH_USE option of its
|
||
|
sibling.
|
||
|
|
||
|
In other news, we are shipping a few minor fixes along with all-new
|
||
|
SSL-centric rulesets for the intrusion prevention courtesy of abuse.ch `[3] <https://www.abuse.ch/>`__ .
|
||
|
Protect your assets, they are worth it!
|
||
|
|
||
|
Without fuzz, here are the full patch notes:
|
||
|
|
||
|
* ports: libressl 2.2.6 `[1] <http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.2.6-relnotes.txt>`__ , openssl 1.0.2f `[2] <https://www.openssl.org/news/secadv/20160128.txt>`__
|
||
|
* intrusion prevention: add SSL fingerprint blacklist and other abuse lists
|
||
|
(courtesy of abuse.ch `[3] <https://www.abuse.ch/>`__ )
|
||
|
* captive portal: limit the max vouchers per call
|
||
|
* captive portal: change voucher download filename to match group name
|
||
|
* captive portal: strip bad characters from group name
|
||
|
* captive portal: fix multiple voucher generation
|
||
|
* firewall: add rule categorisation tag field
|
||
|
* search: tweak padding to align with right visual boarder
|
||
|
* console: fix halt script to show product name again
|
||
|
* firmware: revoked the old 15.7 update fingerprint
|
||
|
* interfaces: fix VLAN edit page to show the correct page name
|
||
|
* squid: fix authentication script permission regression
|
||
|
* dashboard: remove non-authoriative hardware crypto probing
|
||
|
* system: do not accept an authentication server with an empty name
|
||
|
* system: added hint that device polling setting needs reboot
|
||
|
(contributed by Olivier Paroz)
|
||
|
* system: assorted translation fixes (contributed by Fabian Franz)
|
||
|
* logging: unhide IGMP packets from firewall log view
|
||
|
(contributed by Isaac Levy)
|
||
|
|
||
|
|
||
|
|
||
|
--------------------------------------------------------------------------
|
||
|
16.1 (January 28, 2016)
|
||
|
--------------------------------------------------------------------------
|
||
|
|
||
|
|
||
|
No, we would not say it was easy getting here, but booting into 16.1
|
||
|
for the first time sure is as relieving (and exciting) as it could get
|
||
|
for our project growing beyond what we had ever imagined. It has been
|
||
|
more than a year since OPNsense first came out. Back then it was
|
||
|
FreeBSD 10.0. Not even two months after, 10.1 was introduced along
|
||
|
with the opnsense-update utility. Today is the day for FreeBSD 10.2,
|
||
|
the latest and greatest release currently available for broader driver
|
||
|
support and stability improvements.
|
||
|
|
||
|
16.1 is nicknamed "Crafty Coyote" in honour of our beloved childhood
|
||
|
TV sessions. It is the accumulation of 6 months of work, having had
|
||
|
our focus on reengineering the captive portal, native intrusion
|
||
|
prevention, plugin support, and transforming the reporting frontend
|
||
|
into something more modern and flexible just to name a few `[1] <https://opnsense.org/about/road-map/>`__ . Apart
|
||
|
from the recently published security advisories (see patch notes below),
|
||
|
we have included a quick navigation feature which can be activated by
|
||
|
pressing (TAB) followed by search keywords and hitting (ENTER) to go to
|
||
|
the desired page. Last but not least, a larger batch of improvements
|
||
|
and fixes went into assorted sections of the GUI that certainly help
|
||
|
to get your work done without ending up dazed and confused.
|
||
|
|
||
|
Speaking of clearing things up, there is more... While Ad, Franco
|
||
|
and a couple of amazing external contributors have been busy writing
|
||
|
and reviewing code, Jos worked in the shadows to bring to you a fully
|
||
|
revised set of project documentation in the form of an online
|
||
|
handbook `[2] <https://docs.opnsense.org/>`__ . More content will follow as we slow down development
|
||
|
speed a bit in order to catch up. We will have to see how that works
|
||
|
out. ;)
|
||
|
|
||
|
Another thing we have noticed is that translations are hard! We have
|
||
|
planned to finish a translation for this iteration, but the sheer
|
||
|
amount of work overwhelmed even the sizeable German translation team.
|
||
|
The German translation is now at 77% percent completed with Japanese,
|
||
|
Chinese and French chasing tails. If you want to help drop us a line
|
||
|
at project@opnsense.org for details on how to contribute.
|
||
|
|
||
|
All images have been pushed as well, although may take a bit more time
|
||
|
to reach a mirror near you. You can find the checksums attached at the
|
||
|
end of this announcement.
|
||
|
|
||
|
https://opnsense.org/download/
|
||
|
|
||
|
Finally, here are the full patch notes:
|
||
|
|
||
|
* src: FreeBSD 10.2-RELEASE-p11 `[4] <https://www.freebsd.org/releases/10.2R/announce.html>`__
|
||
|
* bootstrap: can now update from any available FreeBSD 10 release
|
||
|
* ports: libarchive 3.1.2_6 `[5] <https://vuxml.freebsd.org/freebsd/7c63775e-be31-11e5-b5fe-002590263bf5.html>`__ , Suricata 3.0 `[6] <http://suricata-ids.org/2016/01/27/suricata-3-0-available/>`__ , squid 3.5.13 `[7] <http://ftp.meisei-u.ac.jp/mirror/squid/squid-3.5-ChangeLog.txt>`__ ,
|
||
|
bind 9.10.3P3 `[8] <https://kb.isc.org/article/AA-01346/81/BIND-9.10.3-P3-Release-Notes.html>`__ , sqlite 3.10.2 `[9] <https://sqlite.org/releaselog/3_10_2.html>`__ , ntp 4.2.8p6 `[10] <http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities>`__
|
||
|
* firewall: lock source / destination port settings when neither
|
||
|
TCP nor UDP is selected
|
||
|
* firewall: simplify the outbound page to hide unwanted items and
|
||
|
zap complicated explanations (contributed by Manuel Faux)
|
||
|
* firewall: do not leak floating rules into other interface tabs
|
||
|
* firewall: add clear button to all log file types
|
||
|
* firewall: hide NAT rules from normal rules screen
|
||
|
* firewall: removed the unsupported dscp rule option
|
||
|
* firewall: display alias descriptions as tooltips (contributed by
|
||
|
Manuel Faux)
|
||
|
* universal plug and play: switch to secure mode as the new default
|
||
|
* unbound: add MX entries to host overrides (contributed by Manuel Faux)
|
||
|
* gateways: always safe the monitor IP regardless of monitoring being
|
||
|
on or off
|
||
|
* gateways: properly add and remove routes for monitors on toggle
|
||
|
* backend: fix harmless error message caused by a sample template
|
||
|
* high availability: allow specification of a different port for
|
||
|
synchronisation
|
||
|
* high availability: special characters are now being properly preserved
|
||
|
* high availability: added new captive portal and traffic shaper as
|
||
|
sync options
|
||
|
* high availability: reworked and pruned the client synchronisation
|
||
|
* firmware: optional php extensions now peacefully coexist with
|
||
|
preinstalled extensions
|
||
|
* firmware: update plugin list on refresh to reveal available plugin list
|
||
|
* intrusion detection: adds intrusion prevention mode for netmap(4)
|
||
|
devices (must disable Hardware CRC manually)
|
||
|
* captive portal: completely rewritten on top of our new components
|
||
|
* proxy: hook up remote ACL settings to translation engine (contributed
|
||
|
by Fabian Franz)
|
||
|
* proxy: add support for compressed ACLs (.gz, .tar.gz, .tgz, .zip)
|
||
|
* proxy: fix toggle for storage log
|
||
|
* ipsec: improve display of tunnel overview
|
||
|
* openvpn: provide full ca chain on client export (contributed by
|
||
|
Manuel Faux)
|
||
|
* openvpn: fix engine detection for LibreSSL
|
||
|
* layout: all tooltips and icons of action buttons have been updated
|
||
|
for proper look and feel (contributed by Manuel Faux)
|
||
|
* layout: added the infamous quick navigation feature
|
||
|
* layout: consolidated the display of the upper right corner
|
||
|
as "user@host.domain"
|
||
|
* interfaces: reworked all the pages for proper look and feel
|
||
|
* interfaces: ARP and NDP tables have been rewritten and now properly
|
||
|
show vendor info
|
||
|
* login: improved look and feel
|
||
|
* dashboard: rss widget has been reworked and its library has been
|
||
|
updated to a new version
|
||
|
* config: recover last backup automatically on broken xml
|
||
|
* menu: properly aligned submenu icons
|
||
|
* system: removed XDebug package from the default installation
|
||
|
|
||
|
We thank all our contributors and users for their ongoing love
|
||
|
and support. <3
|
||
|
|
||
|
|
||
|
|
||
|
.. code-block::
|
||
|
|
||
|
# SHA256 (OPNsense-16.1-OpenSSL-cdrom-amd64.iso.bz2) = bd94c4bf304fa99d7fb426061cf17f45fa2e427cef3ab089704e14b2b570b261
|
||
|
# SHA256 (OPNsense-16.1-OpenSSL-nano-amd64.img.bz2) = abd0c9beb843ad8232f9fc5f0b6c68318993b55529bc06a8c331587863a6c13f
|
||
|
# SHA256 (OPNsense-16.1-OpenSSL-serial-amd64.img.bz2) = 9a5faaebc6cba481199bbc2ae5395877c8acf0dfa225e643ec5c3258e5014c4f
|
||
|
# SHA256 (OPNsense-16.1-OpenSSL-vga-amd64.img.bz2) = 85e3c4275460758565cb0eced8c69afd13a26eb8b9116d86db80be098b6d3e4b
|
||
|
|
||
|
.. code-block::
|
||
|
|
||
|
# SHA256 (OPNsense-16.1-OpenSSL-cdrom-i386.iso.bz2) = 8346db1a23563895f071a51ea86be00f7e405e5df709943b26435c13f1c898f1
|
||
|
# SHA256 (OPNsense-16.1-OpenSSL-nano-i386.img.bz2) = 380819194a3c5a508b161153cc532e8c1caaba31b08bdb01643493438634d2ab
|
||
|
# SHA256 (OPNsense-16.1-OpenSSL-serial-i386.img.bz2) = 1a413fb0563cc63e1b80278df303b092b219d6d58a87f841b7389a1a4939734a
|
||
|
# SHA256 (OPNsense-16.1-OpenSSL-vga-i386.img.bz2) = 16a360b05d3fd325499baa6bd38fcd19090ac1d5c3d8ba2a8fa3e763137e87fc
|
||
|
|
||
|
.. code-block::
|
||
|
|
||
|
# MD5 (OPNsense-16.1-OpenSSL-cdrom-amd64.iso.bz2) = 941e9cd797e4189868398fcd057a428e
|
||
|
# MD5 (OPNsense-16.1-OpenSSL-nano-amd64.img.bz2) = ededf0767412daafcb8209a3fbf85714
|
||
|
# MD5 (OPNsense-16.1-OpenSSL-serial-amd64.img.bz2) = 0094c6275128a35e6f8bf965178245eb
|
||
|
# MD5 (OPNsense-16.1-OpenSSL-vga-amd64.img.bz2) = ddaae54fe90634ca8223f483cebebaa2
|
||
|
|
||
|
.. code-block::
|
||
|
|
||
|
# MD5 (OPNsense-16.1-OpenSSL-cdrom-i386.iso.bz2) = d1a216d5eed3534d7f33a6a4482851e2
|
||
|
# MD5 (OPNsense-16.1-OpenSSL-nano-i386.img.bz2) = 871f23a40d3eee49350fe06cadb37884
|
||
|
# MD5 (OPNsense-16.1-OpenSSL-serial-i386.img.bz2) = be04acd8c51347711c4a5f58b711da8e
|
||
|
# MD5 (OPNsense-16.1-OpenSSL-vga-i386.img.bz2) = 549267467adbf194505c6daaae589ee8
|