Версия TING 1.2

1.2.5 (30 января 2018)

Этот релиз TING основан на OPNsense версии 17.7.12.

Новое от команды Смарт-Софт:

  • плагин os-proxy-useracl: привязка правил к серверу аутентификации, возможность работать с группами sms-портала

  • плагин os-sms-portal: соответствие требованиям законодательства РФ, группы пользователей, статистика и фильтрация на web-прокси

  • плагин os-netpolice: привязка правил к серверу аутентификации, возможность работать с группами sms-портала

  • плагин os-security-scanner: интегрирован сканер OpenVAS

  • плагин os-ndpi: обновлена библиотека распознавания протоколов до версии 2.2

  • web-прокси: локализация шаблонов ответов web-прокси

  • обновлён перевод на русский язык

  • добавлен перевод описаний плагинов

Изменения в OPNsense 17.7.12:

  • system: use correct crypto library to gather GUI SSL ciphers

  • system: do not wrap action buttons in tunables page

  • system: fix CA serial number decrement on save

  • firmware: remove the discontinued hotfix backend support

  • firmware: allow dot in package name during package action

  • interfaces: make level of detail stick in packet capture

  • interfaces: auto-lock problematic interfaces upon assignment

  • firewall: make NAT reflection enable less ambiguous

  • firewall: fix NAT formatting in states dump page

  • network time: fix for valid negative offset in health graph

  • network time: OPNsense NTP pool is now available

  • network time: fix parsing of overly overlong lines

  • web proxy: use PID file instead of daemon name for status probe

  • wizard: add unbound to wizard and uncheck DNSSEC by default

  • ui: HTML compliance fixes button in link usage (contributed by NOYB)

  • mvc: added mutable service controller

  • mvc: added sub-tab layout partials

  • mvc: do not render empty toggle header

  • plugins: acme-client 1.13 [5]

  • plugins: dyndns 1.5 with button in link usage fix (contributed by NOYB)

  • plugins: igmp-proxy 1.3 with button in link usage fix (contributed by NOYB)

  • plugins: tor 1.4 adds contact info (contributed by Fabian Franz)

  • plugins: web-proxy-useracl 1.0 (contributed by Smart-Soft)

  • ports: libressl 2.6.4 [6]

  • ports: php 7.1.13 [7]

1.2.4 (27 декабря 2017)

Этот релиз TING основан на OPNsense версии 17.7.11. В рамках данного обновления осуществлён переход на PHP 7.1.

Новое от команды Смарт-Софт:

  • плагин os-proxy-ntlm: NTLM-аутентификация на веб-прокси для тех, у кого нет возможности использовать Kerberos-аутентификацию

  • полная поддержка кириллических доменов во всех подсистемах

  • добавлена настройка SNMP в веб-прокси

  • обновлён перевод на русский язык

Изменения в OPNsense 17.7.11:

  • system: numerical sort for «Use» and «MTU» columns in route diagnostics

  • system: gateway group edit tier selection issue with jQuery3

  • system: minor cleanups in the certificates backend

  • firewall: move anti-lockout rule to advanced settings

  • interfaces: minor cleanups in the backend

  • reporting: rework configuration handling on the settings page

  • dnsmasq: minor cleanups in the backend

  • firmware: strip the architecture from the base / kernel set version display

  • firmware: backend preparations for full base / kernel set lock and reinstall

  • firmware: increase crash report file limit to 2 MB

  • ipsec: minor cleanups in the backend

  • unbound: register DHCP domain name for interface if found

  • network time: show full remote address and fix page boxing on status page

  • network time: add advanced custom options

  • network time: fix leap second save

  • network time: minor cleanups in the backend

  • wizard: properly redirect on input errors in system wizard

  • mvc: ignore client-side anchors in breadcrumb generation

  • ui: do not use a CSRF input element ID

  • plugins: os-freeradius 1.4.1 fixes a warning in clients (contributed by Michael Muenz)

  • ports: libxml 2.4.7 [1]

  • ports: py-ipaddress 1.0.19

Изменения в OPNsense 17.7.10:

  • system: allow user-based language setting through Lobby: Password

  • system: allow strict interface binding for OpenSSH

  • system: prepare for MVC-based routing pages

  • firewall: fix a PHP warning when no user rules are installed

  • firewall: add refresh button to table diagnostics page

  • captive portal: fix chroot regression since lighttpd web server update in 17.7.9

  • interfaces: provide a link-local IPv6 when asking for addresses

  • intrusion detection: sync port-groups to default template

  • ipsec: upgrade vici lib to match strongSwan package

  • network time: fix a PHP warning during NMEA deselect

  • mvc: do not throw disabled errors in handler

  • plugins: os-dyndns 1.4_1 fixes issue with Namecheap error parsing

  • plugins: os-freeradius 1.4.0 adds log viewer and fixes users write (contributed by Michael Muenz)

  • plugins: os-quagga 1.4.3 adds OSPF firewall rule and spinners for save (contributed by Fabian Franz)

  • plugins: os-quagga 1.4.3_1 fixes service startup regression

  • plugins: os-rfc2136 1.1_1 fixes edit button in IE 11

  • src: OpenSSL multiple vulnerabilities[2] [3]

  • ports: hyperscan 4.6.0 [4]

  • ports: openssl 1.0.2n [5]

  • ports: suricata 4.0.3 [6]

Изменения в OPNsense 17.7.9:

  • system: fix XSS with crafted certificates in certificate manager [7]

  • system: removed duplicated firmware privileges

  • system: fix resolving routes in diagnostics page

  • system: regenerated DH parameters

  • dhcp: support stateless DHCPv6

  • firmware: kernel and base set visibility and better API session handling

  • intrusion detection: improve download and install speed of et-open rules

  • intrusion detection: add TLS and HTTP logging in eve and alert log viewer

  • openvpn: allow remote network in peer to peer modes

  • web proxy: better service and API session handling

  • router advertisements: advertise on VIPs belonging to the same interface

  • configd: allow template overrides via optional target directory

  • mvc: prepare for user-based language setting (contributed by Alexander Shursha)

  • mvc: prepare for auto-generated page titles

  • mvc: tighten against frame-based attacks

  • mvc: correctly hide advanced option headers in forms (contributed by Evgeny Bevz)

  • ui: fix for deactivated storage in sticky «help all» toggle (contributed by Fabian Franz)

  • ui: make «advanced mode» sticky too

  • plugins: os-acme-client 1.12 [8]

  • plugins: os-arp-scan (contributed by Giuseppe De Marco)

  • plugins: os-clamav 1.3 (contributed by Alexander Shursha)

  • plugins: os-dyndns 1.4 adds Route53 IPv6 support (contributed by Kuo-Cheng Yeu)

  • plugins: os-freeradius 1.3.1 (contributed by Michael Muenz)

  • plugins: os-haproxy 2.0 [9]

  • plugins: os-relayd 1.2 fixes «check send» directive

  • plugins: os-tor 1.3 (contributed by Fabian Franz)

  • plugins: os-zabbix-agent 1.2 fixes service status indicator

  • plugins: os-zabbix-proxy 1.0 (contributed by Michael Muenz)

  • ports: ca_root_nss 3.34.1

  • ports: curl 7.57.0 [10]

  • ports: lighttpd 1.4.48 [11]

  • ports: php 7.1.12 [12]

  • ports: pkg 1.10.3 [13]

  • ports: py-Jinja2 2.10 [14]

A hotfix release was issued as 17.7.9_8:

  • system: correctly populate logging settings after clearing all logs

  • firewall: fix 2 PHP 7.1 warnings

  • ipsec: fix 2 PHP 7.1 warnings and one runtime error

  • interfaces: fix a PHP 7.1 warning

  • intrusion detection: add protocol display to alert dialog

  • plugins: os-haproxy 2.1 fixes HSTS usage [15]

Another hotfix release was issued as 17.7.9_9:

  • system: fix a PHP 7.1 runtime error in certificate generation

  • plugins: os-haproxy 2.2 fixes rules parameters [16]

Изменения в OPNsense 17.7.8:

  • firewall: when CARP is disabled it should enable the «Block CARP traffic»

  • firewall: isAlias() should return false when an empty name is provided

  • firewall: support non-whitespace field separators for URL table alias (contributed by shonjir)

  • firewall: table plugin support (contributed by Evgeny Bevz)

  • firewall: properly skip L2TP and PPTP interfaces in IPFW

  • firmware: add mirror courtesy of Ventura Systems, Columbia

  • firmware: crash report file size limit for upload

  • interfaces: prevent reconfigure of wireless device on rc.linkup

  • reporting: clear tooltip in health graphs

  • intrusion detection: prevent UI lockups by closing server sessions early

  • intrusion detection: add advanced payload log option

  • intrusion detection: improved alert inspection dialog

  • ipsec: add passthrough networks support

  • ipsec: add support for elliptical curve DH groups

  • router advertisements: fix DHCPv6 start in «unmanaged» mode

  • web proxy: add update cache support for Linux and Windows (contributed by Fabian Franz)

  • web proxy: add support UTF-8 domain names (contributed by Alexander Shursha)

  • web proxy: improved IPv6 alias support

  • ui: make «full help» state sticky in client session

  • lang: Japanese updates (contributed by Chie and Takeshi Taguchi)

  • lang: German updates (contributed by Fabian Franz)

  • lang: Russian updates (contributed by Smart-Soft)

  • lang: Czech updates (contributed by Pavel Borecki)

  • plugins: os-siproxd 1.2.1 with fix for RTP high port (contributed by mrpace2)

  • plugins: os-smart 1.2 now indicates if no devices have been found (contributed by Larry Meaney)

  • plugins: os-telegraf 1.1 adds network input setting (contributed by nycaleksey)

  • plugins: os-tor 1.2 adds hidden service onion service client support (contributed by Fabian Franz)

  • plugins: os-web-proxy-sso 2.1 makes Kerberos hostname configurable (contributed by Evgeny Bevz)

  • src: properly bzero kldstat structure to prevent information leak [17]

  • src: fix kernel data leak via ptrace(PT_LWPINFO) [18]

  • src: only refresh bsnmpd device table on a device add or remove event

  • src: unclog reply-to to avoid default route in shared forwarding

  • src: update timezone database information

  • ports: phalcon 3.2.4 [19]

  • ports: php 7.0.25 [20]

  • ports: sqlite 3.21.0 [21]

  • ports: openssl 1.0.2m [22]

  • ports: ca_root_nss 3.34

  • ports: sudo 1.8.21p2_1 [23]

1.2.3 (9 ноября 2017)

Этот релиз TING основан на OPNsense версии 17.7.7. В этом релизе OpenSSH обновлён до версии 7.6 и в связи с этим более не поддерживается протокол SSH версии 1 и RSA-ключи длиной менее 1024 бит. Обратите внимание на это перед обновлением. Новое от команды Смарт-Софт:

  • обновлён плагин os-netpolice: выборочное включение фильтрации сайтов по категориям для пользователей и групп, добавлена возможность применения фильтра для сайтов, которые не попали не в одну из категорий [1]

  • обновлён плагин os-c-icap: добавлен просмотр логов сервиса и доступа

  • добавлен плагин os-proxy-ntlm: NTLM-аутентификация на прокси

  • обновлён перевод на русский язык

Изменения в OPNsense 17.7.7:

  • firewall: GeoIP alias edit UX rework

  • reporting: increase database timeout to 60 seconds

  • firmware: base / kernel lock API

  • firmware: details dialog for plugins

  • firmware: assorted minor UI tweaks

  • dhcp: improve sorting of DHCP leases (contributed by Larry Meaney)

  • ipsec: add rightsourceip = %radius for eap-radius

  • ipsec: moved firewall rule generation to plugin code

  • web proxy: remove default value of visible_hostname

  • mvc: translate navigation tabs (contributed by Alexander Shursha)

  • mvc: prevent faulty child node removal in serializeToConfig()

  • plugins: os-freeradius 1.2.0 adds EAP-TLS support (contributed by Michael Muenz)

  • plugins: os-intrusion-detection-content-snort-vrt 1.0 (contributed by shonjir)

  • plugins: os-telegraf 1.0 for amd64 only (contributed by Michael Muenz)

  • plugins: os-tor 1.1 fixes VIP usage and initial setup

  • ports: curl 7.56.1 [2]

  • ports: openssh 7.6p1 [3]

  • ports: suricata 4.0.1 [4]

1.2.2 (26 октября 2017)

Этот релиз TING основан на OPNsense версии 17.7.6, в который включены фиксы, закрывающие уязвимость KRACK (Key Reinstallation Attacks) в WPA2 в пакетах hostapd и wpa_supplicant. Новое от команды Смарт-Софт:

  • плагин os-sms-portal: плагин к Captive Portal, реализующий SMS-аутентификацию на портале; документация по ссылке [1]

  • плагин os-ndpi: доработан веб-интерфейс, отображение статистики по блокировкам на фаерволе, настройки блокировки на фаерволе, IP-адреса для исключения из правил, блокировка с использованием таблицы IP-адресов, документация по ссылке [2]

  • плагин os-havp снимается с поддержки, его функционал заменяется плагинами os-c-icap и os-clamav, требуется настройка ICAP в web-прокси, дополнительная информация по ссылке [3]

  • плагины os-c-icap и os-clamav для антивирусной проверки web-трафика: вывод в web-интерфейс информации об актуальности баз сигнатур, вывод логов сервисов, усовершенствован механизм запуска служб, вывод имени пользователя в лог ICAP; документация по ссылке [4]

  • исключения в настройках ICAP

  • подсистема логирования: усовершенствована процедура применения фильтра к логу, снято ограничение на максимальный размер информации, получаемой из лога

  • обновлён перевод на русский язык

Изменения в OPNsense 17.7.6:

  • interfaces: mitigate KRACK attacks by using patched hostapd and wpa_supplicant from ports

  • interfaces: added ARP flush to diagnostics page (contributed by Giuseppe De Marco)

  • firmware: opnsense-revert man page examples (contributed by Marco Woitschitzky)

  • firmware: opnsense-update provides locks for the kernel and base sets

  • firmware: opnsense-update provides remote size of kernel and base sets

  • firmware: new mirror in Switzerland via HiHo.ch (contributed by Fabian Abplanalp)

  • firmware: preparations for upcoming page and user-facing feature improvements

  • reporting: traffic mini-graphs switch places with their plain throughput values

  • reporting: return empty file when parameters are missing from insight data export

  • captive portal: improved column header texts in session view

  • ipsec: hide mode selection in phase 1 under IKEv2

  • openvpn: multi-remote support for clients

  • web proxy: allow plugin reload through pluginctl

  • ui: bootgrid tweaks (contributed by Fabian Franz)

  • ui: info command addition to bootgrid (contributed by David Harrigan)

  • rc: pluggable /var MFS support and micromanaging of boot tasks

  • configd: parameter handling rework

  • plugins: os-c-icap 1.3 adds server log view (contributed by Michael Muenz)

  • plugins: os-clamav 1.1 adds version info display and /var MFS support (contributed by Alexander Shursha)

  • plugins: os-freeradius 1.1 (contributed by Michael Muenz)

  • plugins: os-monit 1.4 M/Monit support and fixes (contributed by Frank Brendel)

  • plugins: os-siproxd: 1.0 (contributed by Michael Muenz)

  • plugins: os-web-proxy-sso 2.0 (contributed by Smart-Soft)

  • plugins: os-zerotier 1.3 adds remote network info and local.conf setting (contributed by David Harrigan)

  • ports: curl 7.56.0

  • ports: hostapd 2.6_1

  • ports: phalcon 3.2.3

  • ports: unbound 1.6.7

  • ports: wpa_supplicant 2.6_2

Изменения в OPNsense 17.7.5:

  • system: always return unique list of active DNS servers

  • system: remove obsolete fast forwarding sysctl usage

  • gateways: appropriate use of link local scope gateway targets

  • interfaces: start rtsold in directly send SOLICIT case as well

  • firewall: improve virtual IP VHID edit handling

  • firmware: prevent submit of empty crash reports

  • web proxy: fix ICAP username header usage (contributed by Alexander Shursha)

  • plugins: os-c-icap 1.2 local squid authentication (contributed by Alexander Shursha)

  • plugins: os-collectd 1.1 graphite post and prefix (contributed by Michael Muenz)

  • plugins: os-intrusion-detection-content-et-pro 1.0

  • plugins: os-quagga 1.4.2 OSPF router ID support (contributed by Fabian Franz)

  • ports: dnsmasq 2.78

  • ports: kerberos 1.15.2

  • ports: openvpn 2.4.4

  • ports: perl 5.24.3

  • ports: php 7.0.24

  • ports: python 2.7.14

Изменения в OPNsense 17.7.4:

  • system: remove revoked certificates from list of certificates to revoke

  • firewall: add advanced setting to disable interface gateway rules

  • firewall: ignore gateway weight of zero

  • firewall: add reply-to specific gateway in pluggable rules

  • firewall: support anchor quick keyword in pluggable rules

  • intrusion detection: do not allow interface group in selection

  • openvpn: ns-cert-type becomes remote-cert-tls in client export

  • web proxy: ICAP exclude list (contributed by Alexander Shursha)

  • mvc: support value attribute for model option data

  • installer: UEFI partition size increased to 200 MB

  • installer: always error on password mismatch

  • plugins: os-acme-client 1.11 (contributed by Frank Wall)

  • plugins: os-c-icap 1.1 logging and virus scan settings (contributed by Michael Muenz)

  • plugins: os-tor 1.0 (contributed by Fabian Franz)

  • plugins: os-zerotier 1.2.0 allows local.conf settings (contributed by David Harrigan)

  • ports: libnghttp2 1.26

  • ports: unbound 1.6.6

  • ports: hyperscan 4.5.2

  • ports: py-openssl 17.3.0

  • ports: py-cryptography 2.03

Изменения в OPNsense 17.7.3:

  • interfaces: IPv6 tracking now configures DNS to exclusively use local service or global settings

  • interfaces: fix provider selection for PPP

  • intrusion detection: fix changing the action of rules prefixed with «#alert»

  • ipsec: fix access to the shared key edit page

  • web proxy: adjust default URLs for ICAP (contributed by Fabian Franz)

  • plugins: os-dyndns 1.3 fixes Namecheap updates

  • plugins: os-quagga 1.4.1 adds logging (contributed by Fabian Franz)

  • ports: sudo 1.8.21p2 [22]

1.2.1 (18 сентября 2017)

Этот релиз TING основан на OPNsense версии 17.7.2. Кроме наработок OPNsense в данный релиз включён обновлённый пакет перевода на русский язык.

Изменения в OPNsense 17.7.2:

  • system: make log file views adapt to log format to fix date display

  • system: removed m0n0wall/pfSense config migration code

  • reporting: traffic graph mini-graph additions (contributed by Jeffrey Gentes)

  • firewall: align NAT target port to destination port when creating a new entry

  • firewall: remove spurious filter reload page

  • firewall: wrong double-encode in schedule descriptions

  • firewall: naturally order settings menu

  • firmware: fix ALLOW_RISKY_MAJOR_UPGRADE cron job parameter

  • firmware: add new trusted fingerprint key for upcoming rotation

  • firmware: ABI auto-append on custom flavour entry without multiple directories

  • captive portal: small UX tweaks for dialogs and spacing

  • intrusion detection: selectable home networks as advanced option

  • intrusion detection: missing gzip decode on download

  • unbound: restart on new WAN IP if explicit interface matches

  • web proxy: log name now starts with a module name

  • rc: clear /var/run contents on bootup

  • ui: improved PHP 7.1 compatibility for static pages

  • ui: updated nvd3 to version 1.8.5-dev

  • ui: allow runtime bootgrid translation (contributed by Fabian Franz)

  • plugins: migrate plugin models on install

  • plugins: only restart configd once on reinstall

  • plugins: os-acme-client 1.10 (contributed by Frank Wall)

  • plugins: os-clamav 1.0 (contributed by Michael Muenz)

  • plugins: os-c-icap 1.0 (contributed by Michael Muenz)

  • plugins: os-dyndns fix for Cloudflare proxy status (contributed by sll552)

  • plugins: os-mdns-repeater 1.0 (contributed by Fabian Franz)

  • plugins: os-zerotier 1.1.0 (contributed by David Harrigan)

  • ports: mpd 5.8_2[5]

  • ports: php 7.0.23

  • ports: sudo 1.8.21p1

Изменения в OPNsense 17.7.1:

  • system: add email and comment field to users

  • system: do not set LC_ALL locale

  • firewall: fix floating rules default for quick parameter (contributed by Frank Wall)

  • firewall: support outbound NAT source invert

  • firewall: allow SSH installer anti-lockout on setups with only one interface

  • firewall: add back interface gateway pinning when the protocol is assigned

  • firewall: add optional VHID to support alias IP on CARP

  • firewall: use privilege separation to fetch diagnostic states

  • firmware: revoke 17.1 fingerprint

  • interfaces: better labels for DHCPv6 extended settings (contributed by Fabian Franz)

  • interfaces: fix display of validation error from gateway addition request

  • interfaces: do not write defunct advanced settings

  • interfaces: add ability to lock vital interfaces to prevent reboot network recovery

  • interfaces: split device create and rename ifconfig calls as a single call can be unstable

  • interfaces: probe VLAN hardware settings before changing

  • reporting: better insight database corruption detection and repair

  • captive portal: better login database corruption detection and repair

  • captive portal: fix startup after unclean shutdown

  • dhcp: fix string offset warnings in leases page (contributed by Elias Werberich)

  • intrusion detection: fix startup after config import if no remote files have been downloaded yet

  • ipsec: portable NAT before IPsec support

  • openvpn: fix Tunnelblick link on export page (contributed by Stefan Husch)

  • openvpn: fix connected timestamp and bytes up/down display

  • openvpn: write proxy auth file in shared key export

  • openvpn: minor display tweaks in widget and configuration pages

  • openvpn: local group restriction feature

  • update: rename bootstrap „-V“ argument to „-r“ for consistency

  • update: fix code bug for /etc/make.conf link rewrite on upgrade

  • update: support „-S“ argument to probe remote set size

  • update: support loading kernel debug sets via „-g“ option

  • mvc: add standard dialog helper (contributed by Frank Wall)

  • mvc: simplify language selection code (contributed by Alexander Shursha)

  • mvc: allow to run targeted model migration if requested

  • mvc: ensure backend-cached JSON data is valid

  • lang: small updates to Chinese and German

  • lang: Japanese back at 100% (contributed by Chie and Takeshi Taguchi)

  • plugins: several updates for PHP 7.1 compatibility

  • plugins: os-acme-client 1.9 (contributed by Frank Wall)

  • plugins: os-collectd 1.0 (contributed by Michael Muenz)

  • plugins: os-freeradius 1.0.1 (contributed by Micheal Muenz)

  • plugins: os-dyndns 1.1 removes legacy notification support and adds regfish IPv4 and IPv6 as a provider

  • plugins: os-haproxy 1.17 adds hard stop feature to avoid shutdown stalls (contributed by Frank Wall)

  • plugins: os-rfc2136 1.2 removes legacy notification support

  • plugins: os-zerotier 1.0 (contributed by David Harrigan)

  • src: fix panic in PPPoE session lookup (contributed by Alex Dupre)

  • src: add new USB ID for Sierra LTE modem

  • src: fix VNET kernel panic with asynchronous I/O

  • ports: curl 7.55.1

  • ports: isc-dhcp 4.3.6

  • ports: libressl 2.5.5

  • ports: phalcon 3.2.2

  • ports: php 7.0.22

  • ports: sqlite 3.20.1

  • ports: strongswan 5.6.0

  • ports: suricata 4.0.0

  • ports: unbound 1.6.5

1.2.0 (5 сентября 2017)

Этот релиз TING основан на OPNsense версии 17.7. Команда разработчиков TING произвела следующие доработки функциональности:

  • Добавлены интерактивные консольные инструменты для системного администратора: trafshow и htop. Устанавливаются плагином os-console-tools.

  • Плагин os-useracl: настройка приоритетов срабатывания правил (настраиваемый порядок применения правил).

  • Плагин отчётности на прокси os-squid-log: добавлен тип отчёта «Хронологический», отображающий запросы в том порядке, в каком они поступили, без группировок.

  • Доработан перевод на русский язык.

  • Исправлены обнаруженные ошибки.

Базовая система OPNsense с данным релизом претерпела значительные изменения. Уже более двух с половиной лет OPNsense внедряет инновации в брэндмауэр с открытым исходным кодом путём распределения функционала на отдельные модули, организации простых и надёжных обновлений прошивки, реализации многоязыковой поддержки, поддержки безопасности HardenedBSD, быстрой адаптации обновлений системного программного обеспечения а также чёткого лицензирования по лицензии 2-Clause BSD License.

Данная версия включает в себя такие основные моменты, как SafeStack application hardening, Realtek re драйвер для повышения стабильности работы оборудования, плагин Quagga с поддержкой протокола динамической маршрутизации и пакет Unbound в качестве нового резолвера по-умолчанию. Дополнительно, переводы на чешский, китайский, японский, португальский и немецкий были завершены впервые в течение данного цикла разработки.

Фокус OPNsense сместился на совершенствование и оптимизацию его различных систем и обеспечение непрерывных обновлений, что насчитывает более 300 индивидуальных изменений, внесённых с версии 17.1. Инфраструктура плагинов расширена благодаря разработчикам Frank Wall, Frank Brendel, Fabian Franz и Michael Muenz. И последнее, но важное, проведена большая работа с HardenedBSD.

Ниже представлен полный список наработок OPNsense от версии к версии.

Изменения в OPNsense 17.7:

  • interfaces: dhcp6c can now properly reload without leaking its listening socket to e.g. OpenVPN

  • interfaces: correctly write Host-Uniq string in PPPoE configuration (contributed by Paolo Velati)

  • firmware: fix JavaScript typo in the GUI that would prevent an update with a pending reboot

  • firmware: zap spurious newlines in end-of-life message

  • rc: allow to optionally prevent launch of configd via rc.conf variable

  • rc: print root file system when boot is completed

  • lang: Chinese 91% completed (contributed by Tianmo)

  • lang: Czech 94% completed (contributed by Pavel Borecki)

  • lang: German 100% completed (contributed by Fabian Franz et al)

  • lang: Japanese 92% completed (contributed by Chie and Takeshi Taguchi)

  • lang: Russian 89% completed (contributed by SmartSoft)

  • plugins: os-freeradius 1.0.0 (contributed by Michael Muenz)

  • plugins: os-quagga 1.3.2 (contributed by Fabian Franz and Michael Muenz)

  • src: do not update the LAGG link layer address when destroying a LAGG clone

  • src pull the next header as well to restore filtering on incoming IPsec NAT-T traffic

  • ports: haproxy 1.7.8

  • ports: strongswan 5.5.3

Изменения в OPNsense 17.7.r2:

  • system: harden GUI by removing TLS_RSA_WITH_3DES_EDE_CBC_SHA

  • system: harden GUI by improving Secure Attribute cookie usage

  • system: harden GUI by using DH-4096 parameters

  • system: regenerate Diffie-Hellman parameters

  • system: allow to reverse password / token order in TOTP authentication

  • system: added major GUI firmware upgrade code

  • interfaces: fix WLAN device clone creation

  • interfaces: improve LAGG MTU handling and reconfigure

  • interfaces: Host-Uniq configuration option for PPPoE connections

  • ipsec: IKEv2 can handle multiple phase 1 with the same IP

  • installer: request password change after installation

  • installer: now properly advertises itself as version 17.7

  • rc: batch-run bootup command before starting services

  • openvpn: normalise line endings like web GUI does

  • openvpn: fix config read/write on PHP 7.1

  • mvc: squelch a PHP notice on an undefined element in forms (contributed by Evgeny Bevz)

  • lang: update Chinese, Czech, German, Japanese

  • plugins: enable stable plugins for 17.7

  • plugins: os-dyndns 1.1 fixes menu entry visibility

  • plugins: os-quagga 1.3.2 (contributed by Fabian Franz and Michael Muenz)

  • ports: php 7.0.21

  • ports: perl 5.24.2

  • ports: suricata 3.2.3

  • ports: unbound 1.6.4

Изменения в OPNsense 17.7.r1:

  • system: added swap file option for SSD deployments

  • system: bring back crash reports for all types of kernel crashes

  • system: LDAP server StartTLS connection mode (contributed by Eugen Mayer)

  • system: prevent anonymous binds to AD by rejecting empty passwords

  • console: rewrote the backup restore to fix a possible licensing issue

  • interfaces: instead of renaming new interfaces create them with the target name

  • interfaces: the IP renewal was redesigned to prevent spurious reloads

  • firewall: gateway code refactored

  • firewall: rule generation code refactored

  • dynamic dns: removed from core, installable as plugin

  • rfc 2136: removed from core, installable as plugin

  • ipsec: removed stale BINAT configuration items

  • proxy: hardened the SSL configuration (contributed by Fabian Franz)

  • src: netgraph/pppoe: user-supplied Host-Uniq tag and PADM messages