22.4 Series
The OPNsense business edition successfully transitions to this 22.4 release with a new API-capable VLAN interface including QinQ support, FreeBSD 13 and many other improvements. Please make sure to read the migration notes before upgrading.
Download link is as follows. An installation guide [1] and the checksums for the images can be found below as well.
https://downloads.opnsense.com/
22.4.3 (August 04, 2022)
This business release is based on the OPNsense 22.1.10 community version with additional reliability improvements.
Here are the full patch notes:
system: properly shut down removed interfaces in console port assignment
system: log hard limit results in 9999 entries for grid output
system: move add_user script out of shell scripts
system: disable flag was not removing static route
system: fix RADIUS config validation for port requirement (contributed by Josh Soref)
system: properly cleanse user input in Monit dashboard widget
system: flush all core Python pyc files on updates
system: apply default firewall policy before interface configuration
interfaces: move lo0 interface registration to loopback
interfaces: simplify bridge destroy on deletion
interfaces: add missing scope to link-local GIF host route
interfaces: fix “Allow service binding” for multiple aliases per interface (contributed by Adam Dawidowski)
firewall: ignore age/expire when not provided or empty in sessions page
firewall: internal aliases cannot be disabled
firmware: update repository silently on remote list if needed
intrusion detection: remove dead link to McAfee rule references
ipsec: move vici library from core to ports
unbound: prevent crash of DHCP lease watcher due to unhandled CalledProcessError exception
backend: except configparser read (contributed by agh1467)
mvc: AutoNumberField: set minimum value to 1
mvc: IntegerFieldType: fix for negative numbers (contributed by xbb)
mvc: fix two regressions in BaseField for Phalcon 5
mvc: fix rowCount when all is selected in searchRecordsetBase()
plugins: os-ddclient 1.8 [1]
plugins: os-firewall 1.2 fixes internal backup restore
plugins: os-postfix 1.23 [2]
plugins: os-stunnel 1.0.5 adds intermediates to server chain (contributed by Johnny S. Lee)
plugins: os-telegraf 1.12.5 [3]
ports: nss 3.80 [4]
ports: py-vici 5.9.3
ports: python 3.9.13 [5]
ports: sudo 1.9.11p3 [6]
ports: syslog-ng 3.37.1 [7]
ports: unbound 1.16.2 [8]
A hotfix release was issued as 22.4.3_1:
interfaces: fix get_interface_mac() not returning a cached MAC address
A hotfix release was issued as 22.4.3_2:
firmware: added 22.10 series fingerprint
22.4.2 (July 07, 2022)
This business release is based on the OPNsense 22.1.9 community version with additional reliability improvements.
Here are the full patch notes:
system: support plugin device reconfiguration in pluginctl utility
system: use password_verify() in authenticators (contributed by oittaa)
system: hide password from command line during config encryption
system: improve gateway subnet validation to fix IPv6 edge cases
system: dpinger support for IPv6 aliases
system: support 1500000 baudrate selection for ARM
system: non-functional cleanups for upcoming move to PHP 8
system: fix firmware command shortcut in opnsense-shell utility
system: if no temperature sysctls are exposed do nothing
interfaces: add unique constraint for tag+if on VLANs
firewall: bring back missing toggle button in aliases
firewall: exclude internal aliases on import
firewall: fix alias removal
firewall: various usability and visibility improvements for aliases
firewall: performance improvement for large numbers of port type aliases
firewall: simplify sort and add natural sorting in alias diagnostics
captive portal: add extendedPreAuthData for MAC address retrieval during authentication
captive portal: add missing validation message for empty interface selection
dhcp: refactor IPv4 lease removal and purge static leases before starting service
dhcp: revert back to not adding an IP to static lease creation from leases page
dhcp: allow custom configuration from directories
firmware: add python version to crash report header
opendns: update OpenDNS IPv6 servers (contributed by Johan Rylander)
openvpn: add domain search option to servers and overrides
unbound: add custom “destination address” as advanced option for blocklists
unbound: disabling the first DNS override entry invalidates config
unbound: make blocklist additions/removals dynamic to prevent a restart
unbound: zero_ttl is no longer a valid statistic (contributed by David Mora)
mvc: distinct between HTTP errors 401 and 403 during authentication
mvc: call microtime(true) only once during config save (contributed by csbyte)
plugins: os-acme-client 3.11 [1]
plugins: os-ddclient 1.7 [2]
plugins: os-debug 1.5 fixes deprecated xdebug syntax
plugins: os-frr 1.29 [3]
plugins: os-nginx 1.28 [4]
plugins: os-postfix 1.22 [5]
plugins: os-wireguard 1.11 [6]
src: pf: fix memory leaks in nvlist usage
src: pf: stop resolving hosts as dns that use “:” modifier
src: e1000: Increase rx_buffer_size to 32b
src: igc: Increase rx_buffer_size local variable to 32b
src: assorted non-functional cleanups and typo corrections
ports: curl 7.84.0 [7]
ports: krb5 1.20 [8]
ports: lighttpd 1.4.65 [9]
ports: nss 3.79 [10]
ports: openssl 1.1.1q [11]
ports: openvpn 2.5.7 [12]
ports: php 7.4.30 [13]
ports: py-certifi 2022.5.18.1
ports: sqlite 3.38.5 [14]
ports: strongswan 5.9.6 [15]
ports: sudo 1.9.11p2 [16]
ports: unbound 1.16.0 [17]
22.4.1 (June 07, 2022)
This business release is based on the OPNsense 22.1.7 community version with additional reliability improvements.
Here are the full patch notes:
system: set up all DNS system routes from system_resolvconf_generate()
system: tunables without hierarchy are just “environment” variables
system: use PHP random_bytes() builtin (contributed by oittaa)
system: support cd9660 file system in opnsense-importer
system: prevent gateway monitoring from entering a “filter reload” loop
system: only restore missing or zero size ACL files
reporting: add ACPI and ARM temperature support to health data
reporting: do not rely on /var/run/booting test in system health backend code
reporting: fix validation in NetFlow settings
interfaces: interface_ppps_configure() remove boot-time side effect
interfaces: DHCPv6 advanced has a different flag to disable NA
interfaces: add technical interface ID display to assignments page
firewall: make rule parsing more consistent as x:any and any:y are valid port options
captive portal: simplify the voucher generation code (contributed by oittaa)
dhcp: support supplying iPXE filename
firmware: exclude revision matching from latest changelog version check
firmware: list locked packages in health audit
firmware: bypass cache with timestamp in “upgradestatus” call (contributed by gibwar)
firmware: lowercase search in plugins/packages
intrusion detection: fix log file ACL mismatch
ipsec: squelch spurious errors on stderr for backend status action
ipsec: mark non-sortable columns
openvpn: change filetype of export to text/ovpn
unbound: add custom forwarding and overrides MVC pages
unbound: add missing alias description
unbound: change overrides grid label when no results are returned
unbound: domain override IP may contain port information
unbound: fix ACL for overrides
unbound: fix handling of wildcard aliases (contributed by devin122)
unbound: fix overrides case sort order (contributed by NYOB)
unbound: properly support “_msdcs” domain override prefix
unbound: restore duplicate domain behaviour in overrides
unbound: show combined hostname.domain description in new alias popup
unbound: updated no coin list (contributed by Luis Nachtigall)
unbound: disabling the first DNS override entry invalides config
mvc: Phalcon 5 migration layer to reduce dependencies on Phalcon builtins
mvc: add generic searchRecordsetBase() to match existing searchBase()
mvc: safeguard multi_sort in searchRecordsetBase()
mvc: fix two regressions and deprecate __items
plugins: os-OPNBEcore 1.0.2 cleans up LDAP sync task
plugins: os-OPNProxy 1.0.2 fixes newline issue in template
plugins: os-OPNcentral 1.5 [1]
plugins: os-acme-client 3.10 [2]
plugins: os-bind 1.23 [3]
plugins: os-chrony 1.5 [4]
plugins: os-ddclient 1.5 [5]
plugins: os-dnscrypt-proxy 1.12 [6]
plugins: os-frr 1.28 [7]
plugins: os-relayd 2.7 adds listen address and port range to virtual servers
plugins: os-zabbix-agent 1.12 [8]
plugins: os-zabbix-proxy 1.8 [9]
src: tcp: rewind erroneous RTO only while performing RTO retransmissions
src: bnxt: Allow bnxt interfaces to use VLANs
src: rc: use _pidcmd to determine pid for protect
ports: curl 7.83.1 [10]
ports: expat 2.4.8 [11]
ports: libxml 2.9.13 [12]
ports: monit 5.32.0 [13]
ports: nss 3.78 [14]
ports: pcre2 10.40 [15]
ports: php 7.4.29 [16]
ports: phpseclib 2.0.37 [17]
ports: pkg 1.17.5 [18]
ports: python 3.8.13 [19]
ports: suricata 6.0.5 [20]
22.4 (April 26, 2022)
The OPNsense business edition successfully transitions to this 22.4 release with a new API-capable VLAN interface including QinQ support, FreeBSD 13 and many other improvements. Please make sure to read the migration notes before upgrading.
Download link is as follows. An installation guide [1] and the checksums for the images can be found below as well.
https://downloads.opnsense.com/
This business release is based on the OPNsense 22.1.4 community version with additional reliability improvements.
Here are the full patch notes:
system: improved visibility and flexibility of tunables
system: move multiple sysctl manipulations to tunables framework to allow overriding them
system: prevent more than one default route by default
system: sync recovery utility contents with FreeBSD 13
system: add severity to syslog output and allow to filter for it
system: create latest.log links for easier log consumption
system: added opnsense-log utility to inspect logs on the console
system: removed circular logging support
system: background all cron backend command invokes
system: unified cron start between legacy and MVC components
system: improve the fallback after failing to look up specific IPv4 address match for dpinger
system: use correct IPv6 interface for dpinger gateway monitoring when using 6RD
system: default net.inet6.ip6.intr_queue_maxlen to 1000 like its IPv4 counterpart
system: default net.inet6.ip6.redirect to off like its IPv4 counterpart
system: fix potential issues with “search” syntax in resolv.conf
system: fix general settings PHP warnings that only appear when validation fails
system: allow additional search domain (Pierre Fevre)
system: make /var MFS work when /var directories are mount points, e.g. on ZFS
system: optionally disconnect PPP interfaces when going into CARP backup mode
system: fix new PPP CARP hook function call (contributed by Markus Reiter)
system: separate core and thread count in information widget
system: MSDOS file system awareness in information widget for new /boot/efi partition
system: no longer display duplicated mounted partitions on the dashboard
system: refactor GUI rebind protection and remove its os-dyndns/os-rfc2136 references
system: allow to configure SSH setting PubkeyAcceptedAlgorithms (contributed by Manuel Faux)
system: add backward compatibility for reading logs without severity by default (contributed by kulikov-a)
system: fix typo causing PHP warning on IPv6 login (contributed by ppascher)
system: add a sysctl cache to improve tuneable overview load time
system: replace obsolete find_interface_network*() use in GUI
system: allow severity levels in PHP log messages and mark authentication success messages as notice
system: Intel QuickAssist Technology (QAT) crypto module selection and support multiple selection
system: AESNI crypto module is a kernel-builtin since 22.1 and no longer needs to be selected to work
system: enable library support of PCRE JIT included since 22.1.1
system: limit rowCount in log viewer (contributed by kulikov-a)
system: unify system tunables handling and tweak UX of the respective GUI page
system: no longer default to hw.uart.console use in factory configuration
system: remove console mute use from boot sequence
system: fix return code on factory port assignment to prevent configuration loop
system: remove “all” group handling code forgotten in 2015
system: prefer configured IP address family use earlier on boot
system: allow boot to perform generic UFS/ZFS grow using the /.probe.for.growfs marker file
system: import ZFS pools before mounting ZFS datasets
system: added the correct content-type for the dashboard plugins feed (contributed by Bo Frederiksen)
system: obsolete plugins calling missing functions shall not produce fatal errors
system: properly clear legacy files when clearing log files
reporting: fill missing insight data with zeros
reporting: use asynchronous DNS resolver for reverse lookups on traffic page
interfaces: LAGG support in console port assignment (contributed by sarthurdev)
interfaces: improve LAGG/VLAN assignments via console option
interfaces: repair get_interface_list() for console use
interfaces: aligned the name and use of special /tmp files for internal interface handling
interfaces: correctly write nameserverv6 and searchdomainv6 information on dhcp6c lease acquire
interfaces: make cache IP files exclusive to rc.newwan and rc.newwanv6 scripts to avoid missing IP changes
interfaces: refactored linkup event handler to avoid unnecessary recursion in the code
interfaces: removed opportunistic functions find_interface_ip(), find_interface_ipv6() and find_interface_ipv6_ll()
interfaces: get_interface_ip() and get_interface_ipv6() now return a valid IP address if one was given to support VIP aliases
interfaces: interfaces_addresses() can now map a configuration interface to returned addresses to track its origin
interfaces: VIPs now support the “no bind” option to exclude them from automatic service use when configured
interfaces: interfaces_primary_address() is now being used like its IPv6 equivalent throughout the code
interfaces: interfaces_primary_address6() is now considering addresses from tracking interfaces when needed
interfaces: interfaces_scoped_address6() is now being used throughout the code
interfaces: “tentative” state now leads to the address being ignored during configuration like “deprecated”
interfaces: removed unmaintained 3G statistics gathering for Huawei modems that could lock up other modems
interfaces: reworked interface creation on boot up
interfaces: spoof MAC now only applies to actual interface and not all of its VLAN siblings or parent
interfaces: added permanent promiscuous mode setting
interfaces: add the interface description via ifconfig to its respective device
interfaces: stop special treatment of bridge interfaces on linkup
interfaces: improve validations and fix defaults for bridges
interfaces: allow bridges to attach to VXLAN on boot
interfaces: background all interface reconfiguration script hooks
interfaces: no longer allow and apply media configuration for non-parent devices
interfaces: removed restriction from interfaces without configuration to not being able to hold VIPs
interfaces: remove defunct link support for GRE
interfaces: align GIF configuration with base system options
interfaces: fix default handling for VIP nobind option
interfaces: allow VIP nobind feature on CARP addresses
interfaces: stop mpd5 daemon before starting
interfaces: always show interface in GIF and GRE overview even on VIP use
interfaces: fix GIF and GRE VIP use loading order in IP alias cases
interfaces: remove device creation side effect from bridge, LAGG, GIF, GRE and VLAN GUI pages
interfaces: replace obsolete find_interface_network*() use in GUI
interfaces: assignments should take OpenVPN into account
interfaces: only ever store nobind for ipalias/carp
interfaces: align IPv4 address statistics read with IPv6
interfaces: simplify device destroy code
interfaces: no longer use legacy_get_interface_addresses() in MAC address read
interfaces: remove unused opportunistic interface address functions
interfaces: resolve device/interface interdependency on boot
interfaces: do not update VIPs on dynamic address changes
interfaces: remove unused reference and return value from interface_carp_configure()
interfaces: remove unused reference from interface_ipalias_configure()
interfaces: stop IPv6 from reacting to simple stop/detach/down events via rc.linkup
interfaces: introduce ifctl helper for future use
interfaces: loopback “lo0” exists for VIPs
interfaces: only strip addresses on configured IP types
interfaces: use new ifctl utility for DHCPv6 IP type and add manual page
interfaces: adjust MTU configuration when parent also requires MTU changes
interfaces: VLAN MVC conversion with API and QinQ support
interfaces: cleanup surrounding LAGG function use
interfaces: bring back strict reordering of VIPs during dynamic address acquire
interfaces: hint at missing apply when trying to add a new interface in assignment page
interfaces: VLAN UX changes include better tag and parent visibility and handling
interfaces: improve VLAN parent selection for batch changes to allow for a single apply
interfaces: do not assume exclusive use of router file in IPv6 PPPoE case
interfaces: for symmetry with PPPoE do not reload WAN when address disappears
firewall: properly kill all connections from and to a WAN IPv4 on an address change
firewall: display interface descriptions on normalisation rules (contributed by vnxme)
firewall: dynamic IPv6 host alias support (contributed by Team Rebellion)
firewall: removed obsolete kill states option on gateway failure
firewall: plain log default logging severity selection is now “informational”
firewall: improve maximum shaper value validation and add Gbit/s support
firewall: remove ruleset optimization support which did not work since rule labels are mandatory for live log
firewall: encode rules names in aliases (contributed by kulikov-a)
firewall: check state before selecting categories (contributed by kulikov-a)
firewall: synchronise “disabled” flag on linked firewall rule of port forward
firewall: local file corruption might prevent alias to be loaded
firewall: default pass all loopback without state tracking
firewall: exclude localhost stateless traffic from default logging (contributed by kulikov-a)
firewall: using port type aliases the “enable” flag was ignored when not enabled
firewall: add support for SYN cookies
firewall: allow per-rule adaptive timeouts (contributed by kulikov-a)
firewall: constrain default CARP allow rules to those defined in RFC 5798
firewall: make sure that rule use of gateways (route-to) and reply-to are mutually exclusive
firewall: tighten alias FQDN validation to avoid accepting mistypes such as “192.168.01.1”
firewall: add missing range validation to alias host type
firewall: fix sessions page ACL
firewall: adjust default deny label to include mention of possible state violation
captive portal: prevent cleansing password field
dhcp: allow for ARM architectures in network boot options (contributed by Keith Cirkel)
dhcp: allow router advertisements to use a specific link-local VIP alias
dhcp: avoid use of find_interface_network() et al
dhcp: change prefix watcher to work without circular logging now that it is gone
dhcp: fix implode() call (contributed by Clement Moulin)
dhcp: refactor the IPv4 and IPv6 configuration pages and add minimal subnet size requirement hints
dhcp: replace obsolete find_interface_network*() use in GUI
dhcp: rework router advertisement “static” mode flags to separate advanced options
dhcp: stream-read log and leases files for “dhcpd update prefixes” action
dhcp: added reload action for cron use
dhcp: give a hint on why an interface was ignored in radvd
dnsmasq: fix all-server overwriting strict-order configuration directive (contributed by Christian Tramnitz)
dnsmasq: no-hosts option (contributed by agh1467)
firmware: add URL return feature to changelog script
firmware: add a “status_reboot” variable to API return data to make clear it belongs to the offered minor update or major upgrade
firmware: add random delays to existing firmware cron jobs to avoid update server load spikes
firmware: added an automatic cron job to fetch changelog daily to use it as a lightweight check for updates on the dashboard
firmware: check repository and plugin state in health audit
firmware: implement cross-ABI reinstall of all packages for future use
firmware: improve the connectivity audit
firmware: independently check for available upgrade sets
firmware: opnsense-code: support “-z” snapshot mode
firmware: opnsense-revert: support “-z” snapshot mode
firmware: opnsense-update: exclude /boot/efi permission reset from base set extract
firmware: opnsense-update: support version print for sets
firmware: opnsense-version: support reading lock files operated by opnsense-update
firmware: patch version / date header in consistently for backend scripts
firmware: removed obsolete business repository fingerprints and added 22.4 fingerprint
firmware: return product info for status endpoint even when no firmware check was done
firmware: revoke the 21.10 fingerprint
firmware: separate the “needs_reboot” and “upgrade_needs_reboot” check flags
firmware: use opnsense-update for version info in update checks
firmware: use isolated directory for database update check
firmware: cross-version check was not using correct information
firmware: cross-version update should indicate base/kernel reinstall
firmware: exclude revision to match release during hotfixes
installer: add EFI partition as a default mount point
installer: fix installation of rc.conf keymap setting selected earlier during installation
installer: improve disk and ZFS pool scan and display
installer: increase EFI partition size to 260 MB
intrusion detection: improve row count on alerts page
ipsec: avoid use of find_interface_network() et al
ipsec: clean up stale CA certificates on reconfigure
ipsec: fix mobile property passing when creating a new phase 2 entry
ipsec: fix mobile switch logic
ipsec: migrated tunnel settings page to MVC
ipsec: pass protocol when resolving via ipsec_resolve() (contributed by FloMeyer)
ipsec: remove hashes and algorithms no longer supported by FreeBSD 13
ipsec: rename “My Certificate Authority” to “Remote Certificate Authority” to avoid ambiguity
ipsec: replace obsolete find_interface_network*() use in GUI
ipsec: update security of default settings when creating new phase 1 and 2
lang: demote Italian to development-only language due to lowered translation ratio
monit: move logging to own target
network time: add “iburst” option and stop using it by default (contributed by Patrick M. Hausen)
network time: detach “limited” from “kod” option (contributed by Zsolt Zsiros)
openvpn: avoid use of find_interface_network() et al
openvpn: improve gateway detection in topology mode
openvpn: kill by common name when kill by address does not work
openvpn: stop removing name server-related files never written
unbound: disable do-not-query-localhost on local address server use
unbound: update DNS with hostname-only static entries (contributed by Gareth Owen)
update: opnsense-bootstrap: -z snapshot mode
update: opnsense-bootstrap: improved type detection
update: opnsense-code: -r for repository removal
update: opnsense-fetch: emit error message of failed download
update: opnsense-update: handle kernel debug directory like /boot/kernel
update: opnsense-update: removed “firmware-upgrade” file support
update: opnsense-verify: synced shared code with FreeBSD 13
web proxy: fix a typo in extended logging parser (contributed by kulikov-a)
backend: consolidate configctl utility into one location and add manual page
backend: unify use of configctl utility
console: move console mute calls into port setting function
images: removed deprecated os-dyndns plugin from default installation
mvc: add BlankDesc to ModelRelationField (contributed by agh1467)
mvc: add hint support for text fields (contributed by agh1467)
mvc: emulation versioning empty nodes for the legacy configuration sections
mvc: fix logging of configd errors
mvc: overload __isset() magic method
mvc: properly root the model mount point to avoid unrelated XML node name overlap
mvc: refactor and extend HostnameField to add options to validate partial hostnames and root zones
ui: add support for terabytes, and petabytes to format_bytes() (contributed by agh1467)
ui: move storing jQuery Bootgrid settings in browser from core to bootgrid (contributed by Manuel Faux)
ui: sidebar 2nd submenu view fix (contributed by Team Rebellion)
ui: universal striping adjustment for MVC components (contributed by kulikov-a)
ui: omit total entries display for log grids
plugins: os-OPNProxy 1.0.1 [2]
plugins: os-bind 1.22 [3]
plugins: os-ddclient 1.4 [4] as an eventual replacement for os-dyndns
plugins: os-dnscrypt-proxy 1.11 [5]
plugins: os-dyndns adds local copy of get_dyndns_ip()
plugins: os-dyndns menu compatibility with os-ddclient
plugins: os-freeradius 1.9.19 [6]
plugins: os-frr 1.27 [7]
plugins: os-haproxy 3.10 [8]
plugins: os-mdns-repeater 1.1 [9]
plugins: os-nginx 1.26 [10]
plugins: os-rfc2136 adds local copy of get_dyndns_ip()
plugins: os-rspamd 1.12 [11]
plugins: os-stunnel 1.0.4 fix connect format for IPv6 (contributed by Johnny S. Lee)
plugins: os-theme-cicada 1.29
plugins: os-theme-vicuna 1.41
plugins: os-wol adds cron support for wake action (contributed by digitalshow)
plugins: os-zabbix-agent 1.11 [12]
plugins: os-zabbix-proxy 1.7 [13]
src: FreeBSD 13-STABLE as of 4ee9fbcd853
src: migrated to LUA boot loader (contributed by Kyle Evans)
src: revert upstream permission change for /root directory
src: fix kernel build creating wrong linkers.hint file
src: carp: fix send error demotion recovery
src: reworked shared forwarding
src: pf: set_prio was not set after nvlist conversion
src: if_vtnet: Restore the ability to set promisc mode
src: hn: disable Hyper-V vSwitch RSC support
src: stand: add EFI support for MMIO serial consoles
src: apei: make sure event data fit into the buffer
src: openssl: fix a bug in BN_mod_sqrt() that can cause it to loop forever [14]
src: zfs: fix handling of errors from dmu_write_uio_dbuf() [15]
src: debugnet: remove spurious message on boot
src: pf(4) tables may fail to load [16]
src: potential jail escape vulnerabilities in netmap [17]
src: bhyve e82545 device emulation out-of-bounds write [18]
src: mpr/mps/mpt driver ioctl heap out-of-bounds write [19]
src: 802.11 heap buffer overflow [20]
src: zlib compression out-of-bounds write [21]
ports: ca_root_nss fix for faulty upstream file linking
ports: curl 7.81.0 [22]
ports: dnspython 2.2.1 [23]
ports: dpinger 3.2 [24]
ports: expat 2.4.7 [25]
ports: krb5 1.19.3 [26]
ports: lighttpd 1.4.64 [27]
ports: monit 5.30.0 [28]
ports: nss 3.76 [29]
ports: openssh 8.9p1 [30]
ports: openssl 1.1.1n [31]
ports: openvpn 2.5.6 [32]
ports: pcre / pcre2 enable JIT support
ports: pecl-psr 1.2.0 [33]
ports: phalcon 4.1.3 [34]
ports: php 7.4.28 [35]
ports: phpseclib 2.0.36 [36]
ports: pkg fixes validation failures on HTTPS fetch in static binary [37]
ports: sudo 1.9.10 [38]
ports: syslog-ng 3.36.1 [39]
ports: unbound 1.15.0 [40]
A hotfix release was issued as 22.4_2:
interfaces: include VIPS for primary IPv4 detection
mvc: prevent silent crashes in legacy XML attribute emulation
ports: curl 7.83.0 [41]
ports: openssl 1.1.1o [42]
Known issues and limitations:
This release contains a new major operating system version and should be carried out with the necessary care. Despite extended test coverage changes made by FreeBSD may still affect operation without our knowledge. Except for ZFS boot environments rollbacks between major operating system versions are extremely fragile and a reinstall of an older version should be attempted in the worst case. For more information please consult the FreeBSD 13.0 release notes [43] .
IPsec hash and cipher removals in FreeBSD 13 can affect existing setups as insecure cryptographic options have been removed upstream. If you are using MD5, Blowfish, DES, 3DES, or CAST128 in your phase 2 please move to more secure settings prior to the upgrade. Note that phase 1 settings are unaffected, but insecure settings should still be avoided. For more information see the FreeBSD commit in question [44] .
The Realtek vendor driver is no longer bundled with the updated FreeBSD kernel. If unsure whether FreeBSD 13 supports your Realtek NIC please install the os-realtek-re plugin prior to upgrading to retain operability of your NICs.
MAC spoofing now only pertains to the configured interface and not the VLAN siblings or parent interface. This can introduce unwanted configuration due to previous side effects in the code. Make sure to assign and set the spoofed MAC for all interfaces that require a spoofed MAC or simply spoof the MAC on the parent and leave the VLAN sibling settings empty to let them follow the parent MAC automatically. If in doubt the parent interface can be set into promiscuous mode now to allow for mixed MAC address use across VLANs too.
Media and hardware offload settings are no longer shown for non-parent interfaces and need to be set individually on the parent interface to take effect. This can introduce unwanted configuration due to previous side effects in the code. If the parent interface was not previously assigned please assign it to reapply the required settings.
NTPD defaults changed to exclude the “iburst” option by default. “limited” setting was detached from “kod” option. In both cases configuration adjustments can achieve previous behaviour if required.
Rebind checks through os-dyndns or os-rfc2136 will no longer work due to the deprecation of both plugins. Please add your rebind hosts manually or disable rebind protection prior to the upgrade.
GRE link1 support has been removed and needs a static route to function now.
Circular logging support has been removed. No user interaction is required.
The public key for the 22.4 series is:
# -----BEGIN PUBLIC KEY-----
# MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA1o1Bk31AcX5xsqgVAoWQ
# 1fTDznz22ojsK+qCkhW7MKSWlCyEZYEueUtq7hOt/gqttc3qT0WgHjhjI/WE2RQ4
# 53yfSw/2DDdt3v2WRoupaMzu2Px6I0A+dzo/DM0UWHHsjUaa1HnTvrC14W2vy9wY
# rdotDpp6vSA3WoBmpz+6cpAOlOMTboJouaZy2gSAAcFUmnmP6KDE+lQEqudENTpr
# wb/tIILTE3s6HMBrnmyTNz3Oyy77qH0Xq4mU0r+GS3If0LN+zIr3evt/hhS80otG
# 4WA2ifFeoZVUC//ArAqRiuOJKWvDe5455W1tOuoLkVKVwWMUd1YjaLq8/SRNtTVT
# jRWO6znUHJa7LKtwY7SJvJ8bl8kR8QnrEBRLqT3IA+FcRH+8RaeCivPV7oS1tMiV
# 7hUmu4yXkiMU9c/RrUj7UGZfPKa6K1yP2p3pRvHwCpMclhlVdaiAGNQ8X1GmUAmg
# 3hsoay1ximpj0Yzs+ynDdT1WPkjx8+mDWI08qTuVX+KN3xiohzjxUyD6kBbw2N4z
# EkKTu36KLxo+Hs2iHh4iPWV+EZ5pBn/BseUeHha+V76xM/fPU3H2htwF6/lAz3KH
# J6cevsMenCaYBAqpUsQMBjxhDgMmpCcjiZRPijFpe5zsNSUD1NJ8QMpecBZCE6Vt
# YHWiWxZTN13z4mPqA4uebakCAwEAAQ==
# -----END PUBLIC KEY-----
# SHA256 (OPNsense-business-22.4-OpenSSL-dvd-amd64.iso.bz2) = df1ccf00677249fcbe237244016cf5cd9e1a9c0cf998cfa45a579f51e0e97844
# SHA256 (OPNsense-business-22.4-OpenSSL-nano-amd64.img.bz2) = 1e9532ff8efcb1c89b9c71f4a3ccf59233078eab64fbfcd06ba2838b5c1e9484
# SHA256 (OPNsense-business-22.4-OpenSSL-serial-amd64.img.bz2) = dd4506d3c8a0ad7153153f862cfc88d6503554b1575fb7c4866036bcebde3a33
# SHA256 (OPNsense-business-22.4-OpenSSL-vga-amd64.img.bz2) = 88065b0e7fa514867df8e4438626f25c7278b75af91842242aacf4c9ece21531