changelog
changelog copied to clipboard
Security router changelog
The securityrouter.org project is a network operating system and software distribution based on OpenBSD which is developed and maintained by Halon Security. New systems are deployed by downloading a software image. The easiest way to update existing systems is to perform an automatic update from within the product's administration.
New major versions can contain configuration syntax changes which might render a previously working configuration invalid, and thus affect the operation of the system after an update. We therefore urge all users to perform such updates with caution; take a snapshot if running it as a virtual machine, or at least backup the plain-text configuration and monitor the update on the screen/console, so that you can perform recovery or roll back to an older software version, if necessary.
If you need to rollback you can choose version for your serial number.
There is an RSS feed available.
6.6-p1
Unreleased
BugFix regression since 6.6 with multiple VLAN interfaces
6.6
Release on 2019-12-16
NewBased on OpenBSD 6.6- New
bpeIEEE 802.1Q (PBB) interface - Support for Intel Ethernet 700 series via
ixl - Support for Mellanox ConnectX-4/5/6 via
mcx - The
relaydload balancer supports SNI and binary checks - Multiprocessor (SMP) improvements
- New
ImpCompiled with Clang 8.0.1ImpWeb administration now uses PHP 7.3DepOpenBSD 6.6 has disabledmobileipin the generic kernel
6.4
Released on 2019-01-07
NewBased on OpenBSD 6.4ImpSupport for new LACP optionsmode passiveandtimeout fastImpCompiled with Clang 6.0.0ImpAdded new Diffie–Hellman (DH) to IKE IPsec pageDepThe default BGP filter action was changed from allow to deny
6.3-p1
Released on 2018-08-23
BugApplied 6.3 errata up to #018
6.3
Released on 2018-07-04
NewBased on OpenBSD 6.3- Improved network performance thanks to less locking
- New
syncookiesoption in firewall - Support for Intel Cannon Lake and Ice Lake integrated Ethernet
- New
efidriver for EFI runtime services - Mitigation for Meltdown vulnerability for Intel CPUs
ImpCompiled with Clang 5.0.1ImpSupport forsyspatchandfw_updateImpReordering firewall rules in web administrationBugFix bug wheredhcp6-*didn't log properlyBugFix bug in web administration with DHCP reserved hostsBugFix regression since 6.2 where some driver firmware wasn't loaded
6.2
Released on 2018-03-28
NewBased on OpenBSD 6.2- OpenBSD is compiled with Clang 4.0.0
- Support for Hyper-V StorVSC
- Improved network performance thanks to less locking
- Uses new
slaacddaemon for IPv6 autoconfiguration
ImpAbility to run multiplebgpin different routing domainsImpSupport runningdhcp-serveron multiple interfaces in different routing domainsImpSupportdhcp6-clientonpppoeinterfacesImpSupport routing domains ondhcp6-clientanddhcp6-serverImpSupportpppoeinterfaces onvlaninterfacesBugFix bug wherepppoeinterface's 0.0.0.2 route would always be in routing table 0BugFix regression since 3.6 where router solicitation always enabled IA-NABugFix regression since 6.1 wheredhcpdwould log tostderrinstead of syslog
6.1-p1
Released on 2017-09-30
BugFixed regressions withvlanandtrunkinterface configurationBugApplied 6.1 errata up to #029
6.1
Released on 2017-06-22
NewBased on OpenBSD 6.1BugApplied 6.1 errata up to #012
6.0-p2
Released on 2017-04-15
ImpMore options in software updateBugFixed subscription license issue with VPN reloadBugDon't start NTP in cluster domain unless it existsBugFixed regressions in the new Bootstrap interface (IPsec, DHCP, and more)BugApplied 6.0 errata up to #014
6.0-p1
Released on 2016-10-13
ImpSimplified provisioning, such as initialising a storage disk non-interactivelyBugApplied 6.0 errata up to #011
6.0
Released on 2016-09-20
NewBased on OpenBSD 6.0- SMP improvements in AES-NI and network stack
- MSI-X on VirtIO
- W^X is strictly enforced
- Support for new hardware, including NVMe and GPIO controllers
NewMobile-friendly web administration based on Bootstrap
3.7-p1
Released on 2016-05-31
BugFixed regression since 3.7 (pledge-related) where some programs aborted because ofTZpathBugApplied 5.9 errata up to #009, including CVE-2016-2105 to 9
3.7
Released on 2016-04-25
NewBased on OpenBSD 5.9- SMP network stack improvements
- Xen paravirtualizion support
- Initial IEEE 802.11n wireless support
- New
etheripEthernet tunneling (RFC 3378) interface - New
pairEthernet encapsulation interface - New EIGRP routing daemon
- IPv6 support for pflow (NetFlow) transport
- IKEv2 interoperability with OS X El Capitan
- Support for new hardware, including network adapters from Intel and Realtek
ImpAbility to enable/disable clustering (sasyncd) without restarting IKE daemonsBugPrevent SIGPIPE when doing cleartext IKE packet capture inisakmpdDepMovedikev2to separateike {context for more accurate validation
3.6
Released on 2015-11-20
NewBased on OpenBSD 5.8- New MPLS pseudowire driver
mpw - Many improvements to BGP, OSPF and LDP (MPLS)
- The same network range can now be assigned to multiple interfaces
- MTU of VLAN devices can now be set independently from the parent interface's MTU
- Jumbo frames on PC Engines' APU and Halon's HSR-603
- Support for the NX bit on i386 for better W^X enforcement
- Support for new hardware, and improved network drivers
- New MPLS pseudowire driver
NewVPLS (layer 2) MPLS supportNewInterface route priorityImpUsesAUTOCONF6for router solicitation instead ofrtsoldDepThe default Diffie-Hellman group from IKEv1 has been changed to modp3072 (15)
3.5-r1
Released on 2015-07-30
NewFirewall (pf.conf) editor got support for new syntax such as prio, queue, etcNewNew "basic" (non-JavaScript) firewall editor which is much faster when working with large rulesetsBugRegressions (since 3.5) in the first-run config disk population andpkg_*settings resolved
3.5
Released on 2015-05-27
NewBased on OpenBSD 5.7 with many improvements, such asImpThe firewall page loads faster with many rulesImpAutomatic firewall rule sorting has been replaced by a "Sort" buttonBugMake clusterd and configure UTF-8 aware, to prevent corruption of non-ASCIIBugEmpty persistent tables were overwritten by the firewall pageBugFix issue on web admin's IPsec page with quoted strings containing syntax tokensDepThe load balancer has renamed the "ssl" keyword to "tls"DepThe load balancer is TLSv1.2 only by default, you need to manually enable other protocols
3.4-r1
Released on 2015-03-19
NewAdded support for LLDPNewAdded support for vether interfacesSecPatched OpenSSL in regards to security advisory as of 19 mar 2015BugBug on load balancing page with "pftag"BugRegression in the HTTPS SOAP API (since 3.4)Depgmt0 was renamed to utc in SOAP API
3.4-p1
Released on 2015-01-12
ImpBackup (cluster) nodes can use NTP (ntpd) even without working egress IP, via cluster portBugWeb admin server regression; now uses nginx
3.4
Released on 2014-12-11
NewBased on OpenBSD 5.6- Includes the Unbound DNS cache
- Reverse proxy (
match ... forward to) support in the load balancer - Support for new hardware, including network adapters from Broadcom and Realtek
ImpAdd SIP proxy to interface pageImpSupport searching logs larger than 2 GBBugFixes regression on load balancer status pageBugFixes issue when loading/reloading isakmpdBugFixes issue with dhinfodBugFixes issue with router advertisement and DHCPv6 with some clients
3.3-p2
Released on 2014-08-11
BugRe-configure IKE daemon (isakmpd) if it crashes and is restarted by the watchdogBugMitigate a threading issue, to prevent rare dead-locks during startup and reconfiguring
3.3-p1
Released on 2014-06-09
SecFix OpenSSL CVE-2014-0195, 2014-0221, 2014-0224 and 2014-3470ImpRemoved deprecated browser-specific CSS3 options (Mozilla, Opera)ImpEnable auto-scroll on keypress in web terminalBugAllow more than 1000 items to be saved (PHP introduced input data limit)BugUpdate firmware boot data on OpenBSD 5.0 systems to prevent boot issue
3.3
Released on 2014-05-13
NewBased on OpenBSD 5.5NewAdded VXLAN to grammar and web adminNewSupports new hardware such as- VMware's VMXNET3 network interfaces and paravirtual SCSI
- VirtIO's paravirtual SCSI and random number devices
- Many new Intel platforms and NICs, such as the AES-NI capable Atom C2000
- PC Engine's APU
ImpSupport copy-pasting directly into web admin's HTML5 terminalImpAccurately choose a local IPsec endpoint address to send probe pings fromImpEd25519 SSH signaturesImpAllow omitting pflow (NetFlow/IPFIX) sender addressBugFixes an issue where the IKE daemonisakmpdwouldn't run with many addresses configuredBugDo not use cluster rdomain for updating on active cluster nodes without default routeBugFixes an issue where the VPN servernpppdcould fail to start
3.2-r2p1
Released on 2014-04-08
BugPatched OpenSSL "heartbleed" vulnerability (CVE-2014-0160)
3.2-r2
Released on 2014-04-03
NewRoute prioritiesNewAdd reserved host from DHCP lease pageImpLoad balancers on front page in web adminImpShow cancel URL when testing a commitImpPing with LAN addresses if a tunnels local endpoint is 0.0.0.0/0ImpWarn about pflow protocol 9 soon being deprecatedBugWeb admin failed to set IKE phase 2 mode to noneBugBasic setup erased aliases if having multiple IPsBugisakmpctl capture could fail to show decrypted packetsBugCluster push configuration button were brokenBugSystem could run out of bpf interfaces
3.2-r1
Released on 2014-01-08
NewAddedx-superuserlogin classImpAdded skeleton file for the DHCP serverImpSupport running router solicitation, syslog and NTP in routing domainsImpAllowed web terminal to poll backend even when browser tab is in backgroundImpAdded more IPv6 auto-configuration settings to web administrationImpStrip last dot from DHCPv6 search domainImpVarious minor improvementsBugDon't announce SLAAC prefixes when running a DHCPv6 serverBugResolved issue when filtering logs based on firewall label on amd64BugResolved ping-from-self through NAT issueBugResolved issue when moving VLANs from an unconfigured interface
3.2
Released on 2013-11-08
NewBased on OpenBSD 5.4NewRouter advertisement (v6) can announce DNSImpRouter advertisement doesn't announce prefix if DHCP managedImpSandboxed SSH serverImpDisabled private SNMP community by defaultImpVarious minor improvementsBugIssue with load balancer's host page when using IPs in relays
3.1-p7
Released on 2013-11-01
NewBuy feature licenses from within product's interfaceNewSupport for new HSR-603 modelNewSupport for reset button on HSR-1204 and ALIXImpReal-time decrypted IKE packets (isakmpctl capture)ImpSimplified and unified DHCP pageImpSupport temperature sensors in ALIXImpFirewall supports interface addressing and DNS in DHCP/BGP setupsImpUse bidirectional IPsec flows by defaultImpBetter validation of FQDNs as DHCP hostsImpMake HTTP/SSH servers and pflow support routing domainsImpRequire both sender and server for pflow interfacesImpVarious minor improvementsBugHTTP server didn't respect rsa-key and x509-certificateBugScrolling didn't always freezeBugSSL was checked when adding new load balancer listenersBugCouldn't type @ in web terminalBugDo not create sessions for unauthorized web admin clients
3.1-p6
Released on 2013-09-02
BugManagement interfaces couldn't be disabled on administration pageBugIKE lifetime wasn't maintained on IPsec pageBugTables was printed with an extra semi-colon on firewall pageBugNTP client didn't use updated name servers (for example DHCP)
3.1-p5
Released on 2013-08-09
ImpGracefully discard invalid host names in vApp deploymentBugWarning on front page if no graphs are availableBugXML warning on non-VMware system's interface page
3.1-p4
Released on 2013-08-07
ImpSupport new HSR-1200 series hardwareBugSupport non-standard gateway IP in update firmwareBugNo longer consume VMware channels without vAppBugHandle configuration without groups on firewall pageBugVarious minor bugs fixed
3.1-p3
Released on 2013-07-29
NewNetwork setup guide in OVF (VMware vCenter)ImpMinor web administration improvementsBugDisabled SMP due to threading regression in OpenBSD 5.3
3.1-p2
Released on 2013-07-24
ImpRestructured CLI menuImpSubscription licenses are more tolerant to connectivity issuesImpFaster boot by disabling floppy drives in kernelImpMinor web administration improvementsBugCould generate invalid VPN server configuration, regression
3.1-p1
Released on 2013-07-15
NewNew IKE debugging tool (isakmpctl)ImpSupport for VIA temperature sensorsImpPerl modules needed by pkg_add includedBugCluster failed to detect successful synchronizations
3.1
Released on 2013-07-10
NewBased on OpenBSD 5.3 (with patches from head)NewSupport for KVM Virtio para-virtualized driversNewAdded load balancer methods; least states, source hash, randomNewSupport for NetFlow 9 and 10 (IPFIX) inpflowNewTemperature sensors on graph pageImpAdded IPsec lifetime to plain-text configuration and interfaceImpAdded DHCP server options 66 and 67ImpAllow DHCP relay on CARP interfaceBugOnly allow valid advbase valuesBugNTP client reload fixes
3.0-p33
Released on 2013-06-28
ImpLoad balancer (relayd) performance improvedImpGraphs page display load balancer namesImpIPsec IKE tunnels page displays DH group numberImpFirewall page removes outer brackets on lists without spaceBugLoad balancer page didn't display correctly if name ended with a digitBugLoad balancer (relayd) didn't support more than 20 relaysBugCluster discovery (hdpd) don't exit when missing serial
3.0-p32
Released on 2013-05-31
ImpPPTP proxy timeout increasedImpLoad balancer page lists available listen addressesImpInternet failover doesn't require load balancer licenseImpTerminal emulator page input improvedBugLoad balancer page didn't handle multiple listeners and SSLBugLicense page's link to renewals didn't work
3.0-p31
Released on 2013-05-21
ImpSystem disks are grown to disk's size (CF, etc) into new data partitionImpBuffered software update without storage disk on grown systemsImpSupport 1000base* on Intel's SFP+ImpInterface descriptions on graphs pageImpAbility to change CARP password from interface pageImpSort DHCP leases based on lease timesImpWeb terminal's input synchronisedImpSupportsisinterfacesImpImproved Ethernet media handlingImpAllow svlan (QinQ) on trunk (LAG) interfacesImpReserved DHCP hosts excluded from rangesBugIPsec labels such as "to host" was interpreted as a resolvable hostnameBugGraph daemonstatdwarned about full disk too many times
3.0-p30
Released on 2013-04-11
NewMirror (SPAN ports) on bridgesImpKeep logs and graphs when rebooting if using a storage diskImpFaster software updates (writes data to disk asynchronous)ImpFlush all GRE states when enabling the PPTP proxyImpstorageupdatehas support for explicit (IPv) -4 and -6BugMax addresses on bridges wasn't configurable in web administrationBugLoad balancer's wizard was to strict on detecting potential conflicts
3.0-p29
Released on 2013-03-11
NewNew model VSR-Lite available for purchaseNewSupport for PC Engine's ALIX system boardsImpVPN servers support search domain and routes for Apple OSX and iOS clientsImpOther minor improvementsBugdhsyncd would fail to start if any carp interface was down
3.0-p28
Released on 2013-02-25
NewNew CLI commandreplace-swapinconfigureImpSupport for Dell R320ImpEdit buttons in tablesImpSupportrdomainandproxy-arpin cluster activationImpOther minor improvements
3.0-p27
Released on 2013-02-20
ImpSupport for more Broadcom NICsImpOther minor improvementsBugCould not enable free mode (VSR-Free) without serial
3.0-p26
Released on 2013-02-05
ImpVLAN on trunk interfacesImpSuppress repeated cluster errorsImpOther minor improvementsBugWhen configuring partial date and time
3.0-p25
Released on 2012-12-14
NewMicrosoft Hyper-V supportNewAbility to use additional disk as storage for logs, etcNewAbility to update with verification using storage diskImpImproved performance during commit/testImpQuestion on drain/flush load balancer node pausingImpChanged Subversion format to FSFSImpImproved loading time on firewall page with many rulesImpOverall improvementsBugIP ranges in macros on firewall pageBugLoad balancer wizard didn't work with missing statementNoteReserved routing domain 239-255
3.0-p24
Released on 2012-11-21
NewTheproxy-arpmakes it possible to use LAN network in VPN serverImpCluster (hdpd) keeps information about dead hostsImpImproved macro/table presentation on Network > FirewallImpMany load balancer improvements- Proper source-tracking per redirect
- Summarise statistics for multiple "listen on"
- Ability to enable/disable hosts in all relays/redirects
- Creates automatic rules for relays (tagged relayd)
- Wizard for adding relays and redirects
- User interface for global settings
- MIB for traps
ImpUser interface for SNMP settings on System > SNMPBugFixed problem when renaming duplicate macros/tablesBugExports on Configuration > Revision management named properlyBugFixed issue withstatdremoving graphs when redirects is down
3.0-p23
Released on 2012-10-25
ImpAllow more than 4 VPN server groups by creating /dev/tunX dynamicallyImpVisual noise when displaying all rulesets on firewall page removedImpPermit hyphens in the host part in FQDNs (search-domain and host-name)ImpOther minor improvements
3.0-p22
Released on 2012-10-22
NewReal-time graphsNewGraphs for firewall statesNewLogin banner in web administrationNewHighlight text in CLI output with | markImpForwarding (firewall/routing) performance improvedImpAbility to configure DNS, routes, etc per VPN groupImpAlways allow DHCP on VPN interfaces for dhinfod to workImpShortcuts to rule and state statistics on Firewall pageImpBetter logging when using SOAP's commandRunImpGo directly to deploy/diff when saving on clear-text pageImpAbility to restore the terminal using CLI's "reset"ImpDisplay line numbers of configuration error pageImpFirewall page now visually renders more protocolsImpLess obstructive reloading of VPN serverImpOther minor improvementsBugBug in PHP/CURL's DNS reloading remediedBugMemory leak in UUID generationBugInvalid netmask displayed as 0.0.0.0 on basic setup page
3.0-p21
Released on 2012-09-25
ImpWeb admin settings for VPN-server client routesImpUsability improvementsBugReal-time firewall log issue resolved
3.0-p20
Released on 2012-09-24
- New: VPN-server (L2TP/PPTP) supports client routes
- Bug: Issue with IPsec 3DES key generation button resolved
3.0-p19
Released on 2012-09-10
NewVPN-server (L2TP) NAT-T supportNewVPN-server (L2TP/PPTP) DNS suffix supportNewReplacedconfigure"diff" with new "compare" commandImpVarious graphical usability improvementsBugSaving a firewall macro with multiple items resulted in duplicate bracketsBugL2TP passphrase not saved when editing existing server
3.0-p18
Released on 2012-09-02
NewVSR-Free, a free licenseNewLicense subscription, option to automatically downloads license keysImpCLI can install and remove license keysImpLog failed password attempts via HTTPSImpAdded support for option 82 in the dhcp-relayBugMultiple negations on firewall page didn't render properly
3.0-p17
Released on 2012-08-22
NewDHCPv6 server, client and prefix delegationNewIPv6 router solicitation clientNewUser classes, including read-only users (login.conf)NewWeb graph layout is customisable and auto savedImpAbility to renew DHCP leasesImpWeb improvements for Apple iOS and Microsoft IE 9ImpWeb terminal has better scroll-backImpWeb shows disk usage on System > HardwareImpChanged system paths according to BSD defaultsImpCLI parsing improved with quoted stringsImpWeb settings stored in HTML5 local storageImpUpdated jQueryBugResolved cluster memory leak in backendBugResolved issue with /tmp getting fullBugResolved web cluster page script errorBugSuppressed warning when confirming deploymentBugSpelling corrections
3.0-p16
Released on 2012-07-10
NewDiagnostics > Terminal with full ANSI supportNewWorking copy allows for atomic apply of multiple changesImpAbility to tag configuration revisions with a messageImpAbility to cancel a pending configuration testImpNetwork > Interface got statisticsImpNetwork > Interface got PPPoE supportImpNetwork > Firewall supports negation of addressesImpNetwork > Basic setup got PPPoE supportImpNetwork > DHCP server lists connected clients (leases)ImpPPPoE interface automatically adds routes and rulesImpWelcome texts on first bootImpNew layout on login screenImpHighlights save or warns about unsaved changesImpValidating function configCheck() in SOAP APIImpDefault arguments in SOAP APIImpCommand for showing licenses in CLIBugNow validates reserved DHCP host's name more strictlyBugNo longer kicked out of console when setting root passwordBugResolved issue with dhsyncd causing sawtooth CPU usage
3.0-p15
Released on 2012-06-11
ImpSupport for ne (NE1000) interfaces (used by Parallels Desktop)ImpChanged the fail-path when activating clusteringBugError on first page for un-configured interfaces resolvedBugIssue when duplicating rules on the firewall page resolved
3.0-p14
Released on 2012-06-08
NewIntroduced cluster support using SSL certificatesNewIntroduced PPPoE supportNewIntroduced RADIUS support for PPTP and L2TP server with groupsNewLast ethernet interface automatically becomes cluster sync on installationNewPossibility to update a cluster node through other node via sync interfaceNewNew replace command in CLI configureNewLoad balancer shows statistics for layer 3 (redirects)NewKeyboard layout support for video consolesImpInternal IPC moved from TCP to Unix sockets for increased local securityImpFirewall page supports "received-on" routing domainsImpFriendly warning on password change in web administrationImpDHCP server supports clusteringImpDHCP server supports DHCP option 43ImpMake DHCP server leases persistent across rebootsImpPossibility to only change one of the DHCP range valuesImpRouter advertisements supports clusteringImpBasic setup displays unplugged cable correctlyImpSupport Intel 10/100 network cards (fxp)ImpHTTPS server supports certificates and keys in configurationImpRenamed "cd" to "edit" in CLI configureImpLicense page more detailed explains license keysImpOverview page consumes less CPUImpLoad balancer inherits default SSL certificate unless overriddenImpLoad balancer page layout improvedImpWeb browser cache is automatically flushed after software updatesImpUsers "admin" and "root" can force reboots from CLIImpUsers "admin" and "root" can perform a factory reset from CLIImpAllowed all users to view packets in tcpdump from CLIImpLicense, copyright and credit page added under Help pageImpPrevents users from removing themselves by mistakeImpIPsec tunnel ping test works on /0 networksImpHide shutdown button on hardware page by defaultBugBug in tcpbench resolved (patch sent upstream)BugDisplay error on DHCP page resolvedBugThe PPTP proxy has issues with clients sending GRE too earlyBugMonotonic time were not always used for wake upsBugChange of order of some keys in configuration didn't triggering a commitBugParsing error on load balancer page resolvedBugSyslog didn't log with host nameBugDHCP settings link on interface page didn't work for all interface types
3.0-p13
Released on 2012-03-22
BugDHCP relay regression issue resolved
3.0-p12
Released on 2012-03-20
NewHardware detection for Halon HSR-1000
3.0-p11
Released on 2012-03-16
NewLoad balancer user interfaceNewFTP proxy for NAT calledinterface X { ftp-proxyNewPPTP proxy for NAT calledinterface X { pptp-proxyImpFirewall user interface supportsdivertBugLoad balancer stability issue patchedBugSuppressed unnecessaryinterface-groupevents