opnDossier v1.3.0

Multi-platform support, starting with pfSense.

v1.3.0 adds pfSense configuration analysis alongside the existing OPNsense parser, built on a new multi-device architecture designed for extensibility.

Highlights

pfSense Support

opnDossier now parses pfSense config.xml files with the same analysis capabilities available for OPNsense: security findings, dead rule detection, unused interface identification, and multi-format export. Auto-detection identifies the firewall platform from the configuration file, so the workflow is unchanged -- just point opnDossier at your config and it works.

Dedicated Audit Command

The new opndossier audit command is a first-class entry point for security analysis. It replaces the previous convert --audit-mode workflow with cleaner flags, glamour-rendered terminal output, and built-in support for processing multiple configuration files concurrently. The default audit mode is now blue (remediation-focused).

Pluggable Parser Registry

New DeviceParser registry follows the database/sql driver pattern. External Go projects can register custom parsers via blank imports. This is the foundation for community-contributed platform support in future releases. See the plugin development guide for details.

Configuration Diff

New opndossier diff command compares two configuration files and shows what changed. Supports side-by-side mode, HTML output with syntax highlighting, section-level change detection, and security scoring of the delta. Useful for reviewing changes before applying a backup, auditing what changed between maintenance windows, or comparing configs across devices.

# Terminal diff
opndossier diff old-config.xml new-config.xml

# HTML report with side-by-side view
opndossier diff old-config.xml new-config.xml --format html --side-by-side -o diff-report.html

Sanitize Command

New opndossier sanitize command redacts sensitive data (passwords, keys, SNMP strings, RADIUS secrets) from configuration files before sharing. Three sanitization modes target different use cases:

• Aggressive -- for public sharing (forums, GitHub issues). Redacts credentials, network topology, hostnames, and all identifying information.
• Moderate (default) -- for internal sharing or vendor support. Redacts credentials and secrets while preserving network structure.
• Minimal -- credentials only. Strips passwords and keys, leaves everything else intact.

Sanitization maintains referential integrity: the same original value always maps to the same redacted value across the entire config, so network relationships and rule references remain consistent and analyzable. The optional --mapping flag generates a JSON mapping file for reverse lookup when you need to correlate redacted output back to the original.

Built directly from community feedback -- requested by @DevGuyRash and other operators who need to share configs with vendors or post them in support forums without manual redaction.

Additional Output Formats

Export to text and HTML in addition to the existing Markdown, JSON, and YAML formats. HTML output includes alert rendering for security findings. The --redact flag provides opt-in sensitive field redaction during conversion.

Expanded Report Coverage

Reports now include IDS/Suricata configuration, gateway groups, enhanced DHCP reporting (server configuration, static mappings, advanced options), and improved NAT reporting with mode display, forwarding rules, and inbound rules. Compliance checks expanded with password policy and audit logging validation.

Public API Surface

The CommonDevice model and OPNsense schemas are now exported under pkg/model/ and pkg/schema/opnsense/. External tools can import and work with parsed firewall configurations directly as a Go library.

What Changed

Architecture

• Unified Finding type across audit, compliance, and processor packages -- consistent severity levels and validation everywhere (#280)
• Shared analysis package eliminates ~400 lines of duplicated detection logic and fixes an inconsistent rule equivalence algorithm (#321)
• ReportBuilder interface segregation splits a 20-method interface into three focused interfaces (SectionBuilder, TableWriter, ReportComposer) for cleaner consumer code (#323)
• FormatRegistry centralizes output format dispatch, replacing hardcoded routing (#434)
• Enum type safety replaces bare string literals with typed constants for firewall rules, NAT modes, DHCP, and protocol types (#298)

Plugin System

• Panic recovery wraps each plugin's RunChecks() in defer recover() so a misbehaving plugin cannot crash the audit (#309)
• Load failure reporting surfaces .so plugin errors to the user with per-plugin details; new --plugin-dir flag for custom plugin directories (#311)

Performance & Reliability

• Streaming generation for large configurations -- reduced memory pressure on real-world configs (#189)
• Production hardening phases 1-4 (#214)
• ISO-8859-1 and Windows-1252 encoding support -- properly handles non-UTF-8 configs exported from older systems (#169)
• Comprehensive service detection for more accurate unused interface analysis (#215)

Bug Fixes

• Severity breakdown now correctly appears in audit reports (#310)
• IPv6 validation uses net.ParseIP instead of a dot-check heuristic
• --include-tunables flag properly wires through display and convert commands (#413)
• Shared backing array mutations prevented in normalize -- deep copies all mutable slice fields (#313)
• Section added/removed detection restored for value types in diff output (#388)
• Deterministic report output via sorted map iterations (#256)

Documentation

• Comprehensive system architecture documentation
• Plugin development guide and API reference
• Rewritten data-model docs for the CommonDevice export model
• Expanded contributing guide with architecture and governance
• Restructured user-guide commands documentation

Supported Platforms

Installation

Download pre-built binaries from the Releases page or build from source:

go install github.com/EvilBit-Labs/opnDossier@v1.3.0

Quick Start

# OPNsense (unchanged)
opndossier convert config.xml -o report.md

# pfSense (auto-detected)
opndossier convert pfsense-config.xml -o report.md

# Security audit
opndossier audit config.xml

# Compare two configs
opndossier diff old-config.xml new-config.xml

# Strip secrets before sharing (default: moderate mode)
opndossier sanitize config.xml -o config-safe.xml

# Aggressive mode for public posting
opndossier sanitize config.xml --mode aggressive -o config-public.xml

Full changelog: v1.2.2...v1.3.0