OPNsense 19.7.4 Release

Das Release ist 148,8MB groß und startet die Firewall im Anschluss neu. Es wurde 22 Änderungen und Fehler korrigiert. Die Roadmap enthält nun auch das nächste größere Release 20.0 Siehe: https://opnsense.org/about/road-map/ Unten folgen noch die älteren Releases, die ich im Blog nicht erwähnt hatte.

• system: fix legacy remote logging with custom port
• system: regenerate CA bundle when modifying trusted authorities
• system: fix translation order of tunables description
• system: fix CARP maintenance mode bootup
• firewall: missing daily refresh on GeoIP type
• firewall: fix fetch of GeoIP alias if its name is same as its country
• reporting: auto-load required kernel modules for NetFlow
• reporting: allow setting NetFlow active/inactive timeout (contributed by Frank Brendel)
• captive portal: optimise ipfw rule parsing
• firmware: Homelab.no has been superseded by TerraHost mirror (contributed by Thomas Jensen)
• unbound: support file-based custom includes
• unbound: set absolute path to root.hints (contributed by h-town)
• plugins: os-bind 1.8[2] (contributed by ErikJStaab)
• plugins: os-dnscrypt-proxy 1.6[3] (contributed by ErikJStaab)
• plugins: os-etpro-telemetry 1.4[4]
• plugins: os-theme-cicada 1.20 (contributed by Team Rebellion)
• plugins: os-theme-tukan 1.20 (contributed by Team Rebellion)
• ports: ca_root_nss 3.46
• ports: ldns 1.7.1[5]
• ports: pcre2 10.33[6]
• ports: php 7.2.22[7]
• ports: phpseclib 2.0.21[8]
• ports: unbound 1.9.3[9]

A hotfix release was issued as 19.7.4_1:

• captive portal: fix merge conflict in optimisation

OPNsense 19.7.3 Release Notes

• system: try all backups for automatic revert when config.xml is damaged
• system: do a system reset if all config.xml files are damaged
• system: only show tunables reboot hint when applying tunables (contributed by Northguy)
• system: use FQDN in system log remote messages
• system: add defunct gateways to GUI in disabled state
• interfaces: only allow VLAN parents that will work as VLAN parents
• interfaces: optionally promote/demote CARP on service status
• interfaces: CARP status page report with demotion level to avoid ambiguity
• firewall: revert problematic 19.7.2 change „unhide automatic interface-based output rules“
• firewall: restore automatic outbound NAT pre-19.7 behaviour which excludes gateways not configured and not dynamic
• firewall: add logging toggle to rules overview (contributed by johnaheadley)
• firewall: DHCPv6 relay would generate rules even if not enabled
• firmware: only do single-repository fingerprint verify defaulting to our OPNsense repository
• firmware: fix base and kernel package listing
• intrusion detection: show change message after toggle or save
• intrusion detection: rule download fix
• monit: add parent devices to interface list (contributed by Frank Brendel)
• monit: fix standard configuration migration (contributed by Frank Brendel)
• reporting: skip illegal NetFlow records in flow parser
• opendns: migrate update hook from DynDNS plugin to core to make it fully automatic
• backend: fix exception message string handling in Python 3
• backend: add help to pluginctl utility
• backend: configctl event handler support
• mvc: log API key when authentication failed
• ui:  more consistent HTML (contributed by gisforgirard)
• ui: sidebar bug fix (contributed by Team Rebellion)
• ui: fix initFormAdvancedUI() on initial load
• plugins: os-acme-client 1.25[1]
• plugins: os-bind 1.7[2]
• plugins: os-dyndns 1.17 removes OpenDNS and fixes DyNS
• plugins: os-haproxy 2.18[3]
• plugins: os-maltrail 1.1[4]
• plugins: os-nginx log rotation fix (contributed by Fabian Franz)
• plugins: os-postfix 1.10[5]
• plugins: os-smart 2.1 fixes widget status and adds NVMe disk support (contributed by irokinet and ATL)
• plugins: os-theme-cicada 1.19 (contributed by Team Rebellion)
• plugins: os-theme-tukan 1.19 (contributed by Team Rebellion)
• plugins: os-wireguard 1.1[6]
• src: fix incorrect exception handling in libunwind[7]
• src: fix multiple vulnerabilities in bzip2[8]
• src: fix ICMPv6 / MLDv2 out-of-bounds memory access[9]
• src: fix insufficient message length validation in bsnmp library[10]
• src: fix insufficient validation of guest-supplied data (e1000 device)[11]
• src: fix IPv6 remote denial of service[12]
• src: fix kernel memory disclosure from /dev/midistat[13]
• src: fix reference count overflow in mqueuefs[14]
• ports: hostapd 2.9[15]
• ports: nghttp2 1.39.2[16]
• ports: openldap 2.4.48[17]
• ports: perl 5.30.0[18]
• ports: php 7.2.21[19]
• ports: py-openssl 19.0.0[20]
• ports: syslog-ng 3.22.1[21]
• ports: wpa_supplicant 2.9[22]
  

OPNsense 19.7.2 Release Notes

• system: missing „“ in legacy output via Syslog-ng
• system: fix writing gateway information for DNS servers
• system: allow gateway to work in DHCPv6 WAN when no router solicitation is available
• firewall: unhide automatic interface-based output rules
• firewall: unhide automatic non-interface-based floating rules
• firewall: lift length restriction in NAT rule description
• firewall: avoid newlines in rule descriptions
• firewall: only show usable addresses in NAT outbound rules
• interfaces: fix extended CARP output when parsing interface information
• interfaces: add more outputs to overview page to increase usefulness
• interfaces: use shared DHCP lease reader for ARP list
• captive portal: fix binary read issue in Python 3
• dhcp: fix DHCPv4 relay interface selection (contributed by jayantsahtoe)
• firmware: handle file signature verify correctly with multiple fingerprint repositories
• firmware: Aivian mirror is no longer active
• firmware: Cloudfence mirror in Brazil added
• plugins: os-acme-client 1.24[1]
• plugins: os-bind 1.6 (contributed by crazy-max)
• plugins: os-dnscrypt-proxy 1.5 (contributed by crazy-max)
• plugins: os-grid_example 1.0[2]
• plugins: os-helloworld Python 3 compatibility[3]
• plugins: os-nut 1.5 adds Riello driver (contributed by Michael Muenz)
• plugins: os-sunnyvalley 1.0[4][5]
• src: fix panic from Intel CPU vulnerability mitigation[6]
• src: fix multiple telnet client vulnerabilities[7]
• src: fix pts write-after-free[8]
• src: fix kernel memory disclosure in freebsd32_ioctl[9]
• src: fix reference count overflow in mqueuefs[10]
• src: fix byhve out-of-bounds read in XHCI device[11]
• src: fix file descriptor reference count leak[12]
• ports: libevent 2.1.11[13]

OPNsense 19.7.1 Release Notes

• system: do not create automatic copies of existing gateways
• system: do not translate empty tunables descriptions
• system: remove unwanted form action tags
• system: do not include Syslog-ng in rc.freebsd handler
• system: fix manual system log stop/start/restart
• system: scoped IPv6 „%“ could confuse mwexecf(), use plain mwexec() instead
• system: allow curl-based downloads to use both trusted and local authorities
• system: fix group privilege print and correctly redirect after edit
• system: use cached address list in referrer check
• system: fix Syslog-ng search stats
• firewall: HTML-escape dynamic entries to display aliases
• firewall: display correct IP version in automatic rules
• firewall: fix a warning while reading empty outbound rules configuration
• firewall: skip illegal log lines in live log
• interfaces: performance improvements for configurations with hundreds of interfaces
• reporting: performance improvements for Python 3 NetFlow aggregator rewrite
• dhcp: move advanced router advertisement options to correct config section
• ipsec: replace global array access with function to ensure side-effect free boot
• ipsec: change DPD action on start to „dpdaction = restart“
• ipsec: remove already default „dpdaction = none“ if not set
• ipsec: use interface IP address in local ID when doing NAT before IPsec
• web proxy: fix database reset for Squid 4 by replacing use of ssl_crtd with security_file_certgen
• plugins: os-acme-client 1.24[1]
• plugins: os-bind 1.6[2]
• plugins: os-dnscrypt-proxy 1.5[3]
• plugins: os-frr now restricts characters BGP prefix-list and route-maps[4]
• plugins: os-google-cloud-sdk 1.0[5]
• ports: curl 7.65.3[6]
• ports: monit 5.26.0[7]
• ports: openssh 8.0p1[8]
• ports: php 7.2.20[9]
• ports: python 3.7.4[10]
• ports: sqlite 3.29.0[11]
• ports: squid 4.8[12]