pfSense Update 2.3.2-p1

Die Entwickler der Open Source Firewall, pfSense, haben das Maintenance Release der Serie 2.3.x in Version 2.3.2-p1 veröffentllicht. Neben der Fehlerbehebung von 34 Bugs, bringt dieses Release auch 2 neue Features mit.

Neben den aktuellen Updates von OpenSSL in FreeBSD wurden auch einige verwendete Pakete wie:

• PHP auf 5.6.26
• libidn auf 1.33
• curl auf 7.50.3
• libxml2 auf 2.9.4

aktualisiert.

Das Update ist wie immer relativ einfach und über die Web-GUI durchführbar. Zum nachlesen lohnt ein Blick in den Upgrade Guide

Leider gibt es noch folgende Reg ressions / Probleme zwischen den Versionen 2.2.6 und dem 2.3 Release:

• IPsec IPComp does not work. This is disabled by default. However in 2.3.1, it is automatically not enabled to avoid encountering this problem. Bug 6167
• IGMP Proxy does not work with VLAN interfaces, and possibly other edge cases. Bug 6099. This is a little-used component. If you’re not sure what it is, you’re not using it.
• Those using IPsec and OpenBGPD may have non-functional IPsec unless OpenBGPD is removed. Bug 6223

pfSense 2.3.2-p1 Bugfixes und Features

pfSense Release Notes 2.3.2-p1: https://blog.pfsense.org/?p=2122

2.3.2 Update 1 (Pending)

• FreeBSD-SA-16:26.openssl – Multiple vulnerabilities in OpenSSL. The only significant impact on pfSense is OCSP for HAproxy and FreeRADIUS.
• Several HyperV-related Errata in FreeBSD 10.3, FreeBSD-EN-16:10 through 16:16. See https://www.freebsd.org/relnotes/10-STABLE/errata/errata.html for details.
• Several built-in packages and libraries have been updated, including:
  • PHP to 5.6.26
  • libidn to 1.33
  • curl to 7.50.3
  • libxml2 to 2.9.4

• Added encoding to the ‚zone‘ parameter on Captive Portal pages.
• Added output encoding to diag_dns.php for results returned from DNS. #6737
• Worked around a Chrome bug with regular expression parsing of escaped characters within character sets. Fixes „Please match the requested format“ on recent Chrome versions. #6762
• Fixed DHCPv6 server time format option #6640
• Fixed /usr/bin/install missing from new installations. #6643
• Increased filtering tail limit for logging so searching will locate sufficient entries. #6652
• Cleaned up Installed Packages widget and HTML. #6601
• Fixed widget settings corruption when creating new settings. #6669
• Fixed various typos and wording errors.
• Removed defunct links to the devwiki site. Everything is on https://doc.pfsense.org now.
• Added a field to CA/Cert pages for OU, which is required by some external CAs and users. #6672
• Fixed a redundant HTTP „User-Agent“ string in DynDNS updates.
• Fixed the font for sortable tables.
• Added a check to verify if an interface is active in a gateway group before updating dynamic DNS.
• Fixed wording of the „Reject leases from“ option for a DHCP interface (it can only take addresses, not subnets.) #6646
• Fixed error reporting for SMTP settings test.
• Fixed saving of country, provider, and plan values for PPP interfaces
• Fixed checking of invalid „Go To Line“ numbers on diag_edit.php. #6704
• Fixed off-by-one error with „Rows to Display“ on diag_routes.php. #6705
• Fixed description of the filter box on diag_routes.php to reflect that all fields are searchable. #6706
• Fixed description of the box for the file to edit on diag_edit.php. #6703
• Fixed description of the main panel on diag_resetstate.php. #6709
• Fixed warning dialog when a box is unchecked on diag_resetstate.php. #6710
• Fixed log shortcut for DHCP6 areas. #6700
• Fixed the network delete button showing when only one row was present on services_unbound_acls.php #6716
• Fixed disappearing help text on repeatable rows when the last row is deleted. #6716
• Fixed dynamic DNS domain for static map DHCP entries
• Added control to set dashboard widget refresh period
• Added „-C /dev/null“ to the dnsmasq command line parameters to avoid it picking up an incorrect default configuration which would override our options. #6730
• Added „-l“ to traceroute6 to show both IP Addresses and Hostnames when resolving hops on diag_traceroute.php. #6715
• Added note about max ttl/hop limit in source comment on diag_traceroute.php.
• Clarified language on diag_tables.php. #6713
• Cleaned up the text on diag_sockets.php. #6708
• Fixed display of VLAN interface names during console assignment. #6724
• Fixed domain-name-servers option showing twice in pools when set manually.
• Fixed handling of DHCP options in pools other than the main range. #6720
• Fixed missing hostnames in some cases with dhcpdv6. #6589
• Improved pidfile handling for dhcpleases.
• Added checks to prevent accessing an undefined offset in IPv6.inc.
• Fixed the display of the alias popup and edit options on source and destination for both the address and port on outbound NAT.
• Fixed handling of backup config count. #6771
• Removed some dangling PPTP references that are no longer relevant.
• Fixed up/caught up remote syslog areas. Added „routing“, „ntpd“, „ppp“, „resolver“, fixed „vpn“ to include all VPN areas (IPsec, OpenVPN, L2TP, PPPoE Server). #6780
• Fixed missing checkboxes in some cases when adding rows on services_ntpd.php. #6788
• Revised service running/stopped icons.
• Added a check to CRL management to remove certificates from the drop-down list that are already contained in the CRL being edited.
• Fixed rule separators moving when multiple firewall rules are deleted at the same time. #6801

JARVIS

Interessiert in verschiedenste IT Themen, schreibe ich in diesem Blog über Software, Hardware, Smart Home, Games und vieles mehr. Ich berichte z.B. über die Installation und Konfiguration von Software als auch von Problemen mit dieser. News sind ebenso spannend, sodass ich auch über Updates, Releases und Neuigkeiten aus der IT berichte. Letztendlich nutze ich Taste-of-IT als eigene Dokumentation und Anlaufstelle bei wiederkehrenden Themen. Ich hoffe ich kann dich ebenso informieren und bei Problemen eine schnelle Lösung anbieten. Wer meinen Aufwand unterstützen möchte, kann gerne eine Tasse oder Pod Kaffe per PayPal spenden – vielen Dank.