Software-update: pfSense CE 2.7.2

Versie 2.7.2 van pfSense Community Edition is uitgekomen. Dit pakket is gebaseerd op het besturingssysteem FreeBSD en richt zich op router- en firewalltaken. Het is verkrijgbaar in de gratis Community Edition en een Plus-uitvoering, die voorheen als Factory Edition werd aangeboden. Het is in 2004 begonnen als een afsplitsing van m0n0wall vanwege verschillende visies bij de ontwikkelaars en in de loop van de jaren uitgegroeid tot een router- en firewallpakket dat in zowel kleine als zeer grote omgevingen kan worden ingezet. Voor meer informatie verwijzen we naar deze pagina. De changelog voor deze uitgave kan hieronder worden gevonden.

FreeBSD Notices

This release includes corrections for several FreeBSD Errata Notices and Security Advisories, including:

• FreeBSD-SA-23:17.pf - TCP spoofing vulnerability in pf(4)
• FreeBSD-EN-23:16.openzfs - Potential ZFS Data Corruption. For more information about ZFS data corruption, see ZFS Data Corruption Details later in this document.
• FreeBSD-EN-23:18.openzfs - High CPU usage by ZFS kernel threads
• FreeBSD-EN-23:17.ossl - ossl(4)’s AES-GCM implementation may give incorrect results
• FreeBSD-EN-23:20.vm - Incorrect results from the kernel physical memory allocator
• Performance issues in OpenSSL have also been identified and corrected, notably with acceleration such as AES-NI.

EFI Issue on Proxmox VE

Some users of pfSense software running under Proxmox VE 7.4 have had issues booting Virtual Machines via EFI. This may also affect other versions of Proxmox VE and pfSense software as well as FreeBSD. Adding a serial port to the VM hardware appears to work around the issue for the time being. A fix for the root cause is under investigation and development for future versions.

At this time the best practice to avoid potential problems is to add a serial port to the VM, then shutdown the VM and start it back up before beginning the pfSense software upgrade process. See EFI Boot Issues for additional recommendations.

ZFS Data Corruption Details

Two data corruption bugs were recently reported against ZFS, including the version of ZFS in recent releases of pfSense software. These bugs have been corrected upstream in FreeBSD and the fixes have been imported into this release.

One bug was in block cloning, which is disabled by default on pfSense software, and thus is unlikely to be a significant concern on this platform. The other bug has been present in ZFS for years and was difficult to trigger. Given the history of data corruption problems due to hole reporting in files, the corrections for this issue include a preventive measure to disable hole reporting. The downside of disabling hole reporting is the possibly increased disk space usage.

Tip: users on previous releases of pfSense software can reduce the likelihood of encountering the data corruption issue by creating a System Tunable for vfs.zfs.dmu_offset_next_sync with a value of 0.

DHCP (IPv4)

• Fixed: ISC DHCP responds from a random port #15011

DHCP (IPv6)

• Fixed: PHP error on services_dhcpv6.php if the configuration contains an empty dhcpv6 section #14978

DHCP Relay

• Fixed: Input validation prevents saving DHCPv6 Relay settings #14965

IPsec

• Fixed: Mobile IPsec Group Authentication cannot be enabled #14963
• Fixed: Incorrect permissions on ipsec.auth-user.php #14974
• Fixed: IPsec log categories set to “Audit” do not function properly or save properly in the GUI #14990
• Changed: Update strongSwan to 5.9.11_3 #15050

Installer

• Added: Add an appropriately named file to install images to indicate what they are #14887

Interfaces

• Fixed: Mulicast traffic on a detached interface causes a panic #14917
• Fixed: PHP Error on interfaces.php when creating a PPP interface #14949

OpenVPN

• Changed: Update OpenVPN to 2.6.8_1 #15049

Operating System

• Fixed: Potential ZFS file corruption #15034

Rules / NAT

• Fixed: Invalid outbound NAT rules break the following rule #15024
• Fixed: Automatic outbound NAT rules show an empty NAT Address #15025

Upgrade

• Fixed: pfSense-boot does not update the EFI loader #15007

Web Interface

• Fixed: Firewall Maximum Table Entries “default size” is whatever is entered #11566

Versienummer	2.7.2
Releasestatus	Final
Besturingssystemen	BSD
Website	Netgate
Download	https://www.pfsense.org/download/
Licentietype	GPL

Reacties (4)

[duderuud]

Update hier zonder problemen verlopen.

[Microkid]

Hier ook zonder problemen geupgrade. Reboot duurde ong 3 minuten, daarna was Pfsense weer beschikbaar.

[motwho]

Had toch wat issues met upgraden. Al wat eerder moet ik zeggen, van 2.7.0 naar 2.7.1.
Die update stond klaar en na de preventieve herstart opeens niet meer.
Op Netgate forum waren er meer. Had te maken met een certificaat bleek.
Als je dan in de console of root shell prompt cert rehash draait: ‘certctl rehash’ dan is de update wel te vinden en kan je idd probleemloos verder updaten.
https://forum.netgate.com...sense-ce-2-7-0-to-2-7-1/9 Linkje van Netgate forum

[Reactie gewijzigd door motwho op 22 juli 2024 14:32]

[apronk]

Van 2.7.0 naar 2.7.2 gegaan kreeg problemen met L2TP/IPSec. De client verbindingen werden gemaakt maar konden niet meer bij het LAN komen. Enkelen hebben dit probleem ook maar is niet gedocumenteerd nog. Dus vandaag 2.7.0 weer geinstalleerd en problemen zijn weg.