Software-update: OPNsense 26.7.4

Het pakket OPNsense is een firewall met uitgebreide mogelijkheden. Het is gebaseerd op het besturingssysteem FreeBSD en is oorspronkelijk een fork van m0n0wall en pfSense. Het pakket kan volledig via een webinterface worden ingesteld en heeft onder andere ondersteuning voor mfa, OpenVPN, IPsec, CARP en captive portal. Daarnaast kan het packetfiltering toepassen en beschikt het over een traffic shaper. De ontwikkelaars achter OPNsense hebben de vierde update voor versie 26.7 uitgebracht en de releasenotes voor die uitgave kunnen hieronder worden gevonden.

OPNsense 26.7.4 released

Today we are rolling out the wireless device MVC/API rework and a final push for better source NAT replacement over outbound NAT. Strongswan was updated to 6.1.0 and the GUI now offers a small recommended set of post-quantum key exchanges. You may also find the GUI tweaks for advanced option marker and a dialog search field helpful. There is a lot more going on as you can see from this changelog, but more on this and future plans later!

Here are the full patch notes:

• system: audit log injection via login username in auth_log()
• system: add pfsync version 1500 to HA settings
• system: add hidden services so they can be operated by pluginctl -s
• system: privlege separated reload in static PHP pages
• system: lower priority of automatic wg/ipsec gateways
• system: fix disk widget loading issue
• system: add back the service widget link
• system: make compare operator in authTOTP() more strict
• interfaces: migrate wireless configuration to MVC/API
• interfaces: return an empty string which cannot be an interface in convert_real_interface_to_friendly_interface_name()
• interfaces: ppp-ipv6.php may be executed before later stages of interface_configure()
• interfaces: provide "uuid" in legacy_config_get_interfaces()
• interfaces: split media and mediaopt with tabs instead of spaces
• interfaces: a few config_read_array() replacements
• interfaces: refactor device matching around interface_parent_devices()
• interfaces: remove cua matching from PPP device pattern
• firewall: source NAT: add pool options and source hash key
• firewall: source NAT: fix port alias and well known port usage in target_port
• firewall: make source and destination NAT automatic rules visible in GUI
• firewall: implement JsonAuditField in all MVC components
• firewall: update the internally reserved pf keywords for FreeBSD 15
• firewall: add source NAT migration banner to outbound NAT
• firewall: add private network exclusions to default IPv6 bogons
• dnsmasq: leases sorting fixes
• firmware: opnsense-bootstrap: fix bootstrap on FreeBSD 15 with pkgbase
• firmware: opnsense-prefetch: new tool for sets prefetching
• firmware: opnsense-sign: shell compatibility update
• firmware: adjust the incompatible pkg test
• firmware: disable FreeBSD-base repository and remove old definitions
• intrusion detection: fix displaying URL in descriptions
• ipsec: add some hybrid post-quantum variants as additional key exchange
• kea: fix leases sorting
• openvpn: moved legacy CARP hook to os-openvpn-legacy plugin
• acl: fix API patters for GIF/GRE device settings
• acl: add missing and fix some issues
• backend: add CLOEXEC to a few file descriptor opens to avoid lock inheritance
• mvc: advanced marker for form/dialog fields
• mvc: fix stale imports for Message classes
• mvc: JsonAduditField: shared implementation for configuration revision tracking
• rc: add watchdog to shutdown, reboot and reload_all cases
• ui: fix widget bottom gap in standard theme files
• ui: sidebar fixes and rework
• ui: remove spurious _formDialog portion of dialog IDs
• ui: implement dialog search field
• ui: ensure a minimum amount of rows to render in grids
• plugins: os-acme-client 4.17
• plugins: os-theme-rebellion 1.9.8
• plugins: os-turnserver 1.4
• src: ciss: revert patch that added max physical target
• src: pf: do not set a null rule pointer during test
• src: pf: fix securelevel off-by-one
• src: pfctl: fix printing of wildcard anchors
• src: e1000: more assorted upstream patches from stable/15
• src: ixgbe: assorted upstream patches from stable/15
• src: virtio_p9fs: disallow detach if a session is in progress
• src: route/fib_algo: free leaked radix_masks in radix_lockless
• src: netipsec: implement pr_disconnect for PF_KEY sockets
• src: iflib: assorted upstream patches from stable/15
• src: net: add ifmedia support for 10GBase-BX BiDi
• src: bnxt: report initialization failures to iflib
• src: bnxt: add led(4) identification support
• src: ice: add led(4) identification support
• src: ice: report initialization failures to iflib
• src: ice: add support for E835 CNSA 2.0 adapters
• src: ice: add two more 4-part IDs for E835 adapters
• src: if_vxlan: fix panic by validating unused drvspec values
• src: qat: driver updates to enhance qat infrastructure
• src: ath10k: remove some early FreeBSD-specific debugging
• src: ip(6)_mroute: assorted upstream patches from stable/15
• src: in_mcast: fix uninitialized variable usage in inm_merge()
• src: bind: lookup local address in current FIB if '*.bind_all_fibs' is active
• src: net: add fib-aware ifa_ifwithaddr()
• ports: ca_root_nss / nss 3.129
• ports: curl 8.22.0
• ports: dhcp6c fix for truncated env vars in dhcp6c-script
• ports: expat 2.8.4
• ports: filterlog 0.9 support for pflog actions on FreeBSD 15
• ports: libxml 2.15.4
• ports: openldap 2.6.15
• ports: pcre2 10.48
• ports: php 8.5.10
• ports: phpseclib 3.0.57
• ports: strongswan 6.1.0

Versienummer	26.7.4
Releasestatus	Final
Besturingssystemen	BSD
Website	OPNsense
Download	https://opnsense.org/download
Licentietype	Voorwaarden (GNU/BSD/etc.)