Das Release ist 148,8MB groß und startet die Firewall im Anschluss neu. Es wurde 22 Änderungen und Fehler korrigiert. Die Roadmap enthält nun auch das nächste größere Release 20.0 Siehe: https://opnsense.org/about/road-map/ Unten folgen noch die älteren Releases, die ich im Blog nicht erwähnt hatte.

• system: fix legacy remote logging with custom port
• system: regenerate CA bundle when modifying trusted authorities
• system: fix translation order of tunables description
• system: fix CARP maintenance mode bootup
• firewall: missing daily refresh on GeoIP type
• firewall: fix fetch of GeoIP alias if its name is same as its country
• reporting: auto-load required kernel modules for NetFlow
• reporting: allow setting NetFlow active/inactive timeout (contributed by Frank Brendel)
• captive portal: optimise ipfw rule parsing
• firmware: Homelab.no has been superseded by TerraHost mirror (contributed by Thomas Jensen)
• unbound: support file-based custom includes
• unbound: set absolute path to root.hints (contributed by h-town)
• plugins: os-bind 1.8[2] (contributed by ErikJStaab)
• plugins: os-dnscrypt-proxy 1.6[3] (contributed by ErikJStaab)
• plugins: os-etpro-telemetry 1.4[4]
• plugins: os-theme-cicada 1.20 (contributed by Team Rebellion)
• plugins: os-theme-tukan 1.20 (contributed by Team Rebellion)
• ports: ca_root_nss 3.46
• ports: ldns 1.7.1[5]
• ports: pcre2 10.33[6]
• ports: php 7.2.22[7]
• ports: phpseclib 2.0.21[8]
• ports: unbound 1.9.3[9]

A hotfix release was issued as 19.7.4_1:

• captive portal: fix merge conflict in optimisation

OPNsense 19.7.3 Release Notes

• system: try all backups for automatic revert when config.xml is damaged
• system: do a system reset if all config.xml files are damaged
• system: only show tunables reboot hint when applying tunables (contributed by Northguy)
• system: use FQDN in system log remote messages
• system: add defunct gateways to GUI in disabled state
• interfaces: only allow VLAN parents that will work as VLAN parents
• interfaces: optionally promote/demote CARP on service status
• interfaces: CARP status page report with demotion level to avoid ambiguity
• firewall: revert problematic 19.7.2 change “unhide automatic interface-based output rules”
• firewall: restore automatic outbound NAT pre-19.7 behaviour which excludes gateways not configured and not dynamic
• firewall: add logging toggle to rules overview (contributed by johnaheadley)
• firewall: DHCPv6 relay would generate rules even if not enabled
• firmware: only do single-repository fingerprint verify defaulting to our OPNsense repository
• firmware: fix base and kernel package listing
• intrusion detection: show change message after toggle or save
• intrusion detection: rule download fix
• monit: add parent devices to interface list (contributed by Frank Brendel)
• monit: fix standard configuration migration (contributed by Frank Brendel)
• reporting: skip illegal NetFlow records in flow parser
• opendns: migrate update hook from DynDNS plugin to core to make it fully automatic
• backend: fix exception message string handling in Python 3
• backend: add help to pluginctl utility
• backend: configctl event handler support
• mvc: log API key when authentication failed
• ui:  more consistent HTML (contributed by gisforgirard)
• ui: sidebar bug fix (contributed by Team Rebellion)
• ui: fix initFormAdvancedUI() on initial load
• plugins: os-acme-client 1.25[1]
• plugins: os-bind 1.7[2]
• plugins: os-dyndns 1.17 removes OpenDNS and fixes DyNS
• plugins: os-haproxy 2.18[3]
• plugins: os-maltrail 1.1[4]
• plugins: os-nginx log rotation fix (contributed by Fabian Franz)
• plugins: os-postfix 1.10[5]
• plugins: os-smart 2.1 fixes widget status and adds NVMe disk support (contributed by irokinet and ATL)
• plugins: os-theme-cicada 1.19 (contributed by Team Rebellion)
• plugins: os-theme-tukan 1.19 (contributed by Team Rebellion)
• plugins: os-wireguard 1.1[6]
• src: fix incorrect exception handling in libunwind[7]
• src: fix multiple vulnerabilities in bzip2[8]
• src: fix ICMPv6 / MLDv2 out-of-bounds memory access[9]
• src: fix insufficient message length validation in bsnmp library[10]
• src: fix insufficient validation of guest-supplied data (e1000 device)[11]
• src: fix IPv6 remote denial of service[12]
• src: fix kernel memory disclosure from /dev/midistat[13]
• src: fix reference count overflow in mqueuefs[14]
• ports: hostapd 2.9[15]
• ports: nghttp2 1.39.2[16]
• ports: openldap 2.4.48[17]
• ports: perl 5.30.0[18]
• ports: php 7.2.21[19]
• ports: py-openssl 19.0.0[20]
• ports: syslog-ng 3.22.1[21]
• ports: wpa_supplicant 2.9[22]
  

OPNsense 19.7.2 Release Notes

• system: missing “” in legacy output via Syslog-ng
• system: fix writing gateway information for DNS servers
• system: allow gateway to work in DHCPv6 WAN when no router solicitation is available
• firewall: unhide automatic interface-based output rules
• firewall: unhide automatic non-interface-based floating rules
• firewall: lift length restriction in NAT rule description
• firewall: avoid newlines in rule descriptions
• firewall: only show usable addresses in NAT outbound rules
• interfaces: fix extended CARP output when parsing interface information
• interfaces: add more outputs to overview page to increase usefulness
• interfaces: use shared DHCP lease reader for ARP list
• captive portal: fix binary read issue in Python 3
• dhcp: fix DHCPv4 relay interface selection (contributed by jayantsahtoe)
• firmware: handle file signature verify correctly with multiple fingerprint repositories
• firmware: Aivian mirror is no longer active
• firmware: Cloudfence mirror in Brazil added
• plugins: os-acme-client 1.24[1]
• plugins: os-bind 1.6 (contributed by crazy-max)
• plugins: os-dnscrypt-proxy 1.5 (contributed by crazy-max)
• plugins: os-grid_example 1.0[2]
• plugins: os-helloworld Python 3 compatibility[3]
• plugins: os-nut 1.5 adds Riello driver (contributed by Michael Muenz)
• plugins: os-sunnyvalley 1.0[4][5]
• src: fix panic from Intel CPU vulnerability mitigation[6]
• src: fix multiple telnet client vulnerabilities[7]
• src: fix pts write-after-free[8]
• src: fix kernel memory disclosure in freebsd32_ioctl[9]
• src: fix reference count overflow in mqueuefs[10]
• src: fix byhve out-of-bounds read in XHCI device[11]
• src: fix file descriptor reference count leak[12]
• ports: libevent 2.1.11[13]

OPNsense 19.7.1 Release Notes

• system: do not create automatic copies of existing gateways
• system: do not translate empty tunables descriptions
• system: remove unwanted form action tags
• system: do not include Syslog-ng in rc.freebsd handler
• system: fix manual system log stop/start/restart
• system: scoped IPv6 “%” could confuse mwexecf(), use plain mwexec() instead
• system: allow curl-based downloads to use both trusted and local authorities
• system: fix group privilege print and correctly redirect after edit
• system: use cached address list in referrer check
• system: fix Syslog-ng search stats
• firewall: HTML-escape dynamic entries to display aliases
• firewall: display correct IP version in automatic rules
• firewall: fix a warning while reading empty outbound rules configuration
• firewall: skip illegal log lines in live log
• interfaces: performance improvements for configurations with hundreds of interfaces
• reporting: performance improvements for Python 3 NetFlow aggregator rewrite
• dhcp: move advanced router advertisement options to correct config section
• ipsec: replace global array access with function to ensure side-effect free boot
• ipsec: change DPD action on start to “dpdaction = restart”
• ipsec: remove already default “dpdaction = none” if not set
• ipsec: use interface IP address in local ID when doing NAT before IPsec
• web proxy: fix database reset for Squid 4 by replacing use of ssl_crtd with security_file_certgen
• plugins: os-acme-client 1.24[1]
• plugins: os-bind 1.6[2]
• plugins: os-dnscrypt-proxy 1.5[3]
• plugins: os-frr now restricts characters BGP prefix-list and route-maps[4]
• plugins: os-google-cloud-sdk 1.0[5]
• ports: curl 7.65.3[6]
• ports: monit 5.26.0[7]
• ports: openssh 8.0p1[8]
• ports: php 7.2.20[9]
• ports: python 3.7.4[10]
• ports: sqlite 3.29.0[11]
• ports: squid 4.8[12]