OPNsense Bugfix und Feature Update 21.7.4

Die Firewall OPNsense erhielt das Update 21.7.4, die einige Fehler behebt und 3 neue Funktionen einführt. Zu den Neuerungen gehört die Möglichkeit der Aktivierung von Receive Side Scale (RSS), was im Kernel unterstüzt wird. Außerdem Asynchrone DNS Auflösung für Aliase und Support für erweitertes LAGG.

RSS is per default deaktiviert und kann durch hinzufügen von “net.inet.rss.enabled” mit dem Wert “1” aktiviert werden. OPNsense muss danach neugestartet werden. RSS kann die Performance von einigen Systemen verbessern, aber es sollte mit Sorgfalt genutzt werden und ist generell nicht empfohlen. Die Suricata Version beinhalet die kommende API Bindings um die Vorteile von RSS basiertem multithreading nutzen zu können. Wichtig, PPPoE kann nicht die Vorteile von RSS nutzen.

OPNsense 21.7.4 Change Log

• system: prevent expired or intermediate CA certificates from being added to trust store by default
• system: prevent XSS in LDAP attribute return in authentication tester (reported by Orange CERT-CC)
• system: add product title to auth pages
• system: fix log search ignoring first character
• system: add xc0 entry video console entry if node exists
• system: add automatic outbound NAT logging option
• interfaces: let guess_interface_from_ip() find the best match on overlapping subnets (contributed by Jason Crowley)
• interfaces: improve configurability with LAGG devices
• firewall: fix non-sticky rule association in port forward
• firewall: switch failover peer address acquire away from deprecated function
• firewall: specify overload table on maximum new connections
• firewall: add loaded item count and last update to aliases page
• firewall: refactor getInterfaceGateway() to eliminate edge cases with IPsec route-to behaviour
• firewall: allow alias to skip entry on EmptyLabel (contributed by James Golovich)
• firewall: improve resolve performance by implementing asynchronous DNS lookups
• dhcp: show static leases without IP address assignments in the lease pages
• firmware: do not remove obsolete base files on major upgrades
• firmware: support ABI hints in the file “firmware-upgrade”
• firmware: opnsense-code utility now supports “-u” mode for automatic upgrade after fetch
• firmware: opnsense-code utility fix for “-d” option (contributed by Patrick M. Hausen)
• firmware: opnsense-update utility is now able to bootstrap its own configuration in “-d” mode
• firmware: opnsense-update utility now supports “-ct package-name” check for type change
• firmware: opnsense-update utility no longer assumes “-bkp” by default
• firmware: opnsense-update utility adds separate clean option for obsolete base files
• firmware: opnsense-update utility assorted cleanups
• ipsec: add charon.max_ikev1_exchanges parameter
• ipsec: add closeaction parameter (contributed by Patrick M. Hausen)
• ipsec: rewrite netmask calculation for VTI tunnel setup
• monit: add link event to alert settings (contributed by Frank Brendel)
• openvpn: remove obsolete remnants of tun-ipv6
• unbound: add Abuse.ch ThreatFox list
• unbound: make so-reuseport conditional upon RSS status
• backend: static parameters ignored when no dynamic ones exist
• mvc: replace __toString() calls with string casts
• plugins: os-acme-client 3.4[1]
• plugins: os-c-icap log file fix (contributed by Michael Muenz)
• plugins: os-dyndns 1.25[2]
• plugins: os-haproxy 3.6[3]
• plugins: os-lldpd will now identify itself as Network Connectivity Device (contributed by Xeroxxx)
• plugins: os-puppet-agent 1.0[4]
• plugins: os-qemu-guest-agent 1.1[5]
• plugins: os-theme-rebellion 1.8.8 (contributed by Team Rebellion)
• src: include RSS kernel support defaulting to off
• src: axgbe: properly multiplex on reading module signals
• src: libnetmap: reset errno in nmreq_register_decode()
• src: pf: remove side effect from nat logging patch
• src: dummynet: fix mbuf tag allocation failure handling
• src: aesni: avoid a potential out-of-bounds load in aes_encrypt_icm()
• ports: curl 7.79.1[6]
• ports: dnspython 2.1.0[7]
• ports: jinja 3.0.1[8]
• ports: libressl 3.3.5[9]
• ports: lighttpd 1.4.60[10]
• ports: nss 3.71[11]
• ports: openvpn 2.5.4[12]
• ports: php 7.4.24[13]
• ports: strongswan 5.9.4[14]
• ports: sudo 1.9.8p2[15]

Quelle: OPNsense 21.7.4 released – OPNsense® is a true open source firewall and more