udate changelogs

pull/308/head
Ad Schellevis 3 years ago
parent 387c17d1f5
commit 9edba62645

@ -6,8 +6,8 @@ Releases
:width: 600px
:align: center
As of January 2015 there have been *191* releases leading to the latest version *20.7.6*
named "Legendary Lion".
As of January 2015 there have been *195* releases leading to the latest version *21.1*
named "Marvelous Meerkat".
The list below contains all releases, ordered by version number categorized by major version.
@ -16,6 +16,7 @@ The list below contains all releases, ordered by version number categorized by m
:titlesonly:
:glob:
releases/21.1
releases/20.7
releases/20.1
releases/19.7

@ -64,7 +64,7 @@ Here is the full list of changes:
* src: improve reliability of ZFS `[3] <https://www.freebsd.org/security/advisories/FreeBSD-EN-15:06.file.asc>`__
* src: updated to tzdata2015e `[4] <http://mm.icann.org/pipermail/tz-announce/2015-June/000032.html>`__
* ports: openssl 1.0.2c `[5] <https://www.openssl.org/news/openssl-1.0.2-notes.html>`__ , libressl 2.2.0 `[6] <http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.2.0-relnotes.txt>`__ , php 5.6.10 `[7] <https://php.net/ChangeLog-5.php#5.6.10>`__ ,
dnsmasq 2.73 `[8] <http://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__ , smartmontools 6.4 `[9] <https://www.smartmontools.org/browser/tags/RELEASE_6_4/smartmontools/NEWS>`__
dnsmasq 2.73 `[8] <https://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__ , smartmontools 6.4 `[9] <https://www.smartmontools.org/browser/tags/RELEASE_6_4/smartmontools/NEWS>`__
* syslogd: disable unmaintained and unused ZMQ patches
* opnsense-update: gained independent awareness of kernel and
base system version

@ -37,7 +37,7 @@ tools. Please see the full patch notes for details and references:
* base: inconsistency between locale and rune locale states `[4] <https://www.freebsd.org/security/advisories/FreeBSD-EN-15:09.xlocale.asc>`__
* notable ports updates: phalcon 2.0.3 `[5] <https://github.com/phalcon/cphalcon/releases/tag/phalcon-v2.0.3>`__ , curl 7.43.0_2 `[6] <https://curl.haxx.se/changes.html>`__ ,
openssh 6.8p1_8, python 2.7.10 `[7] <https://hg.python.org/cpython/raw-file/15c95b7d81dc/Misc/NEWS>`__ , perl 5.20.2_5 `[8] <http://perldoc.perl.org/perl5202delta.html>`__ , ntp 4.2.8p3 `[9] <http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ChangeLog-stable>`__ ,
libxml2 2.9.2_3 `[10] <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-1819>`__ , openldap24-server 2.4.41 `[11] <http://www.openldap.org/software/release/readme.html>`__
libxml2 2.9.2_3 `[10] <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-1819>`__ , openldap24-server 2.4.41 `[11] <https://www.openldap.org/software/release/changes.html>`__
* opnsense-update: will no longer try to reinstall the istalled version
after a fresh installation
* bsdinstaller: bring back cpdup to error out on low memory installation
@ -327,7 +327,7 @@ Here are the full patch notes:
* ports: phalcon 2.0.9 `[1] <https://github.com/phalcon/cphalcon/releases/tag/phalcon-v2.0.9>`__
* ports: php 5.6.16 `[2] <https://php.net/ChangeLog-5.php#5.6.16>`__
* ports: suricata 2.0.10 `[3] <http://suricata-ids.org/2015/11/25/suricata-2-0-10-available/>`__
* ports: openldap 2.4.43 `[4] <http://www.openldap.org/software/release/changes.html>`__
* ports: openldap 2.4.43 `[4] <https://www.openldap.org/software/release/changes.html>`__
* ports: strongswan 5.3.5 `[5] <https://www.strongswan.org/blog/2015/11/26/strongswan-5.3.5-released.html>`__
* menu: removed tab navigation in favour of submenu items
* menu: removed the status and diagnostics from the top menu
@ -720,7 +720,7 @@ Here is the full list of changes:
* src: local privilege escalation in IRET handler `[1] <https://www.freebsd.org/security/advisories/FreeBSD-SA-15:21.amd64.asc>`__
* src: disable ixgbe(4) flow-director support `[2] <https://www.freebsd.org/security/advisories/FreeBSD-EN-15:14.ixgbe.asc>`__
* src: insufficient check of unsupported pkg(7) signature methods `[3] <https://www.freebsd.org/security/advisories/FreeBSD-EN-15:15.pkg.asc>`__
* ports: libressl 2.2.3 `[4] <http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.2.3-relnotes.txt>`__ , bind 9.10.2P4 `[5] <https://kb.isc.org/article/AA-01301/81/BIND-9.10.2-P4-Release-Notes.html>`__ , openldap24-client 2.4.42 `[6] <http://www.openldap.org/software/release/changes.html>`__
* ports: libressl 2.2.3 `[4] <http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.2.3-relnotes.txt>`__ , bind 9.10.2P4 `[5] <https://kb.isc.org/article/AA-01301/81/BIND-9.10.2-P4-Release-Notes.html>`__ , openldap24-client 2.4.42 `[6] <https://www.openldap.org/software/release/changes.html>`__
* ports: radvd 1.15 `[7] <http://www.litech.org/radvd/CHANGES-1.txt>`__ , lighttpd 1.4.37 `[8] <http://www.lighttpd.net/2015/8/30/1.4.37/>`__ , squid 3.5.8 `[9] <http://ftp.meisei-u.ac.jp/mirror/squid/squid-3.5-ChangeLog.txt>`__
* ports: php 5.6.13 `[10] <https://php.net/ChangeLog-5.php#5.6.13>`__ , php-suhosin 0.9.38 `[11] <https://raw.githubusercontent.com/stefanesser/suhosin/master/Changelog>`__
* dhcp: use reverse mask instead of reverse address in config
@ -877,7 +877,7 @@ Here are the full patch notes:
* src: shell injection vulnerability in patch `[1] <https://www.freebsd.org/security/advisories/FreeBSD-SA-15:18.bsdpatch.asc>`__
* src: routed remote denial of service vulnerability `[2] <https://www.freebsd.org/security/advisories/FreeBSD-SA-15:19.routed.asc>`__
* ports: dnsmasq 2.75 `[3] <http://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__ , squid 3.5.7 `[4] <http://ftp.meisei-u.ac.jp/mirror/squid/squid-3.5-ChangeLog.txt>`__ , openvpn 2.3.8 `[5] <https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.8>`__
* ports: dnsmasq 2.75 `[3] <https://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__ , squid 3.5.7 `[4] <http://ftp.meisei-u.ac.jp/mirror/squid/squid-3.5-ChangeLog.txt>`__ , openvpn 2.3.8 `[5] <https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.8>`__
* ports: libressl 2.2.2 `[6] <http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.2.2-relnotes.txt>`__ , lighttpd 1.4.36 `[7] <http://www.lighttpd.net/2015/7/26/1.4.36/>`__ , php 5.6.12 `[8] <https://php.net/ChangeLog-5.php#5.6.12>`__
* ports: pcre 8.37_3 `[9] <https://github.com/freebsd/freebsd-ports/commit/1b0e3ce910b727>`__ , pkg 1.5.6 `[10] <https://github.com/freebsd/freebsd-ports/commit/1a100a88a92d4>`__ , expat 2.1.0_3 `[11] <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1283>`__
* dns resolver: improve bootstrapping of root directory to ensure
@ -943,7 +943,7 @@ The update requires a reboot. Here are the full patch notes:
* src: shell injection vulnerability in patch(1) `[1] <https://www.freebsd.org/security/advisories/FreeBSD-SA-15:14.bsdpatch.asc>`__
* src: resource exhaustion in TCP reassembly `[2] <https://www.freebsd.org/security/advisories/FreeBSD-SA-15:15.tcp.asc>`__
* src: OpenSSH multiple vulnerabilities `[3] <https://www.freebsd.org/security/advisories/FreeBSD-SA-15:16.openssh.asc>`__
* ports: phalcon 2.0.6 `[4] <https://github.com/phalcon/cphalcon/releases/tag/phalcon-v2.0.6>`__ , openssh 6.9p1 `[5] <http://www.openssh.com/txt/release-6.9>`__ , bind 9.10.2P3 `[6] <https://kb.isc.org/article/AA-01280/81/BIND-9.10.2-P3-Release-Notes.html>`__ , dnsmasq 2.74 `[7] <http://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: phalcon 2.0.6 `[4] <https://github.com/phalcon/cphalcon/releases/tag/phalcon-v2.0.6>`__ , openssh 6.9p1 `[5] <http://www.openssh.com/txt/release-6.9>`__ , bind 9.10.2P3 `[6] <https://kb.isc.org/article/AA-01280/81/BIND-9.10.2-P3-Release-Notes.html>`__ , dnsmasq 2.74 `[7] <https://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* opnsense-update: can now replace mirror locations
* crash reporter: fixed numerous remotely-submitted warnings and bugs
* universal plug and play: fixed concurrent enable for UPnP and NAT-PMP (contributed by Chong Cheung)
@ -1143,7 +1143,7 @@ tools. Please see the full patch notes for details and references:
* base: inconsistency between locale and rune locale states `[4] <https://www.freebsd.org/security/advisories/FreeBSD-EN-15:09.xlocale.asc>`__
* notable ports updates: phalcon 2.0.3 `[5] <https://github.com/phalcon/cphalcon/releases/tag/phalcon-v2.0.3>`__ , curl 7.43.0_2 `[6] <https://curl.haxx.se/changes.html>`__ ,
openssh 6.8p1_8, python 2.7.10 `[7] <https://hg.python.org/cpython/raw-file/15c95b7d81dc/Misc/NEWS>`__ , perl 5.20.2_5 `[8] <http://perldoc.perl.org/perl5202delta.html>`__ , ntp 4.2.8p3 `[9] <http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ChangeLog-stable>`__ ,
libxml2 2.9.2_3 `[10] <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-1819>`__ , openldap24-server 2.4.41 `[11] <http://www.openldap.org/software/release/readme.html>`__
libxml2 2.9.2_3 `[10] <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-1819>`__ , openldap24-server 2.4.41 `[11] <https://www.openldap.org/software/release/changes.html>`__
* opnsense-update: will no longer try to reinstall the istalled version
after a fresh installation
* bsdinstaller: bring back cpdup to error out on low memory installation

@ -218,7 +218,7 @@ Here are the patch notes for 16.1.16:
* src: kernel stack disclosure in Linux compatibility layer `[2] <https://www.freebsd.org/security/advisories/FreeBSD-SA-16:20.linux.asc>`__
* src: kernel stack disclosure in 4.3BSD compatibility layer `[3] <https://www.freebsd.org/security/advisories/FreeBSD-SA-16:21.43bsd.asc>`__
* src: directory traversal in cpio `[4] <https://www.freebsd.org/security/advisories/FreeBSD-SA-16:22.libarchive.asc>`__
* ports: libressl 2.3.5 `[5] <http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.5-relnotes.txt>`__ , phalcon 2.0.13 `[6] <https://github.com/phalcon/cphalcon/releases/tag/phalcon-v2.0.13>`__ , dnsmasq 2.76 `[7] <http://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: libressl 2.3.5 `[5] <http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.5-relnotes.txt>`__ , phalcon 2.0.13 `[6] <https://github.com/phalcon/cphalcon/releases/tag/phalcon-v2.0.13>`__ , dnsmasq 2.76 `[7] <https://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: apinger 0.7 `[8] <https://github.com/opnsense/apinger/blob/master/NEWS>`__ , curl 7.49 `[9] <https://curl.haxx.se/changes.html>`__ , bind 9.10.4-p1 `[10] <https://kb.isc.org/article/AA-01383/81/BIND-9.10.4-P1-Release-Notes.html>`__
* ports: php 5.6.22 `[11] <https://php.net/ChangeLog-5.php#5.6.22>`__ , sqlite 3.13.0 `[12] <https://sqlite.org/releaselog/3_13_0.html>`__ , ntp 4.2.8p8 `[13] <https://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ChangeLog-stable>`__
* dashboard: movable widgets, multi-column support and improved
@ -910,7 +910,7 @@ Enough with the announcing already, here are the full patch notes:
* src: hyperv/kvp: wake up the daemon if it is sleeping due to poll() `[1] <https://github.com/opnsense/core/issues/748>`__
* src: Use correct src/dst ports when removing states in pf `[2] <https://github.com/opnsense/src/pull/9>`__
* src: finish the boot loader branding by adding a shiny logo
* ports: unbound 1.5.7 `[3] <https://nlnetlabs.nl/projects/unbound/download/>`__ , openldap 2.4.44 `[4] <http://www.openldap.org/software/release/changes.html>`__ , ca_root_nss 3.22,
* ports: unbound 1.5.7 `[3] <https://nlnetlabs.nl/projects/unbound/download/>`__ , openldap 2.4.44 `[4] <https://www.openldap.org/software/release/changes.html>`__ , ca_root_nss 3.22,
php 5.7.18 `[5] <https://php.net/ChangeLog-5.php#5.6.18>`__ , phalcon 2.0.10 `[6] <https://github.com/phalcon/cphalcon/releases/tag/phalcon-v2.0.10>`__ , pkg 1.6.4 `[7] <https://github.com/freebsd/freebsd-ports/commit/364bf01c846>`__ `[8] <https://github.com/freebsd/freebsd-ports/commit/69fe3e55ff5>`__
* interfaces: collapsible overview for each interface
* shaper: fix issue with model when not able to save an old config

@ -805,7 +805,7 @@ Lastly, here are the full changes since 16.7-RC2:
--------------------------------------------------------------------------
16.7-RC2 is here and brings major additions to amd64 architectures: Intel's
16.7-RC2 is here and brings major additions to amd64 architectures: Intel
Hyperscan library to speed up Suricata rule matching and UEFI boot support!
It also brings language packs to their correct 16.7 state, with Japanese
already having been completed by the amazing Chie Taguchi.
@ -848,8 +848,7 @@ Here is the list of all changes since 16.7-RC1:
* firmware: enable trim even for GPT/UFS labeled root file systems
* firmware: removed / disabled defunct mirrors
* firmware: removed deprecated status.php page
* intrusion detection: allow to select pattern matcher, e.g.
Intel's Hyperscan
* intrusion detection: allow to select pattern matcher, e.g. Intel Hyperscan
* wizard: fix misalignment on page titles and contents
* firewall: fix missing dependency in alias download script
* firewall: correctly skip "//" type comments in remote alias files
@ -932,7 +931,7 @@ Here is our list of major features that were worked on since 16.1:
* Japanese translations 100% completed
* Dashboard revamp with multi-column support, drag and drop and mini API
* RFC 6238 (TOTP) support for two-factor authentication
* HardenedBSD's ASLR implementation
* HardenedBSD ASLR implementation
* High availability page for remote service status and start/stop/restart
* API commands for remote reboot and power off
* Firmware page resume support and cron-based "nightly" updates

@ -110,21 +110,17 @@ Here are the full patch notes:
* firewall: move gateway switching from system to firewall advanced settings
* firewall: keep category selection when changing tabs
* firewall: do not skip gateway switch parsing too early (contributed
by Stephane Lesimple)
* firewall: do not skip gateway switch parsing too early (contributed by Stephane Lesimple)
* interfaces: show VLAN description during edit
* firmware: opnsense-revert can now handle multiple packages at once
* firmware: opnsense-patch can now handle permission changes from patches
* dnsmasq: use canned --bogus-priv for no_private_reverse
* dnsmasq: separate log file, ACL and menu entries
* dynamic dns: fix update for IPv6 (contributed by Alexander Leisentritt)
* dynamic dns: remove usage of CURLAUTH_ANY (contributed
by Alexander Leisentritt)
* intrusion detection: suppress "fast mode available" boot warning
in PCAP mode
* dynamic dns: remove usage of CURLAUTH_ANY (contributed by Alexander Leisentritt)
* intrusion detection: suppress "fast mode available" boot warning in PCAP mode
* openvpn: plugin framework adaption
* unbound: add local-zone typetransparent for PTR zone (contributed
by Davide Gerhard)
* unbound: add local-zone typetransparent for PTR zone (contributed by Davide Gerhard)
* unbound: separate log file, ACL and menu entries
* wizard: remove HTML from description strings
* mvc: group relation to something other than uuid if needed
@ -135,15 +131,14 @@ Here are the full patch notes:
* plugins: acme-client 1.8 (contributed by Frank Wall)
* plugins: tinc fix for switch mode (contributed by Johan Grip)
* plugins: monit 1.3 (contributed by Frank Brendel)
* src: support dhclient supersede statement for option 54 (contributed
by Fabian Kurtz)
* src: support dhclient supersede statement for option 54 (contributed by Fabian Kurtz)
* src: add Intel Atom Cherryview SOC HSUART support
* src: add the ID for the Huawei ME909S LTE modem
* src: HardenedBSD Stack Clash mitigations `[1] <https://hardenedbsd.org/article/shawn-webb/2017-06-25/stack-clash-mitigations>`__
* ports: sqlite 3.19.3 `[2] <https://sqlite.org/releaselog/3_19_3.html>`__
* ports: openvpn 2.4.3 `[3] <https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24>`__
* ports: sudo 1.8.20p2 `[4] <https://www.sudo.ws/stable.html#1.8.20p2>`__
* ports: dnsmasq 2.77 `[5] <http://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: dnsmasq 2.77 `[5] <https://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: openldap 2.4.45 `[6] <https://www.openldap.org/software/release/changes.html>`__
* ports: php 7.0.20 `[7] <https://php.net/ChangeLog-7.php#7.0.20>`__
* ports: suricata 3.2.2 `[8] <https://suricata-ids.org/2017/06/07/suricata-3-2-2-available/>`__

@ -408,7 +408,7 @@ Here are the full patch notes:
* plugins: os-collectd 1.1 graphite post and prefix (contributed by Michael Muenz)
* plugins: os-intrusion-detection-content-et-pro 1.0
* plugins: os-quagga 1.4.2 OSPF router ID support (contributed by Fabian Franz)
* ports: dnsmasq 2.78 `[1] <http://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: dnsmasq 2.78 `[1] <https://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: kerberos 1.15.2 `[2] <https://web.mit.edu/kerberos/krb5-1.15/#announcement>`__
* ports: openvpn 2.4.4 `[3] <https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24>`__
* ports: perl 5.24.3 `[4] <http://search.cpan.org/dist/perl-5.24.3/pod/perldelta.pod>`__
@ -666,10 +666,10 @@ Here are the full patch notes of the initial 17.7.1:
* openvpn: write proxy auth file in shared key export
* openvpn: minor display tweaks in widget and configuration pages
* openvpn: local group restriction feature
* update: rename bootstrap '-V' argument to '-r' for consistency
* update: rename bootstrap "-V" argument to "-r" for consistency
* update: fix code bug for /etc/make.conf link rewrite on upgrade
* update: support '-S' argument to probe remote set size
* update: support loading kernel debug sets via '-g' option
* update: support "-S" argument to probe remote set size
* update: support loading kernel debug sets via "-g" option
* mvc: add standard dialog helper (contributed by Frank Wall)
* mvc: simplify language selection code (contributed by Alexander Shursha)
* mvc: allow to run targeted model migration if requested

@ -547,7 +547,7 @@ Here are the full patch notes:
* src: vt console memory disclosure `[2] <https://security.freebsd.org/advisories/FreeBSD-SA-18:04.vt.asc>`__
* src: multiple small kernel memory disclosures `[3] <https://security.freebsd.org/advisories/FreeBSD-EN-18:04.mem.asc>`__
* src: timezone database information update `[4] <https://security.freebsd.org/advisories/FreeBSD-EN-18:03.tzdata.asc>`__
* ports: dnsmasq 2.79 `[5] <http://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: dnsmasq 2.79 `[5] <https://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: openssl 1.0.2o `[6] <https://www.openssl.org/news/secadv/20180327.txt>`__
* ports: perl 5.26.1 `[7] <https://metacpan.org/pod/release/SHAY/perl-5.26.1/pod/perldelta.pod>`__
* ports: php 7.1.16 `[8] <https://php.net/ChangeLog-7.php#7.1.16>`__

@ -441,7 +441,7 @@ Here are the full patch notes:
* src: fix DoS in listen syscall over IPv6 socket `[3] <https://www.freebsd.org/security/advisories/FreeBSD-EN-18:11.listen.asc>`__
* src: fix small kernel memory disclosures `[4] <https://www.freebsd.org/security/advisories/FreeBSD-EN-18:12.mem.asc>`__
* ports: unbound 1.8.1 `[5] <https://nlnetlabs.nl/projects/unbound/download/>`__
* ports: dnsmasq 2.80 `[6] <http://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: dnsmasq 2.80 `[6] <https://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__

@ -437,7 +437,7 @@ Here is the full list of changes:
* src: fix reference count overflow in mqueuefs `[14] <https://www.freebsd.org/security/advisories/FreeBSD-SA-19:24.mqueuefs.asc>`__
* ports: hostapd 2.9 `[15] <https://w1.fi/cgit/hostap/plain/hostapd/ChangeLog>`__
* ports: nghttp2 1.39.2 `[16] <https://github.com/nghttp2/nghttp2/releases/tag/v1.39.2>`__
* ports: openldap 2.4.48 `[17] <https://www.openldap.org/software/release/announce.html>`__
* ports: openldap 2.4.48 `[17] <https://www.openldap.org/software/release/changes.html>`__
* ports: perl 5.30.0 `[18] <https://metacpan.org/pod/release/XSAWYERX/perl-5.30.0/pod/perldelta.pod>`__
* ports: php 7.2.21 `[19] <https://www.php.net/ChangeLog-7.php#7.2.21>`__
* ports: py-openssl 19.0.0 `[20] <https://www.pyopenssl.org/en/stable/changelog.html>`__

@ -55,7 +55,7 @@ Here are the full patch notes:
* plugins: os-wireguard 1.2 `[5] <https://github.com/opnsense/plugins/pull/1865>`__
* ports: ca_root_nss 3.54
* ports: curl 7.71.1 `[6] <https://curl.haxx.se/changes.html>`__
* ports: dnsmasq 2.82 `[7] <http://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: dnsmasq 2.82 `[7] <https://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: monit 5.27.0 `[8] <https://mmonit.com/monit/changes/>`__
* ports: php 7.3.20 `[9] <https://www.php.net/ChangeLog-7.php#7.3.20>`__
* ports: python 3.7.8 `[10] <https://www.python.org/downloads/release/python-378/>`__
@ -91,7 +91,7 @@ Here are the full patch notes:
* firewall: work around categories typeahead issue with recent jQuery libraries
* firewall: improve alias help text (contributed by Team Rebellion)
* firewall: switch from single log filter to one per attribute
* intrusion detection: when enabling rules prefixed with '# ' consume the extra space (contributed by Tra5is)
* intrusion detection: when enabling rules prefixed with "# " consume the extra space (contributed by Tra5is)
* intrusion detection: less sensitive rule parsing
* intrusion detection: compress stats.log backups
* ipsec: valid IPSec Phase 2 hash config warning raises GUI alert (contributed by Brett Merrick)
@ -240,7 +240,7 @@ Here are the full patch notes:
* plugins: os-unbound-plus 1.1 `[3] <https://github.com/opnsense/plugins/blob/master/dns/unbound-plus/pkg-descr>`__
* plugins: os-wol 2.3 adds case insensitive matching in widget (contributed by Gauss23)
* ports: ca_root_nss 3.51.1
* ports: dnsmasq 2.81 `[4] <http://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: dnsmasq 2.81 `[4] <https://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: krb5 1.18.1 `[5] <https://web.mit.edu/kerberos/krb5-1.18/>`__
* ports: openvpn 2.4.9 `[6] <https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24#OpenVPN2.4.9>`__
* ports: php 7.2.30 `[7] <https://www.php.net/ChangeLog-7.php#7.2.30>`__

@ -26,6 +26,117 @@ can be found below as well.
* Full mirror list: https://opnsense.org/download/
--------------------------------------------------------------------------
20.7.8 (January 19, 2021)
--------------------------------------------------------------------------
The particular volume of this stable update foreshadows the end of the 20.7
series in less than two weeks.
One longstanding issue with radvd on FreeBSD 12.1 has been resolved according
to multiple user feedback.
The mailing lists have been archived and will no longer be used.
And before there are questions: yes, consumers of the development version are
now able to upgrade to 21.1-RC1.
Here are the full patch notes:
* system: allow to recover from bad TLS certificate and/or bad settings in console interface assign
* system: display destination port number in firewall log widget (contributed by Team Rebellion)
* system: keep compatible TLS 1 defaults for web GUI on 20.7 series
* system: set default certificate lifetime to 397 days
* firewall: add type 128 to outgoing IPv6 RFC4890 requirements
* firewall: add manual refresh button to live log
* firewall: fix typo in ICMPv6 validation
* firewall: fix minor regression in maintaining target alias file
* firewall: fix all state value in pfTop (contributed by Lucas Held)
* firewall: remove duplicated destination field in live log
* firewall: add read-only actions to aliases permission (contributed by Manuel Faux)
* firewall: category selector missing caption
* reporting: add top talkers to revamped traffic graph page
* reporting: fix name resolution filter change in insight
* reporting: persist interface selection on traffic graph page
* captive portal: disable faulty TLS on HTTP since lighttpd 1.4.56
* dhcp: fix sorting of IPv6 static mappings (contributed by vnxme)
* dhcp: fix incorrect parsing of DUID (contributed by Matt Holgate)
* firmware: opnsense-code now updates the current directory if nothing was specified
* firmware: opnsense-code now uses flexible make.conf target from tools.git
* firmware: opnsense-update now supports snapshot access via -z option
* firmware: opnsense-update now fixes missing dependencies on the fly
* firmware: fix some issues with missing repository on server
* firmware: add version output and date to audit logs
* ipsec: display remote host in status overview (contributed by garlic17)
* opendns: add standalone mode
* openssh: honour MAX_LISTEN_SOCKS
* openvpn: set default certificate lifetime to 397 days in wizard
* unbound: generate all configuration files in service controller
* unbound: fix broken lines in large files (contributed by kulikov-a)
* web proxy: lock ACL download to prevent duplicate execution
* mvc: allow underscore in filter string (contributed by kulikov-a)
* plugins: os-haproxy 2.26 `[1] <https://github.com/opnsense/plugins/blob/master/net/haproxy/pkg-descr>`__
* plugins: os-hw-probe 1.0 (contributed by Michael Muenz)
* plugins: os-maltrail fixes sensor start without server (contributed by Julio Camargo)
* plugins: os-nginx 1.20 `[2] <https://github.com/opnsense/plugins/blob/master/www/nginx/pkg-descr>`__
* plugins: os-tinc fixes for latest version (contributed by vnxme)
* src: fix OpenSSL NULL pointer de-reference `[3] <https://www.freebsd.org/security/advisories/FreeBSD-SA-20:33.openssl.asc>`__
* src: fix partial scrub of multicast packages
* src: free full mbuf chains in iflib when draining transmit queues
* src: initialize oifp to avoid bogus results/panics in edge cases
* src: 10Gigabit Ethernet driver for AMD SoC
* ports: libressl 3.2.3 `[4] <https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.2-relnotes.txt>`__ `[5] <https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.3-relnotes.txt>`__
* ports: nss 3.60.1
* ports: php 7.3.26 `[6] <https://www.php.net/ChangeLog-7.php#7.3.26>`__
* ports: pkg fix for shell keyword by opening root file descriptor
* ports: radvd 2.19 `[7] <https://radvd.litech.org/CHANGES.txt>`__
* ports: sudo 1.9.5p1 `[8] <https://www.sudo.ws/stable.html#1.9.5p1>`__
A hotfix release was issued as 20.7.8_4:
* firmware: enable upgrade path to 21.1
* ports: sudo 1.9.5p2 `[9] <https://www.sudo.ws/stable.html#1.9.5p2>`__
--------------------------------------------------------------------------
20.7.7 (December 17, 2020)
--------------------------------------------------------------------------
Important security updates inside. Also: happy holidays!
Here are the full patch notes:
* reporting: fix traffic graph widget link issue
* system: simplify log format parsing
* interfaces: fix DUID LL description (contributed by Gabriel Mazzocato)
* unbound: fix dnsbl not reloading after update
* plugins: os-acme-client 2.2 `[1] <https://github.com/opnsense/plugins/blob/master/security/acme-client/pkg-descr>`__
* plugins: os-freeradius 1.9.9 `[2] <https://github.com/opnsense/plugins/blob/master/net/freeradius/pkg-descr>`__
* plugins: os-frr 1.20 `[3] <https://github.com/opnsense/plugins/blob/master/net/frr/pkg-descr>`__
* plugins: os-tinc 1.6 enables multiple addresses per host (contributed by ElNounch)
* plugins: os-wireguard 1.4 `[4] <https://github.com/opnsense/plugins/blob/master/net/wireguard/pkg-descr>`__
* ports: curl 7.74.0 `[5] <https://curl.se/changes.html>`__
* ports: dhcp6c ignores advertise messages with none of requested data and missed status codes
* ports: libressl 3.1.5 `[6] <https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.1.5-relnotes.txt>`__
* ports: lighttpd 1.4.56 `[7] <https://www.lighttpd.net/2020/11/29/1.4.56/>`__
* ports: nss 3.60 `[8] <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.60_release_notes>`__
* ports: openssl 1.1.1i `[9] <https://www.openssl.org/news/secadv/20201208.txt>`__
* ports: pcre2 10.36 `[10] <https://www.pcre.org/changelog.txt>`__
* ports: sudo 1.9.4 `[11] <https://www.sudo.ws/stable.html#1.9.4>`__
* ports: sqlite 3.34.0 `[12] <https://sqlite.org/changes.html>`__
* ports: unbound 1.13.0 `[13] <https://nlnetlabs.nl/projects/unbound/download/>`__
A hotfix release was issued as 20.7.7_1:
* system: disable TLS on plain HTTP redirect for new lighttpd version
* ports: unbound fix for segmentation fault (restart service to activate)
* ports: lighttpd 1.4.58 `[14] <https://www.lighttpd.net/2020/12/27/1.4.58/>`__
--------------------------------------------------------------------------
20.7.6 (December 08, 2020)
--------------------------------------------------------------------------
@ -246,7 +357,7 @@ Here are the full patch notes:
* system: force syslog-ng restart after boot sequence
* system: properly read new style logging directories
* reporting: replace line endings when sending traceback to syslog in flowd_aggregate
* reporting: dd traffic graph filter for private IPv4 networks (contributed by kcaj-burr)
* reporting: add traffic graph filter for private IPv4 networks (contributed by kcaj-burr)
* firewall: add MAC address alias type
* firewall: be more verbose when fetching alias remote content
* firewall: prevent pfctl error messages from being suppressed
@ -269,7 +380,7 @@ Here are the full patch notes:
* plugins: os-telegraf 1.8.2 `[3] <https://github.com/opnsense/plugins/blob/master/net-mgmt/telegraf/pkg-descr>`__
* plugins: os-tinc fixes cipher parsing on 20.7
* src: remove ACPI workaround for serial console on AMD EPYC
* src: Make pf.conf ':0' ignore link-local v6 addresses too
* src: Make pf.conf ":0" ignore link-local v6 addresses too
* src: default "show bad packets" tunable to off in e100 driver
* src: fix unsolicited promisc mode in e1000 driver
* src: add valectl to the system commands
@ -361,7 +472,7 @@ Here are the full patch notes against version 20.7-RC1:
* plugins: os-collectd 1.3 `[2] <https://github.com/opnsense/plugins/blob/master/net-mgmt/collectd/pkg-descr>`__
* plugins: os-zabbix5-proxy 1.3 `[3] <https://github.com/opnsense/plugins/blob/master/net-mgmt/zabbix5-proxy/pkg-descr>`__
* src: prevent netgraph page fault for LTE usage
* ports: dnsmasq 2.82 `[4] <http://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: dnsmasq 2.82 `[4] <https://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: monit 5.27.0 `[5] <https://mmonit.com/monit/changes/>`__
* ports: nss 3.55 `[6] <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes>`__
* ports: sudo 1.9.2 `[7] <https://www.sudo.ws/stable.html#1.9.2>`__

@ -0,0 +1,324 @@
===========================================================================================
21.1 "Marvelous Meerkat" Series
===========================================================================================
For more than 6 years, OPNsense is driving innovation through modularising
and hardening the open source firewall, with simple and reliable firmware
upgrades, multi-language support, HardenedBSD security, fast adoption of
upstream software updates as well as clear and stable 2-Clause BSD licensing.
21.1, nicknamed "Marvelous Meerkat", is the relentless continuation of
open source dedication. The last 6 years were not always easy, but we
are happy to be where we are now and have the community to thank for it.
New and improved are the firewall rules and NAT categories, the traffic
graphs supporting IPv6 along with a visual refresh, intrusion detection
rule management by policies, an alias for MAC addresses and NAT over IPsec
with all phase 2 you could ever want. Last but not least, the serial image
now supports UEFI as well.
For those wondering, the WireGuard plugin has been available since 2019 and
receives continuous improvements by its maintainer and various users alike.
And that is unlikey to change in the future. ;)
As we continue to deprecate custom configuration inputs for a number of
reasons, Dnsmasq has been switched to a pluggable file-based approach `[1] <https://docs.opnsense.org/manual/dnsmasq.html>`__
with Unbound to follow in the upcoming 21.7 series.
Download links, an installation guide `[2] <https://docs.opnsense.org/manual/install.html>`__ and the checksums for the images
can be found below as well.
* Europe: https://opnsense.c0urier.net/releases/21.1/
* US East Coast: http://mirrors.nycbug.org/pub/opnsense/releases/21.1/
* US West Coast: https://mirror.sfo12.us.leaseweb.net/opnsense/releases/21.1/
* South America: https://mirror.venturasystems.tech/opnsense/releases/21.1/
* Australia: http://mirror.as24220.net/opnsense/releases/21.1/
* Full mirror list: https://opnsense.org/download/
--------------------------------------------------------------------------
21.1 (January 28, 2021)
--------------------------------------------------------------------------
For more than 6 years, OPNsense is driving innovation through modularising
and hardening the open source firewall, with simple and reliable firmware
upgrades, multi-language support, HardenedBSD security, fast adoption of
upstream software updates as well as clear and stable 2-Clause BSD licensing.
21.1, nicknamed "Marvelous Meerkat", is the relentless continuation of
open source dedication. The last 6 years were not always easy, but we
are happy to be where we are now and have the community to thank for it.
New and improved are the firewall rules and NAT categories, the traffic
graphs supporting IPv6 along with a visual refresh, intrusion detection
rule management by policies, an alias for MAC addresses and NAT over IPsec
with all phase 2 you could ever want. Last but not least, the serial image
now supports UEFI as well.
For those wondering, the WireGuard plugin has been available since 2019 and
receives continuous improvements by its maintainer and various users alike.
And that is unlikey to change in the future. ;)
As we continue to deprecate custom configuration inputs for a number of
reasons, Dnsmasq has been switched to a pluggable file-based approach `[1] <https://docs.opnsense.org/manual/dnsmasq.html>`__
with Unbound to follow in the upcoming 21.7 series.
Download links, an installation guide `[2] <https://docs.opnsense.org/manual/install.html>`__ and the checksums for the images
can be found below as well.
* Europe: https://opnsense.c0urier.net/releases/21.1/
* US East Coast: http://mirrors.nycbug.org/pub/opnsense/releases/21.1/
* US West Coast: https://mirror.sfo12.us.leaseweb.net/opnsense/releases/21.1/
* South America: https://mirror.venturasystems.tech/opnsense/releases/21.1/
* Australia: http://mirror.as24220.net/opnsense/releases/21.1/
* Full mirror list: https://opnsense.org/download/
Here are the full patch notes against 20.7.8:
* system: use authentication factory for web GUI login
* system: allow case-insensitive matching for LDAP user authentication
* system: removed unused gateway API dashboard feed
* system: removed spurious comma from certificate subject print and unified underlying code
* system: harden web GUI defaults to TLS 1.2 minimum and strong ciphers
* system: generate a better self-signed certificate for web GUI default
* system: allow self-signed renew for web GUI default (using "configctl webgui restart renew")
* system: allow subdirectories in NextCloud backup (contributed by Lorenzo Milesi)
* system: first backup is same as current so ignore it on GUI and console
* system: optionally allow TOTP users to regenerate a token from the password page
* system: set hw.uart.console appropriately
* system: reconfigure routes on bootup
* system: relax gateway name validation
* system: ignore disabled gateways in dpinger services
* system: choose a better bind candidate for IPv4 in dpinger
* interfaces: defer IPv6 disable in interface code to ensure PPP interfaces do exist
* interfaces: no longer assume configuration-less interfaces can reach static setup code
* interfaces: fix PPP links not linking to its advanced configuration page
* interfaces: read deprecated flag, allow family spec in (-)alias calls
* interfaces: fix address removal in IPv6 CARP case
* interfaces: pick proper route for 6RD and 6to4 tunnels
* interfaces: support 6RD with single /64 prefix (contributed by Marcel Hofer)
* firewall: support category filters for firewall and NAT rules (sponsored by Modirum)
* firewall: add live log "host", "port" and "not" filters
* firewall: create an appropriate max-mss scrub rule for IPv6
* firewall: fix anti-spoof option for separate bridge interfaces
* firewall: display zeros and sort columns in pfTables (contributed by kulikov-a)
* firewall: relax schedule name validation
* reporting: prevent calling top talkers when no interfaces are selected
* reporting: cleanup deselected interface rows in top talkers
* dhcp: hostname validation now includes domain
* dhcp: use same logic as menu figuring out if DHCPv6 page is reachable from leases
* dhcp: correct DHCPv6 custom options unsigned integer field (contributed by Team Rebellion)
* dhcp: added toggle for disabling RDNSS in router advertisements (contributed by Team Rebellion)
* dhcp: removed the need for a static IPv4 being outside of the pool (contributed by Gauss23)
* dhcp: add min-secs option for each subnet (contributed by vnxme)
* dnsmasq: remove advanced configuration in favour of plugin directory
* dnsmasq: use domain override for static hosts
* firmware: disable autoscroll if client position differs
* firmware: remove spurious \*.pkgsave files and offload post install bits to rc.syshook
* firmware: repair display of removed packages during release type transition
* firmware: add ability to run audits from the console
* firmware: show repository in package and plugin overviews
* intrusion detection: replace file-based policy changes with detailed filters
* ipsec: NAT with multiple phase 2 (sponsored by m.a.x. it)
* ipsec: prevent VTI interface to hit spurious 32768 limit
* ipsec: allow mixed IPv4/IPv6 for VTI
* openvpn: added toggle for block-outside-dns (contributed by Julio Camargo)
* openvpn: hide "openvpn_add_dhcpopts" fields when not parsed via the backend
* unbound: allow /0 in ACL network
* unbound: default to SO_REUSEPORT
* web proxy: add GSuite and YouTube filtering (contributed by Julio Camargo)
* mvc: do not discard valid application/json content type headers
* mvc: make sure isArraySequential() is only true on array input
* mvc: speed up processing time when over 2000 users are selected in a group
* mvc: add locking in JsonKeyValueStoreField type
* mvc: change LOG_LOCAL4 to LOG_LOCAL2 in base model
* images: use UFS2 as the default for nano, serial and vga
* images: support UEFI boot in serial image
* ui: add tooltips for service control widget
* ui: move sidebar stage from session to local storage
* ui: upgrade Tokenize2 to v1.3.3
* plugins: os-acme-client 2.3 `[3] <https://github.com/opnsense/plugins/blob/master/security/acme-client/pkg-descr>`__
* plugins: os-bind 1.16 `[4] <https://github.com/opnsense/plugins/blob/master/dns/bind/pkg-descr>`__
* plugins: os-frr 1.21 `[5] <https://github.com/opnsense/plugins/blob/master/net/frr/pkg-descr>`__
* plugins: os-maltrail 1.6 `[6] <https://github.com/opnsense/plugins/blob/master/security/maltrail/pkg-descr>`__ (contributed by jkellerer)
* plugins: os-smart adds cron jobs for useful actions (contributed by Jacek Tomasiak)
* plugins: os-telegraf 1.8.3 adds ping6 ability (contributed by DasSkelett)
* src: fix AES-CCM requests with an AAD size smaller than a single block
* src: introduce HARDEN_KLD to ensure DTrace functionality
* src: refine pf_route\* behaviour in PF_DUPTO case for shared forwarding
* src: assorted upstream fixes for ipfw, iflib, multicast processing and pf
* src: netmap tun(4) support adds pseudo addresses to ethernet header emulation (contributed by Sunny Valley Networks)
* src: add a manual page for axp(4) / AMD 10G Ethernet driver
* src: fix traffic graph not showing bandwidth when IPS is enabled
* ports: dnsmasq 2.83 `[7] <https://www.thekelleys.org.uk/dnsmasq/CHANGELOG>`__
* ports: igmpproxy 0.3 `[8] <https://github.com/pali/igmpproxy/releases/tag/0.3>`__
* ports: nss 3.61 `[9] <https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.61_release_notes>`__
* ports: openldap 2.4.57 `[10] <https://www.openldap.org/software/release/changes.html>`__
* ports: py-netaddr 0.8.0 `[11] <https://pypi.org/project/netaddr/0.8.0/>`__
* ports: sudo 1.9.5p2 `[12] <https://www.sudo.ws/stable.html#1.9.5p2>`__
The public key for the 21.1 series is:
.. code-block::
# -----BEGIN PUBLIC KEY-----
# MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtiv4C8TPBnVAxUS+xW3W
# uYhAOuLCZPA6F22Qatit4PVHI7AzfLbGjCQFZqjO+HRPVCmeiyggQWE4ZBOQrhbq
# Em/NqmnDVos2rdGfEvp5miY4fstebtHI9CPv26QswgO7bsoJuCUoSmtGTbgNXyaF
# ueNYTSXNEpWu35tQS830NCLW5Y6elfK99gxmNChlGdlz0wchaSA+myR6xH+TUw8L
# D+87Tny/R2guC9Q0XnsKpKeOMxkNh0X3H0GsmcWmyV0rGAiMh6GuJXIN/yhNMkaD
# wuHomqxd1OAyGLz9BjDNRKZ+b+y0iVpEx3qsDWlradtf8sUKZHJ96lf0jCRhEPvl
# v1+QkAOzsauWBr3UtFbkKfHONpuwb5XVNgAJzFIRrnGhmWRXD7liiShOP4O+KBP1
# Dzxs/X0plXgX2hOgzMbtgCMj4M1sV5HhKUrwiyqBpoe5nESJVrQ/DxETwEZIFoHy
# hwQxd/DDp7uJmZlCkveuZeUAo7pfTUVchDpe2GB54bHEhIn3OES93PURMQtQxB12
# mubV52vcfvzLnbv5FL5lMK/cgl64ip2bRu1jcB3wsKrKcGyUbtYJQDnHpowWrs5h
# RdMHSfLyaC8ROMKhZmJTe141wr5p8d+NmgjlDblnNmUJ0jHVJeP0+RO/OcY/o3Zt
# 2MxL1Yp2cUu2l1HEmyrCsIcCAwEAAQ==
# -----END PUBLIC KEY-----
.. code-block::
# SHA256 (OPNsense-21.1-OpenSSL-dvd-amd64.iso.bz2) = 936301cb53c7c3474171a076594bb00a29827b4aa1c9aa8dac7519e447f7ec81
# SHA256 (OPNsense-21.1-OpenSSL-nano-amd64.img.bz2) = e5116c5037f4b4bbc68708e8f14ce023508ccf585164b778d6c158f170ea202f
# SHA256 (OPNsense-21.1-OpenSSL-serial-amd64.img.bz2) = 472c8568d8c4a54743b3a2b1bc720e83c04cc2c63d68df1376c207f25b98ae20
# SHA256 (OPNsense-21.1-OpenSSL-vga-amd64.img.bz2) = 44a930151472954626c237a1255712e6e7c542d7ac3c5317a74618d08ce36bbf
--------------------------------------------------------------------------
21.1.r1 (January 13, 2021)
--------------------------------------------------------------------------
For more than 6 years, OPNsense is driving innovation through modularising
and hardening the open source firewall, with simple and reliable firmware
upgrades, multi-language support, HardenedBSD security, fast adoption of
upstream software updates as well as clear and stable 2-Clause BSD licensing.
We thank all of you for helping test, shape and contribute to the project!
We know it would not be the same without you. <3
Download links, an installation guide `[1] <https://docs.opnsense.org/manual/install.html>`__ and the checksums for the images
can be found below as well.
* Europe: https://opnsense.c0urier.net/releases/21.1/
* US East Coast: http://mirrors.nycbug.org/pub/opnsense/releases/21.1/
* US West Coast: https://mirror.sfo12.us.leaseweb.net/opnsense/releases/21.1/
* South America: https://mirror.venturasystems.tech/opnsense/releases/21.1/
* Australia: http://mirror.as24220.net/opnsense/releases/21.1/
* Full mirror list: https://opnsense.org/download/
Here are the full patch notes against 20.7.7_1:
* system: use authentication factory for web GUI login
* system: allow case-insensitive matching for LDAP user authentication
* system: removed unused gateway API dashboard feed
* system: removed spurious comma from certificate subject print and unified underlying code
* system: harden web GUI defaults to TLS 1.2 minimum and strong ciphers
* system: generate a better self-signed certificate for web GUI default
* system: allow self-signed renew for web GUI default (using "configctl webgui restart renew")
* system: allow subdirectories in NextCloud backup (contributed by Lorenzo Milesi)
* system: optionally allow TOTP users to regenerate a token from the password page
* system: set default certificate lifetime to 397 days
* system: relax gateway name validation
* system: display destination port number in firewall log widget (contributed by Team Rebellion)
* system: allow to recover from bad TLS certificate and/or bad settings in console interface assign
* interfaces: defer IPv6 disable in interface code to ensure PPP interfaces do exist
* interfaces: no longer assume configuration-less interfaces can reach static setup code
* interfaces: fix PPP links not linking to linked advanced configuration
* firewall: add live log "host", "port" and "not" filters
* firewall: add manual refresh button to live log
* firewall: create an appropriate max-mss scrub rule for IPv6
* firewall: fix anti-spoof option for separate bridge interfaces
* firewall: relax schedule name validation
* firewall: fix typo in ICMPv6 validation
* firewall: add type 128 to outgoing IPv6 RFC4890 requirements
* firewall: fix minor regression in maintaining target alias file
* firewall: category selector missing caption
* firewall: fix all state value in pfTop (contributed by Lucas Held)
* firewall: remove duplicated destination field in live log
* firewall: add read-only actions to aliases permission (contributed by Manuel Faux)
* reporting: add top talkers to revamped traffic graphs page
* dhcp: hostname validation now includes domain
* dhcp: correct DHCPv6 custom options unsigned integer field (contributed by Team Rebellion)
* dhcp: removed the need for a static IPv4 being outside of the pool (contributed by Gauss23)
* dhcp: add min-secs option for each subnet (contributed by vnxme)
* dhcp: fix sorting of IPv6 static mappings (contributed by vnxme)
* dnsmasq: remove advanced configuration in favour of plugin directory
* dnsmasq: use domain override for static hosts
* firmware: opnsense-code now updates the current directory if nothing was specified
* firmware: opnsense-code now uses flexible make.conf target from tools.git
* firmware: opnsense-update now supports snapshot access via -z option
* firmware: opnsense-update now fixes missing dependencies on the fly
* firmware: repair display of removed packages during release type transition
* firmware: fix some issues with missing repository on server
* firmware: add version output and date to audit logs
* intrusion detection: replace file-based policy changes with detailed filters
* ipsec: NAT with multiple phase 2 (sponsored by m.a.x. it)
* ipsec: prevent VTI interface to hit spurious 32768 limit
* ipsec: allow mixed IPv4/IPv6 for VTI
* ipsec: display remote host in status overview (contributed by garlic17)
* openssh: honour MAX_LISTEN_SOCKS to prevent startup failure
* openvpn: added toggle for block-outside-dns (contributed by Julio Camargo)
* openvpn: hide "openvpn_add_dhcpopts" fields when not parsed via the backend
* openvpn: set default certificate lifetime to 397 days in wizard
* unbound: default to SO_REUSEPORT
* web proxy: add GSuite and YouTube filtering (contributed by Julio Camargo)
* web proxy: lock ACL download to prevent duplicate execution
* mvc: make sure isArraySequential() is only true on array input
* mvc: speed up processing time when over 2000 users are selected in a group
* mvc: allow underscore in filter string (contributed by kulikov-a)
* images: use UFS2 as the default for nano, serial and vga
* images: support UEFI boot in serial image
* ui: add tooltips for service control widget
* ui: move sidebar stage from session to local storage
* plugins: os-bind 1.15 `[2] <https://github.com/opnsense/plugins/blob/master/dns/bind/pkg-descr>`__
* plugins: os-frr 1.21 `[3] <https://github.com/opnsense/plugins/blob/master/net/frr/pkg-descr>`__
* src: fix OpenSSL NULL pointer de-reference `[4] <https://www.freebsd.org/security/advisories/FreeBSD-SA-20:33.openssl.asc>`__
* src: fix AES-CCM requests with an AAD size smaller than a single block
* src: introduce HARDEN_KLD to ensure DTrace functionality
* src: fix partial scrub of multicast packages
* src: refine pf_route\* behaviour in PF_DUPTO case for shared forwarding
* src: assorted upstream fixes for ipfw, iflib, multicast processing and pf
* ports: libressl 3.2.3 `[5] <https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.2-relnotes.txt>`__ `[6] <https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.3-relnotes.txt>`__
* ports: nss 3.60.1
* ports: pkg fix for shell keyword by opening root file descriptor
* ports: radvd 2.19 `[7] <https://radvd.litech.org/CHANGES.txt>`__
* ports: sudo 1.9.4p2 `[8] <https://www.sudo.ws/stable.html#1.9.4p2>`__
Known issues and limitations:
* Installer currently advertises 20.7
The public key for the 21.1 series is:
.. code-block::
# -----BEGIN PUBLIC KEY-----
# MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtiv4C8TPBnVAxUS+xW3W
# uYhAOuLCZPA6F22Qatit4PVHI7AzfLbGjCQFZqjO+HRPVCmeiyggQWE4ZBOQrhbq
# Em/NqmnDVos2rdGfEvp5miY4fstebtHI9CPv26QswgO7bsoJuCUoSmtGTbgNXyaF
# ueNYTSXNEpWu35tQS830NCLW5Y6elfK99gxmNChlGdlz0wchaSA+myR6xH+TUw8L
# D+87Tny/R2guC9Q0XnsKpKeOMxkNh0X3H0GsmcWmyV0rGAiMh6GuJXIN/yhNMkaD
# wuHomqxd1OAyGLz9BjDNRKZ+b+y0iVpEx3qsDWlradtf8sUKZHJ96lf0jCRhEPvl
# v1+QkAOzsauWBr3UtFbkKfHONpuwb5XVNgAJzFIRrnGhmWRXD7liiShOP4O+KBP1
# Dzxs/X0plXgX2hOgzMbtgCMj4M1sV5HhKUrwiyqBpoe5nESJVrQ/DxETwEZIFoHy
# hwQxd/DDp7uJmZlCkveuZeUAo7pfTUVchDpe2GB54bHEhIn3OES93PURMQtQxB12
# mubV52vcfvzLnbv5FL5lMK/cgl64ip2bRu1jcB3wsKrKcGyUbtYJQDnHpowWrs5h
# RdMHSfLyaC8ROMKhZmJTe141wr5p8d+NmgjlDblnNmUJ0jHVJeP0+RO/OcY/o3Zt
# 2MxL1Yp2cUu2l1HEmyrCsIcCAwEAAQ==
# -----END PUBLIC KEY-----
Please let us know about your experience!
.. code-block::
# SHA256 (OPNsense-21.1.r1-OpenSSL-dvd-amd64.iso.bz2) = c6cfdd88227bb58c94634dca01e9108647a83278a4549291a4b772094342c81a
# SHA256 (OPNsense-21.1.r1-OpenSSL-nano-amd64.img.bz2) = a60c3cb077b56202d3b02637054607f6180121b7da9faaf870f73a814dcfc2c7
# SHA256 (OPNsense-21.1.r1-OpenSSL-serial-amd64.img.bz2) = cba8578d7acbb323fd1fa6fe93d648c5d227010e1169ccbdf1111980d73fa447
# SHA256 (OPNsense-21.1.r1-OpenSSL-vga-amd64.img.bz2) = 1fce48c99e5c46d92fca7a00805873154832357c7de71f5035a01ca8047041dc
Loading…
Cancel
Save