Software Update: OPNsense 20.7.3

The package OPNsense is a firewall with extensive opportunities. It is based on the FreeBSD operating system and is originally a fork of m0n0wall and pfSense. The package can be set up completely via a web interface and has support for 2fa, openvpn, ipsec, carp and captive portal, among others. In addition, it can apply packet filtering and has a traffic shaper. The developers have released OPNsense 20.7.3 with the following announcement:

OPNsense 20.7.3 released

Today is the day for a number of FreeBSD security advisories and a few reliability fixes. We are still testing a batch of Netmap improvement patches with a separate kernel. This and the Realtek vendor driver update will likely follow in the next kernel update. All feedback is welcome.

Here are the full patch notes:

• system: use different shell gateway name to appease wizard
• system: simplify CARP hook
• interfaces: phase out netaddr.eui.ieee.OUI_REGISTRY_PATH usage
• firewall: add MAC type to top right filter selection
• firewall: fix two scrub rule parsing bugs
• firewall: omit group type interfaces in filter selection
• intrusion detection: re-create rule cache after rule deployment
• unbound: add “unbound-plus” section to XMLRPC sync
• dhcp: adding DDNS values ​​of each additional pool to the $ddns_zones array
• dhcp: add static interface mode to router advertisements
• rc: fix ssh key permissions on MSDOS import
• rc: support service identifier in pluginctl -s mode
• plugins: os-bind download link changes
• plugins: os-chrony 1.0
• plugins: os-dnscrypt-proxy blocklist script fixes
• plugins: os-frr 1.17
• plugins: os-postfix 1.17
• plugins: os-rspamd 1.10
• plugins: os-theme-cicada 1.25 (contributed by Team Rebellion)
• plugins: os-theme-tukan 1.23 (contributed by Team Rebellion)
• plugins: os-theme-vicuna 1.1 (contributed by Team Rebellion)
• plugins: os wireguard 1.3
• plugins: os-zabbix-agent 1.8
• src: fix FreeBSD Linux ABI kernel panic
• src: fix SCTP socket use-after-free
• src: fix dhclient heap overflow
• src: fix ure device driver susceptible to packet-in-packet attack
• src: fix bhyve privilege escalation via VMCS access
• src: fix bhyve SVM guest escape
• src: fix ftpd privilege escalation via ftpchroot
• src: set PAX_HARDENING_NOSHLIBRANDOM in the RTLD by default
• src: fix kernel panic while trying to read multicast stream
• ports: mpd 5.9
• ports: nss 3.57
• ports: php 7.3.22
• ports: pkg 1.15.6