OPNsense business edition 21.4.1 released

[franco]

This business release is based on the OPNsense 21.1.5 community version
with additional reliability improvements.

The OpenVPN advisory tracked as CVE-2020-15078 does not affect the provided
version 2.4.11, but the security audit will falsely flag it as vulnerable
because the source of the audit is FreeBSD where OpenVPN was migrated to 2.5
series already.

Here are the full patch notes:

o system: lighttpd include directory for configuration (contributed by Greelan)
o system: remove /dev/crypto GUI support
o system: add route address family return on dynamic gateway
o system: allow CPU temperature display in Fahrenheit in widget (contributed by Team Rebellion)
o system: performance enhancement for local_sync_accounts()
o system: move extensions out of a certificate DN (contributed by kulikov-a)
o system: fix restore copy in console recovery
o interfaces: treat deprecated addresses as non-primary
o interfaces: improve guess_interface_from_ip() (contributed by vnxme)
o firewall: resolve IP addresses in kernel for force gateway rule
o firewall: use tables in the shaper to avoid breaking ipfw with too many addresses
o firewall: clarify help text for firewall rules traffic direction (contributed by Greelan)
o firewall: sticky filter-rule-association setting for none/pass on copied items
o firewall: copy and paste for alias content (contributed by kulikov-a)
o firewall: improve loopack visibility
o reporting: format 24 hour timestamps in traffic graphs and widget
o dhcp: add dhcpd_staticmap() and fix DHCPv6 leases page with it
o dhcp: add "none" option to gateway setting of static mappings
o firmware: separate update error for "forbidden"
o firmware: update error if upstream core package is missing yet installed
o firmware: opnsense-patch now also invalidates the menu cache
o installer: migrate to scripted solution using bsdinstall
o ipsec: validation to prevent saving of route-based tunnels with "install policy" set
o ipsec: automatic outbound NAT rules missed mobile clients
o ipsec: fix typo in autogenerated rules for virtual IP use
o unbound: prefer domain list over host file format (contributed by Gareth Owen)
o rc: attempt to create /tmp if it does not exist
o rc: add opensolaris module load for ZFS
o rc: reverse list on stop action
o ui: prevent autocomplete in the quick navigation
o plugins: os-bind 1.17[1]
o plugins: os-chrony 1.2[2]
o plugins: os-debug 1.4 changes debugging profile to new version
o plugins: os-freeradius 1.9.11[3]
o plugins: os-haproxy 3.2[4]
o plugins: os-intrusion-detection-content-et-open 1.0
o plugins: os-maltrail 1.7[5]
o plugins: os-netdata 1.1[6]
o plugins: os-nginx 1.22[7]
o plugins: os-nginx expected MIME type fix (contributed by Kimotu Bates)
o plugins: os-smart 2.2 JSON conversion (contributed by Arnav Singh)
o plugins: os-telegraf 1.10.0[8]
o plugins: os-theme-rebellion 1.8.7 (contributed by Team Rebellion)
o plugins: os-wireguard 1.6[9]
o plugins: os-zabbix5-proxy 1.4[10]
o src: axgbe: check for IFCAP_VLAN_HWTAGGING when reading descriptor
o src: axgbe: add 1000BASE-BX SFP support
o src: accept_filter: fix filter parameter handling[11]
o src: vm_fault: shoot down multiply mapped COW source page mappings[12]
o src: mount: disallow mounting over a jail root[13]
o src: em: add support for Intel I219 V10 device
o src: em: fix a null de-reference in em_free_pci_resources
o src: bsdinstall: switch to OPNsense branding
o src: race condition in aesni(4) encrypt-then-auth operations[14]
o ports: curl 7.77.0[15]
o ports: dnsmasq 2.85[16]
o ports: expat 2.4.1
o ports: hyperscan 5.4.0[17]
o ports: monit 5.28.0[18]
o ports: nettle 3.7.2
o ports: phpseclib 2.0.31[19]
o ports: pkg 1.16.3

Stay safe,
Your OPNsense team

--
[1] https://github.com/opnsense/plugins/blob/stable/21.1/dns/bind/pkg-descr
[2] https://github.com/opnsense/plugins/blob/stable/21.1/net/chrony/pkg-descr
[3] https://github.com/opnsense/plugins/blob/stable/21.1/net/freeradius/pkg-descr
[4] https://github.com/opnsense/plugins/blob/stable/21.1/net/haproxy/pkg-descr
[5] https://github.com/opnsense/plugins/blob/stable/21.1/security/maltrail/pkg-descr
[6] https://github.com/opnsense/plugins/blob/stable/21.1/net-mgmt/netdata/pkg-descr
[7] https://github.com/opnsense/plugins/blob/stable/21.1/www/nginx/pkg-descr
[8] https://github.com/opnsense/plugins/blob/stable/21.1/net-mgmt/telegraf/pkg-descr
[9] https://github.com/opnsense/plugins/blob/stable/21.1/net/wireguard/pkg-descr
[10] https://github.com/opnsense/plugins/blob/stable/21.1/net-mgmt/zabbix5-proxy/pkg-descr
[11] https://www.freebsd.org/security/advisories/FreeBSD-SA-21:09.accept_filter.asc
[12] https://www.freebsd.org/security/advisories/FreeBSD-SA-21:08.vm.asc
[13] https://www.freebsd.org/security/advisories/FreeBSD-SA-21:10.jail_mount.asc
[14] https://www.freebsd.org/security/advisories/FreeBSD-EN-21:11.aesni.asc
[15] https://curl.se/changes.html#7_77_0
[16] https://www.thekelleys.org.uk/dnsmasq/CHANGELOG
[17] https://github.com/intel/hyperscan/releases/tag/v5.4.0
[18] https://mmonit.com/monit/changes/
[19] https://github.com/phpseclib/phpseclib/releases/tag/2.0.31