2.2.5 New Features and Changes

Security/Errata Notices

User Management/Authentication

  • Added support for GUI auth from RADIUS to obtain group names from the RADIUS reply attribute “Class” as a string (local groups must exist, similar to LDAP). #935

  • Added an LDAP server timeout field to address GUI access issues when the LDAP server is down/unreachable. #3383

  • Added support for LDAP RFC 2307 style group membership. #4923

  • Worked around a chicken-and-egg problem in user syncing which was preventing users from using ssh the first time the account was saved. #5152

  • Prevent deletion of system users and groups by authenticated, authorized users using manually crafted POSTs. #5294

OpenVPN

  • Fixed an incorrect netmask being sent to OpenVPN clients with static IP addresses set in RADIUS. #5129

  • Changed the calculation of the OpenVPN point-to-point server IP address obtained from RADIUS to be consistent with CSC/Overrides (Server should be one IP address below the Client)

IPsec

  • strongSwan upgraded to 5.3.3. strongSwan’s change log

  • Fixed missing DH group 22-24. #4918

  • Fixed handling of IPv4 IPsec Phase 1 endpoints that resolve to an IPv6 address. #4147 (Fixed by strongSwan update to 5.3.3)

  • Brought back “auto” IKE version and fixed problems with its previous implementation.

  • Pre-shared keys configured as “any” under VPN>IPsec, Pre-Shared Keys tab are added as %any to ipsec.secrets now, as described in the note on the page. #5246

  • Resolved memory leak by switching printf hooks to vstr. #5149

  • Change to vstr to fix memory leak broke SMP status plugin. Switched to vici for status output.

  • ID selectors omitted from ipsec.secrets for mobile PSK+XAuth configurations. Fixes pre-shared key mismatches with Apple iOS Cisco IPsec and other mobile clients. #5245

  • Fixed logging default settings and ability to set logging to silent. #5340

  • Logging settings applied correctly on clean start and stop/start of service. #5242

  • Remove deleted CAs, certificates and CRLs from strongswan configuration. #5238

  • Prevent over-matching of auto-added firewall rules for mobile IPsec configurations. #5211

  • Added IPv6 virtual address pool support for mobile. #5284

  • Allow both IPv4 and IPv6 in phase 2 entries on a single phase 1 when using IKEv2. #5305

  • Omit NAT rules for disabled phase 1 and 2 configurations. #5320

  • Only display certificate authority field for methods where it’s relevant. #5323

  • Only write out CA certificates for those specified in a Phase 1 configuration. #5243

  • Fixed Hybrid RSA + xauth. #5207

  • Fixed configuration of split tunnel attribute. #5327

  • Specify rightca in ipsec.conf where relevant. #5241

  • Specify leftsendcert=always in ipsec.conf for mobile profiles using IKEv2 to better accommodate iOS and macOS manual configurations. #5353

  • Fix IKEv2 mobile client pool status display with small number of active leases

Rules/NAT

  • Fixed handling of url_port alias types when processing items that should be handled by filterdns. #4888

  • Fixed handling of line endings when parsing a URL table ports file.

  • Fixed handling of empty bogon lists on NanoBSD.

  • Fixed handling of 6rd rules so they are only added when there is an IPv4 IP defined for the gateway, otherwise the ruleset ends up invalid. #4935

  • Added support for port ranges on Outbound NAT. #5156

  • Added a check to prevent renaming an alias to an existing name. #5162

  • Improved the fix for increasing the “self” table size in pf.

  • Imported fixes from FreeBSD for a situation that could result in a panic/crash due to source address limits in pf rules (“pf_hashsrc: unknown address family 0”). #4874

Captive Portal

  • Implemented an alternate method to find VIP targets that should be allowed for Captive Portal. #4903

  • Improved handling of the captive portal database files for zones in cases when the database files may be corrupt or unreadable. #4904

  • Improved handling of vouchers that are too short. In certain cases they were not being properly rejected. #4985

  • Fixed handling of voucher database files, initializing the database properly when necessary. #5113

  • Fixed loading of allowed hostnames at boot time. #4746, #5345

Packages

  • Fixed handling of package install errors and connect timeouts during the install process. #4884

  • Improved package version comparison. #4924

  • Fixed an issue with package editing where the default value was not being populated for new fields.

  • Fixed removal of syslog.conf entries during package uninstall #5210

DHCP

  • Fixed handling of DHCP pools that are out of range, preventing them from creating an invalid dhcpd configuration. #4878

  • Added support for UEFI network booting with arch 00:09. #5046

  • Fixed a situation where dhcpleases could miss updates for hostnames in the leases file, delaying functional hostname resolution of new and updated DHCP leases. #4931

  • Automatically add firewall rules to permit DHCP traffic when DHCP Relay is enabled, matching the behavior for DHCP Server. #4558

Interfaces

  • Fixed identification of IPv6 interfaces with PPP-type interfaces and DHCP6 #3670

  • Removed “Could not find gateway for interface…” log messages as they were largely useless. #4102

  • Added OpenVPN interfaces to the list of available interfaces when reassignment is necessary during config.xml restoration.

  • Fixed interface assignment menus running off VGA screen.

  • Fixed preservation of MLPPP settings when saving interface settings. #4568

  • Correct handling of SLAAC, DHCP6 and DHCP-PD with PPP interfaces. #5297

Dynamic DNS

  • Fixed Cloudflare support for Dynamic DNS updates.

  • Fixed GratisDNS support for hosts without subdomains.

  • Disabled DHS provider. It had never worked.

  • Fixed IPv4 dynamic DNS registrations on dual stack hosts to providers with AAAA records. #3858

  • Update Dynamic DNS using gateway groups upon enable and disable of gateways. #5214

  • Fixed Dynamic DNS using gateway groups specifying a CARP IP. #4990

Misc

  • Fixed the configuration version comparison in XMLRPC sync to prevent more invalid synchronization cases. #4902

  • Cleaned up old unused platforms referenced in a few areas of the code that were no longer relevant.

  • Fixed killing of individual states in cases when the source and destination were reversed. #4907

  • Fixed killing of individual states for IPv6. #4906

  • Changed the “enableallowallwan” script to also allow bogons, which makes the use of RFC 5735 / RFC 6890 test networks easier in lab environments.

  • Fixed handling of VIPs in source address selection for Diagnostics > Test Port. #4986

  • Updated status.php to include more information. #5304

  • Fixed handling of the description in Traffic Shaping.

  • Fixed pfSense base version comparison. #4925

  • Fixed handling of multiple notices in the same second. #4879

  • Removed the routed service as it is being handled by the package.

  • Set MIME type for SVG in lighttpd configuration.

  • Improved handling of the cron service reconfiguration process.

  • Added option to display monitor IP on Gateways widget #4782

  • Added “Description” as a display option on Traffic Graphs. #4783

  • Fixed handling of L2TP server interface selection. #4830

  • Added /usr/bin/dc back into the build. #5111

  • Fixed a crash/panic “Sleeping thread owns a non-sleepable lock” in ARP code when using Proxy ARP type VIPs. #4685

  • Added support for Sierra Wireless 7355. #4863

  • Updated time zones. #5254

  • Added fsync of Unbound’s root.key to ensure the file isn’t corrupted if power is lost shortly after writing of the file. Code added to detect corrupt root.key and delete and recreate it. #5334

  • Fix changing outbound NAT modes and uploading/downloading files on exec.php with non-English languages. #5342, #5343

  • Associate intermediate internal CA certificates with the signing CA. #5313