OPNsense Community Edition Updates & Release Notes

This release is mainly for the brave Hyper-V users who fought kernel panics since 26.7, which got fixed in 26.7.6 only to cause segmentation faults for others. Thanks all for testing and correcting the problem in FreeBSD!

The other reason are fixes in the new interfaces settings API so that it more closely matches the behaviour of the legacy page.

Both the iPerf and the FRR plugin have been reworked substantially. In case of FRR please read the migration notes linked below before updating.

Here are the full patch notes:

• interfaces: add missing validation for “configurable” and “spoofmac” in new settings API
• interfaces: only store “dhcp6_norequest_dns” in DHCPv6 mode in new settings API
• interfaces: only store “track6-interface” in ID association / Track interface modes in new settings API
• interfaces: do not render “none” to configuration in new settings API
• interfaces: move promiscuous mode to advanced in new settings API
• interfaces: fix index into $todo for proper flag check during apply in new settings API
• interfaces: provide better option group labels to DeviceField
• interfaces: add proper local/remote IP support to PPPoE IPCP
• interfaces: move legacy apply cache to /var/lib/php/tmp
• firewall: destination NAT: fix typo in parseRdrRules() causing faulty rules not being disabled
• firewall: aliases: validate that port aliases always have content
• firewall: revert a clone rule change so that cloned rules to appear adjacent to the original rule again
• mvc: UidField: add isolated updateValue() for installer user
• ui: bootgrid: sync columnselect-input state with (un)setColumns
• ui: sync expanded state for selected submenus
• ui: close mobile menu when a menu entry opens another tab of the current page (contributed by Greelan)
• plugins: os-ddclient 1.33
• plugins: os-frr 2.0
• plugins: os-iperf 2.0
• src: pf: send syncookies from the receiving thread
• src: hyperv: fix two regressions in previous upstream patch
• src: pcib: only apply ARI translation to the own secondary bus of a bridge
• src: ktls CBC decrypt: avoid creating zero length iovec entries
• src: route/fib_algo: respect immediate_sync in fd_ref_nhop
• src: route/fib_algo: fix FIB_ALGO without ROUTE_MPATH option
• src: sysctl: retire SYSCTL_NODE_CHILDREN()

Original source

This update finally brings interface settings to MVC/API! It also brings a number of fixes and improvements from FreeBSD stable/15 including a fix for previous Hyper-V boot issues and hopefully also fixes ice driver DDP issues with newer firmware versions.

For the interface settings MVC/API there a few things to keep in mind:

• You can find them on the assignments page integrated into the existing grid.
• Commonly required DHCP advanced options not in basic mode have been made available.
• Advanced/file based modes for DHCP are gone and will reset on save.
• Saving settings queues them for reconfiguration and storage.
• A reboot without apply will discard the previously saved changes.
• Apply works similar to the old interfaces.php page but uses a rewritten backend sequence.
• The old interfaces.php page is still available retaining the old style settings.
• The old interfaces.php page will likely move to a plugin for 27.1.

We are looking for your feedback on this historic milestone!

Here are the full patch notes:

• system: use correct type for IP when killing active states in “lockout_handler” (reported by Omar Habra of Apex Security Research)
• system: reject a null gateway in getGatewayAction()
• system: add “latency_avg” as sanity check for running dpinger
• system: missing chown in backup call for proper non-root web GUI access
• system: do not allow system scope users to be renamed
• reporting: unbound: add DNSSEC status column in details grid
• interfaces: add interface configuration settings in new assignments page
• interfaces: prevent interface_configure() from reloading non-interface hooks when in batch mode
• interfaces: improve queue build sequence in interfaces_dependencies()
• interfaces: remove stale VIP address after update (contributed by ExpRam)
• interfaces: be more conservative with -no_dad
• interfaces: add a new ‘updateip’ hook
• firewall: aliases: reject reversed port ranges
• firewall: destination NAT: fix destination for no-rdr rules (reported by fa1k3)
• firewall: destination NAT: add safety guards for calculated port ranges
• ipsec: add “replay_window” option to children
• monit: log from the first line and reconfigure through the base class (contributed by IvanTheGeek)
• openvpn: default keepalive to “10 60” in server mode and improve validation
• bootgrid: upgrade Tabulator to version 6.5.3
• mvc: disable Nginx reverse proxy buffering on configd streams
• mvc: dispatch failed message during reconfiguredAction()
• mvc: PortField: keep the first well-known service in the option list (contributed by fa1k3)
• mvc: PortField: always return a string for normalizedPort()
• mvc: UidField: allow an arbitrarily specified UID for system scope users upon creation
• ui: do not add the spinner again when it fails
• plugins: add error returns to plugins_configure()
• plugins: os-ndp-proxy-go 1.5
• src: sysvsem: heap out-of-bounds access in semop(2)
• src: ktls: remote DoS via receive-side kernel TLS
• src: udp: IPv6 UDP sendto(2) bypasses jail loopback restriction
• src: vfs: multiple jail filesystem root escapes
• src: openssl: out-of-bounds read in OpenSSL DTLS retransmission
• src: kqueue: memory safety bugs in kqueue copy-on-fork implementation
• src: syslogd: fix leaking child processes when logging to a pipe
• src: iflib: do not hold the ifnet lock across registration
• src: ixgbe: correct Wake-on-LAN configuration
• src: dummynet: do not overflow the points[ED_MAX_SAMPLES_NO] array
• src: pf: mark non-port packets to require IP checksumming
• src: pf: set the correct type for rule timeouts
• src: loopback: improve checksum offloading
• src: vlan: use the exclusive lock everywhere
• src: routing: initialize V_rt_numfibs earlier during boot
• src: raw ip: clear sin_port on bind(2)
• src: nd6: fix regeneration of temp addresses in detached state
• src: hyperv: fix single page invalidation path
• src: route/fib_algo: fix nexthop index collision across families
• src: ice: do not leave device non-functional if Tx scheduler config fails
• src: netipsec: fix V_spd_size updates
• src: bnxt: assorted updates from stable/15
• src: ixl: assorted updates from stable/15
• src: linxkpi: assorted updates from stable/15
• src: net80211: assorted updates from stable/15
• src: pci: assorted updates from stable/15
• ports: ca_root_nss / nss 3.130
• ports: expat 2.8.5
• ports: pcre2 10.49
• ports: phalcon 5.22.1
• ports: php 8.5.11
• ports: py-duckdb 1.5.6

Original source

This update fixes a few security related things and updates to OpenSSL 3.5.9. We are also updating the package manager to version 2.8.4 to sync up with the current version being used in FreeBSD.

The default password hash changes from bcrypt to argon2id. If you wish to benefit from this change your hashed passwords need to be changed. Note that this step is optional. All bcrypt-hashed passwords will continue to work.

The firewall outbound NAT page moves to the legacy plugin. Note that you can still migrate your rules without the plugin installed via the migration assistant and the outbound rules will continue to work even when the legacy plugin is not installed.

Since work on the interface settings API is progressing nicely, there is also work being done on the backend which is already featured in this release. It is now possible to debug the interface ordering sequence at boot, which will also help bring in more optimizations in the near future.

Here are the full patch notes:

• system: clear password change session flag only after password was changed (reported by Wu Wenhao)
• system: change diag.disk to return total bytes as well as formatted bytes
• system: fix HA service restart with “id” parameter set
• system: add webgui PAM config to test with opnsense-login
• system: switch password hashing from bcrypt to argon2id
• interfaces: refactor interfaces_loopback_configure() and add ::1/128 sync
• interfaces: fix PHP warnings in interfaces.php and do not write unset options
• interfaces: fix linter complaints in WLAN model, 11a typo and wpa_pairwise labels
• interfaces: dhclient handles keywords case-insensitive so properly match all “media” invokes (reported by Alice-Sabrina-Ivy)
• interfaces: refactor interfaces_ppps_hardware() and avoid emitting serial device nodes
• interfaces: allow to push $all_plugins in interface_configure()
• interfaces: retire problematic validations in interface settings pertaining to legacy ISC-DHCP plugin
• interfaces: stricter archive command in backend for packet capture download
• interfaces: split out interfaces_dependencies() and make it digestible via pluginctl -Q
• firewall: outbound NAT moves to legacy plugin
• firewall: remove handling loopback addresses as “private”
• firewall: fix expiry cron job default when alias TTL is smaller than 1 hour
• firewall: use font-awesome elements for data tree controls to align with themes
• firmware: opnsense-patch: added -R mode and updated -N mode
• firmware: opnsense-prefetch: get remote size and print mismatches
• firmware: opnsense-prefetch: curl use is now optional
• firmware: add simple prompt to console changelog viewer
• kea: add ping check settings for subnet configuration (contributed by laozhoubuluo)
• monit: change “logfile” to “log” to fix syntax on newer daemon
• acl: fix patterns for gateway groups (contributed by Andrew Ferk)
• acl: merge the Dhcrelay log file pattern into the main ACL
• bootgrid: exclude header cells from status color rendering
• mvc: guard direct config saves against user-config-readonly (contributed by Andrew Ferk)
• ui: remove defunct content-box-main usage
• ui: make settings-changed trigger overridable
• ui: fix blank bottom UI space (contributed by Konstantinos Spartalis)
• plugins: os-ddclient 1.32
• plugins: os-firewall-legacy 1.1
• plugins: os-net-snmp 1.7
• plugins: os-puppet-agent 2.0
• plugins: os-sftp-backup 1.2 verify backups after put
• plugins: os-theme-cicada 1.42 (contributed by Greelan)
• plugins: os-theme-tukan 1.32 (contributed by Team Rebellion)
• plugins: os-theme-vicuna 1.52 (contributed by Team Rebellion)
• ports: openssl 3.5.9
• ports: phalcon 5.22.0
• ports: pkg 2.8.4

Original source

Today we are rolling out the wireless device MVC/API rework and a final push for better source NAT replacement over outbound NAT.

StrongSwan was updated to 6.1.0 and the GUI now offers a small recommended set of post-quantum key exchanges.

You may also find the GUI tweaks for advanced option marker and a dialog search field helpful.

There is a lot more going on as you can see from this changelog, but more on this and future plans later!

Here are the full patch notes:

• system: audit log injection via login username in auth_log()
• system: add pfsync version 1500 to HA settings (contributed by Bjoern Jakobsen)
• system: add hidden services so they can be operated by pluginctl -s
• system: privlege separated reload in static PHP pages
• system: lower priority of automatic wg/ipsec gateways
• system: fix disk widget loading issue (contributed by Konstantinos Spartalis)
• system: add back the service widget link
• system: make compare operator in authTOTP() more strict
• interfaces: migrate wireless configuration to MVC/API
• interfaces: return an empty string which cannot be an interface in convert_real_interface_to_friendly_interface_name()
• interfaces: ppp-ipv6.php may be executed before later stages of interface_configure()
• interfaces: provide “uuid” in legacy_config_get_interfaces()
• interfaces: split media and mediaopt with tabs instead of spaces
• interfaces: a few config_read_array() replacements
• interfaces: refactor device matching around interface_parent_devices()
• interfaces: remove cua matching from PPP device pattern
• firewall: source NAT: add pool options and source hash key
• firewall: source NAT: fix port alias and well known port usage in target_port
• firewall: make source and destination NAT automatic rules visible in GUI
• firewall: implement JsonAuditField in all MVC components
• firewall: update the internally reserved pf keywords for FreeBSD 15
• firewall: add source NAT migration banner to outbound NAT
• firewall: add private network exclusions to default IPv6 bogons (contributed by Maurice Walker)
• dnsmasq: leases sorting fixes (contributed by Greelan)
• firmware: opnsense-bootstrap: fix bootstrap on FreeBSD 15 with pkgbase
• firmware: opnsense-prefetch: new tool for sets prefetching
• firmware: opnsense-sign: shell compatibility update
• firmware: adjust the incompatible pkg test
• firmware: disable FreeBSD-base repository and remove old definitions
• intrusion detection: fix displaying URL in descriptions (contributed by Konstantinos Spartalis)
• ipsec: add some hybrid post-quantum variants as additional key exchange
• kea: fix leases sorting (contributed by Greelan)
• openvpn: moved legacy CARP hook to os-openvpn-legacy plugin
• acl: fix API patters for GIF/GRE device settings
• acl: add missing and fix some issues (contributed by Konstantinos Spartalis)
• backend: add CLOEXEC to a few file descriptor opens to avoid lock inheritance
• mvc: advanced marker for form/dialog fields
• mvc: fix stale imports for Message classes
• mvc: JsonAduditField: shared implementation for configuration revision tracking
• rc: add watchdog to shutdown, reboot and reload_all cases
• ui: fix widget bottom gap in standard theme files (contributed by Konstantinos Spartalis)
• ui: sidebar fixes and rework (contributed by Team Rebellion)
• ui: remove spurious _formDialog portion of dialog IDs
• ui: implement dialog search field
• ui: ensure a minimum amount of rows to render in grids
• plugins: os-acme-client 4.17
• plugins: os-theme-rebellion 1.9.8 (contributed by Team Rebellion)
• plugins: os-turnserver 1.4
• src: ciss: revert patch that added max physical target
• src: pf: do not set a null rule pointer during test
• src: pf: fix securelevel off-by-one
• src: pfctl: fix printing of wildcard anchors
• src: e1000: more assorted upstream patches from stable/15
• src: ixgbe: assorted upstream patches from stable/15
• src: virtio_p9fs: disallow detach if a session is in progress
• src: route/fib_algo: free leaked radix_masks in radix_lockless
• src: netipsec: implement pr_disconnect for PF_KEY sockets
• src: iflib: assorted upstream patches from stable/15
• src: net: add ifmedia support for 10GBase-BX BiDi
• src: bnxt: report initialization failures to iflib
• src: bnxt: add led(4) identification support
• src: ice: add led(4) identification support
• src: ice: report initialization failures to iflib
• src: ice: add support for E835 CNSA 2.0 adapters
• src: ice: add two more 4-part IDs for E835 adapters
• src: if_vxlan: fix panic by validating unused drvspec values
• src: qat: driver updates to enhance qat infrastructure
• src: ath10k: remove some early FreeBSD-specific debugging
• src: ip(6)_mroute: assorted upstream patches from stable/15
• src: in_mcast: fix uninitialized variable usage in inm_merge()
• src: bind: lookup local address in current FIB if ‘*.bind_all_fibs’ is active
• src: net: add fib-aware ifa_ifwithaddr()
• ports: ca_root_nss / nss 3.129
• ports: curl 8.22.0
• ports: dhcp6c fix for truncated env vars in dhcp6c-script (contributed by Michael Zimmermann)
• ports: expat 2.8.4
• ports: filterlog 0.9 support for pflog actions on FreeBSD 15
• ports: libxml 2.15.4
• ports: openldap 2.6.15
• ports: pcre2 10.48
• ports: php 8.5.10
• ports: phpseclib 3.0.57
• ports: strongswan 6.1.0

A hotfix release was issued as 26.7.4_1:

• ui: only schedule grid dimension changes after data processing, window resizing and table visibility changes
• ports: suricata 8.0.7
• ports: unbound 1.26.1

Original source

Here is your biweekly dose of bugfixes and quality of life improvements! This update offers several new features: VLANs on bridges, “received-on” firewall rule support, persistent rule label tracking, repeatable WireGuard QR codes, menu favourites and full screen grid support. On top of that it bundles the recent FreeBSD 15.1-RELEASE-p3, fixes and cleanups as well as third party updates such as OpenSSL 3.5.8 and OpenSSH 10.5p1. Enjoy. :)

Meanwhile, development is busy with adding interface settings to the new MVC assignments page, which includes building wireless MVC/API support. That is all for now. Need to get back to work.

Here are the full patch notes:

system

• offer post-quantum mldsa44-ed25519 OpenSSH server host key
• do not regenerate all OpenSSH key files when adding new key types
• truncate long names in services dashboard widget (contributed by circa1665)
• use created user name for change event (contributed by Julian Pawlowski)
• handle missing objects during deletion in API (contributed by Julian Pawlowski)
• multiple PHP warning fixes (contributed by Julian Pawlowski)
• avoid filter_configure() calls to make existing backend call less obscure
• add favorites section to menu (contributed by Greelan)
• approximate user being expired for the grid view icon
• replace cron restart in static PHP pages
• fix server certificate purpose detection for EC

interfaces

• permit a VLAN device as bridge member
• resolve VLAN devices indirectly via interfaces_configure()
• handle missing GRE and GIF during deletion in API (contributed by Julian Pawlowski)
• multiple PHP warning fixes (contributed by Julian Pawlowski)
• emit discovered hosts sorted by last_seen via hostwatch

captive portal

• exclude IPv4 from roaming logic

dhcrelay

• add options for circuit_id and remote_id (contributed by Thomas Cheyney)

dnsmasq

• remove count badge from GroupBy with static configuration elements
• add “expand-hosts” option (contributed by Konstantinos Spartalis)

firewall

• remove 2a10::/12 from bogonsv6.sample (contributed by Belgarion)
• deprecate old rule register function names due to functional overlaps
• add missing TLS ports to well-known ports (contributed by Self-Hosting-Group)
• use new “rlabel” from pfctl for persistent rule identification across reloads
• emit gateway debug message in block rules only when gateway is not empty
• aliases: use same dynamic label as in KEA DHCPv6 for a unified look
• aliases: fix spinner on alias dialog save button
• destination NAT: make local-port numeric before applying range in registered firewall rule (contributed by Thomas Cheyney)
• rules: add “received-on” interface keyword as interface origin option
• rules: promote “statetype” from advanced to common option for “received-on” usage

firmware

• revoke 26.1 fingerprint

kea

• remove count badge from GroupBy with static configuration elements
• use DOM construction for the “dynamic” label

network time

• strict security GUI support

unbound

• update Hagezi blocklists to use new mirror URL

wireguard

• FreeBSD 15 no longer allows addresses without netmasks
• cleaner QR codes (contributed by Roy Orbitson)
• preserve peer generator state for existing peers

mvc

• BaseField: add getInitialValue()
• OptionField: fix simplified option group definition
• fix typo in base_form.volt advanced/help toggle IDs
• fix assorted stale imports in the code base

ui

• tabulator: add _showMaximized() modal that can show a grid close to full screen
• add keyboard shortcut “f” to maximize a currently visible grid
• scope “all help” and “advanced mode” toggle to closest relevant form
• trigger “h” and “a” keyboard shortcuts on all relevant matches

plugins

• os-caddy 2.2.1
• os-frr 1.55
• os-theme-rebellion 1.9.7 (contributed by Team Rebellion)

src

• posixshm: fix a TOCTOU race in the FIOSSHMLPGCNF handler
• tty: revalidate after dropping the tty lock in ioctl handlers
• ppp: fix multiple vulnerabilities
• openssl: fix multiple vulnerabilities
• cred: fix group_is_primary()
• dsp: fix a potential use-after-free in dsp_oss_syncstart()
• unix: fix some bugs in the SOCK_STREAM receive path
• hwpmc: fix the execve handler
• ucode: fix validation on Intel platforms
• netmap: fix driver name handling
• netmap: fix a race in kqueue registration
• e1000: assorted upstream patches from stable/15
• route: add an eventhandler for rt_numfibs changes
• rawip: fix handling of checksums in rip6_input()
• pf: attempt to handle overlapping group and interface names
• pf: check if a group has a kif before dereferencing it
• pf: fix fallout from the STATE_LOOKUP macro removal
• pf: re-optimize state key handling
• pf: rule label patch was merged from a wrong version
• pfsync: handle large MTU pfsync interfaces
• ktls: propagate EPG_FLAG_ANON to mapped mbufs
• netipsec: fix sockaddr type set in ipcomp6_nonexp_encapcheck()
• src: PF_KEY socket: limit the length of copied socket address
• ure: add USB device IDs for additional RTL8152/RTL8153 adapters
• ure: fix spurious link flaps from MII

ports

• ca_root_nss / nss 3.127
• expat 2.8.3
• kea 3.0.4
• monit 6.0.0
• openssh 10.5p1
• openssl 3.5.8
• perl 5.42.3
• phalcon 5.20.3
• php 8.5.9
• rrdtool 1.11.0
• sqlite 3.53.4

hotfix release 26.7.3_2

• interfaces: add missing PPP support to interface_parent_devices()
• firewall: source NAT: fix faulty import removal

hotfix release 26.7.3_8

• system: normalize output of get_nameservers()
• interfaces: prevent inline reloads of VLANs via rc.linkup
• interfaces: batch VIP post-reload for proxyarp/pfsync
• monit: use LIBXML_NOCDATA on XML fetch
• ui: improve form matching for help/advanced
• ui: fix _showMaximized() height calculation when mobile navigation triggers below 768px width

hotfix release 26.7.3_11

• system: flush volt template cache in shared action
• interfaces: exclude VLAN devices from virtual queue
• ui: attach selectors piped through replaceInputWithSelector to body
• ports: openvpn 2.7.7

Original source

This update addresses the WireGuard MAC authentication issue people have been talking about, 4 core security advisories and the usual volume of quality of life improvements and bug fixes. We are currently improving the compatibility with the legacy pages in full privilege separation, working on feature parity between Outbound NAT and Source NAT and will also provide a road map in the next weeks for 27.1. Stay tuned.

Here are the full patch notes:

Patch notes

• system: use /var/lib/php/tmp in static pages for proper privilege separation
• system: improve “user-config-readonly” in static pages where write_config() was denied
• system: service widget changes based on further community feedback
• system: support 7680 bit RSA type for certificates and authorities
• system: add redirection capability to SSO provider
• reporting: correctly map NetFlow indexes when there are gaps (contributed by Thomas Cheyney)
• reporting: improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
• reporting: make parsing iftop lines more robust for traffic graphs (contributed by Brendan Bank)
• reporting: map ARC and laundry to cache memory stats (contributed by Konstantinos Spartalis)
• reporting: stop NetFlow service before reloading configuration
• interfaces: fix assignment of wireless devices
• interfaces: strict description fields in new assignments page
• interfaces: fix typos in GIF reconfiguration script
• interfaces: add “noclamp” flag for GIF
• interfaces: add separate link types for IPv4 and IPv6 in overview
• interfaces: return the proper UUID when assigning an interface (contributed by Kemoy Campbell)
• interfaces: improve VIP page save when no subnet was posted
• firewall: use htmlSafe() on action search value in live log
• firewall: group invalid rules to the end of the ruleset
• firewall: enable virtualDOM and refactor commands on alias page
• firewall: add “endpoint-independent” support for UDP translations (full cone NAT) in source NAT
• firewall: fix missing well-known ports in local-port in destination NAT
• firewall: add “max-pkt-rate” rate limiting option to firewall rules
• firewall: add proper support for container items in search field selection, export and import data and implement it in destination NAT
• firewall: scope get action to general settings in source NAT
• kea: improve prefix watcher accuracy via both interface and MAC address key
• kea: store subnet IDs inside the model so they cannot shift during config regeneration
• kea: change dynamic pool range from prefix to range 1000-2000
• kea: switch custom DHCP option config generation to libdhcp_flex_option library
• openvpn: add some input validation for control characters in connection status
• backend: sanitize template filename replacements
• backend: further restrict actions to root and wwwonly for more sensitive actions
• backend: ensure strict templates are not reloaded via “*” wildcard
• mvc: add some missing htmlSafe() calls for generated HTML
• mvc: create runInterfaceRegistation() and use it for immediate device registration
• mvc: add some exception types and handle them in the base template
• mvc: clean up a number of stale imports
• mvc: translate backend system status messages
• mvc: translate grid view labels
• ui: add some more legacy_html_escape_form_data() safeguards
• ui: add tokenize2.css in standard theme to ensure selection in opnsense-auto theme
• ui: prevent blinking by hiding the contents while loading for opnsense-auto theme
• ui: fix collapsed sidebar stray line and restore rail divider in opnsense-dark theme (contributed by circa1665)
• ui: restore stacked layout for interfaces widget on narrow (contributed by circa1665)
• ui: fix minor JavaScript bugs in dashboard widget code (contributed by Thomas Schöpf)
• ui: do not freeze commands column on touchscreen devices
• ui: further fixes for base templates
• ui: fix empty legacy firewall menu container glitch
• plugins: os-caddy 2.2.0
• plugins: os-frr 1.54
• plugins: os-intrusion-detection-content-at-antiphishing 1.0
  (contributed by Julio Lira)
• plugins: os-ndp-proxy-go 1.4
• plugins: os-nrpe 1.2
• plugins: os-theme-rebellion 1.9.6 (contributed by Team Rebellion)
• src: pf: add missing PF_TS_CNT netlink attribute
• src: pf: expose first rule label for states since rule number is insufficient
• src: usb: bpfattach() before if_attach()
• src: igc: disable PCIe ASPM to improve stability
• src: ena: update driver version to v2.8.4
• src: assorted minor commits from stable/15
• src: coredump: do not assume that the number of ELF segments is consistent
• src: sysvsem: fix a TOCTOU race in semctl()
• src: jail: restore ktrace privileges for jailed root
• src: ktimer: check for errors from realtimer_gettime()
• src: kqueue: avoid enqueuing an already-enqueued knote
• src: zfs: multiple fixes
• src: tzdata: import 2026c
• src: wg: check for crypto operation errors
• src: revert “daemon: replace memchr with memrchr”
• ports: dpinger 3.6
• ports: hostapd / wpa_supplicant 2.12
• ports: nss 3.126
• ports: openldap 2.6.14
• ports: openssh 10.4p1
• ports: openvpn 2.7.6
• ports: phalcon 5.18.2
• ports: py-duckdb 1.5.5
• ports: python 3.13.15
• ports: unbound 1.26.0

A hotfix release was issued as 26.7.2_2:

• unbound: switch AAAA-only mode from respip to block_a_wdata (contributed by Maurice Walker)
• ui: bootgrid: classname can depend on state, accept a callback function

Original source

This is a small stable release addressing some of the upgrade related issues that were reported last week as well as 4 new security advisories for the core code.

Here are the full patch notes:

• system: add correct release name to boot splash screen for 26.7
• system: disable web GUI KTLS use for the time being
• system: do not let the components selectpicker grow indefinitely in defaults page
• system: DTLSv1.1 is forcefully rejected by OpenSSL 3.5, migrate to DTLSv1.2
• system: use Bootstrap “btn” styles in services widget
• system: use serialNumberHex for CRL so high-bit serials are not dropped (contributed by chrstnth)
• system: lower max-request-size to roughly max post size in lighttpd configs (reported by lujiefsi)
• system: fixed several PHP 8.5 warnings
• firewall: use “urgent” as empty default for firewall debug messages
• firewall: skip message banner if searchPhrase set
• firewall: fix PHP warning when scrub yields no interfaces
• captive portal: automatic block rule should be evaluated after the anti-lockout rule
• openvpn: client export can export private keys for unlisted certificate references (reported by iys8 and lujiefsi)
• backend: remove cache file on execution error in script_output
• mvc: fix tab/subtab form generation for plugins
• mvc: fix default labels in selectpickers
• mvc: form labels can be empty so make sure to add them to avoid warnings in forms
• mvc: safeguard some write operations with missing throwReadOnly() actions for custom action (reported by lujiefsi)
• ui: fix multiple stored XSS (reported by lujiefsi)
• plugins: os-theme-rebellion 1.9.5 (contributed by Team Rebellion)
• ports: ca_root_nss / nss 3.125

A hotfix release was issued as 26.7.1_1:

• system: fix default gateway switch alarm trigger being overwritten by gateway group check
• ports: pecl-mcrypt 1.0.9

Original source

For over 11 a half years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, fast adoption of upstream software updates, modern IPv6 support, as well as clear and stable 2-Clause BSD licensing.

26.7, nicknamed “Xenial Xenops”, features interface assignments and gateway groups via MVC/API, firewall rules now defaulting to MVC/API, outbound NAT to source NAT migration assistant, captive portal IPv6 support, Kea DDNS/custom options/dynamic prefix delegation, FreeBSD 15.1, OpenSSL 3.5, OpenVPN 2.7, PHP 8.5, Python 3.13, plus much more.

The upgrade path for 26.1 will likely be unlocked later today. We want to ensure the upgrade goes as smoothly as possible so please be patient! :)

Download links, an installation guide and the checksums for the images can be found below as well.

• Europe:
• US East Coast:
• US West Coast:
• South America:
• East Asia:
• Full mirror list:

Here are the full patch notes:

• system: remove periodic backups settings and backend code
• system: migrate gateway groups to MVC/API
• system: new service widget flat tile layout (partially contributed by Konstantinos Spartalis)
• system: make LDAP auth adhere to bad login penalty as well (contributed by Matt Andreko)
• system: move ldap_escape() to caller for now to avoid side effects
• system: improve the log_archive script to also work on log subdirectories
• system: change our version of “certctl” to emit files instead of links like it is the case in FreeBSD 15.1
• system: include interfaces widget in dashboard default
• system: adjust dashboard widget resize logic to observe border box instead of content box
• reporting: migrate several settings pages to MVC/API and assorted changes
• reporting: do not show disabled interfaces in traffic graphs (contributed by Konstantinos Spartalis)
• interfaces: migrate interface assignments to MVC/API
• interfaces: fix faulty netmask on loopback address due to upstream change
• firmware: remove overzealous cleansing in output_cmd to unhide individual character progress
• firewall: move config.xml default LAN allow rules to new rules GUI
• firewall: legacy rules pages move to plugin
• firewall: restrict automatic DHCPv6 filter rules to plugin/track6 use
• firewall: always set a sequence at the end of the rule set when cloning a NAT rule
• firewall: remove unused “safepoint” actions
• firewall: fix automatic source NAT rules not displayed for PPPoE interfaces
• firewall: flatten automatic source NAT rules into two per WAN type interface
• firewall: prevent deletion if a group is referenced in MVC rules
• firewall: constraint source NAT getAction() to only general page and align setAction() accordingly
• firewall: use proper path for one-to-one NAT rules for renaming operations
• firewall: avoid emitting reply-to on block rules as well
• firewall: change interface group render/apply order
• firewall: adjust MVC alias rename according to address_to_pconfig()
• firewall: adapt getAdvancedIds() to the sectioned form structure
• firewall: invalidate rule stats cache for firewall utilities API endpoint
• captive portal: move template actions out of the ServiceController into its own TemplateController
• captive portal: adjust accounting interval to Acct-Interim-Interval
• dnsmasq: possible use before define in lease watcher
• intrusion detection: rename “uncategorized” rule package to “adult” (contributed by Konstantinos Spartalis)
• monit: fix mail-format and poll-time validation
• unbound: missing NetMaskAllowed=N on override address
• wireguard: add allowed-ips to reresolve-dns.py in case none are set yet
• acl: merge user management ACLs into one single privilege
• backend: allow “strict” mode +TARGETS using the preamble “!”
• backend: swap “strict” template logic as it was reversed
• mvc: refactor base_dialog and parseFormNode() to simplify the template
• mvc: remove unused argument from getFormGrid()
• mvc: BaseField: emit descriptions in getNodes() when they are not the same as the value to match getNodeContent()
• mvc: PortField: reject whitespaces in port ranges during validation
• mvc: ModelRelationField: remove grouped option handling
• mvc: add file type to forms
• ui: add “opnsense-auto” theme which switches between “opnsense” and “opnsense-dark” depending on browser setting
• ui: decrease flashing in opnsense-auto theme when switching (contributed by Konstantinos Spartalis)
• ui: remove direct apply_btn_id usage in favour of base_apply_button template partial
• ui: fix menu registration not setting “active”
• plugins: os-firewall-legacy 1.0 contains the static PHP firewall rules pages
• plugins: os-ndproxy has been removed, use os-ndp-proxy-go instead
• src: FreeBSD 15.1-RELEASE-p1 plus assorted stable/15 networking commits
• src: pf: do not mangle IP header before shared forwarding
• src: pf: stop resolving hosts via DNS that use “:” modifier
• src: pf: clear anchor after stepping into it in pf_match_translation_rule()
• src: pf: pf_route() “dst” no longer holds the gateway in 15.x
• ports: libevent 2.1.13
• ports: lighttpd 1.4.85
• ports: openssl 3.5.7
• ports: openvpn 2.7.5
• ports: sqlite 3.53.3
• ports: suricata 8.0.6

Migration notes, known issues and limitations:

• The privileges “page-system-groupmanager” and “page-system-usermanager-addprivs” were merged into “page-system-groupmanager” and are no longer available separately. This was done to avoid the misconception that access to a user management page gives constrained rights to each page, but that is not the case. User management is a process involving all 3 pages.
• The static PHP pages for firewall rule management have been moved to the “os-firewall-legacy” plugin which can be manually installed before or after the upgrade. All rules will continue to work regardless of the plugin being installed or not and are easily migrated using the given assistant.
• Hyper-V guests may be producing panics on certain hosts with more than one virtual processor assigned. Make sure to snapshot beforehand and stay on 26.1.x until the situation is clear.
• Since this is a major OS upgrade and OpenSSL changes from 3.0 to 3.5 third party repositories may interfere with your upgrade experience. Removing offending repositories and plugins may help; or wait for affirmation from the respective repository owners.
• The CPU microcode early loading has been known to be flaky on some setups. A fix is in the FreeBSD 15.1 boot loader code, but can only be reached by reinstall or manually updating the boot code of your system after the upgrade succeeded. If you want to be on the safe side during the upgrade itself please remove the plugin before proceeding.

The public key for the 26.7 series is:

# -----BEGIN PUBLIC KEY-----
# MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAziSNKuzrL2cwLx5LXmLn
# cWS5Lk+iCzRMXO/4xQYBQCaSnd8GBg/HA/g4aPoTUa6ovAI0AHfW8KQJQyBkFzn
# pi6MLZJ9tEaFcn0CiV+tSTJd1RV4bB8jtpKl5oTkgFrPsyaB7iBlG5Cd49VCW19h
# DxClQ24lkWkVoYfsfCQEt4ADNGLygWCPyf4bxGD/t6/tiW9SsOs2+gfOZ9C/G2d/
# EBhJFoBEoz5lvULVxTdfY5PScYrHD/waZnk3rGc2A+9pI/SM2JAwKqsgZ6MSFbXO
# DNocSjqFUUkdqhty+Qcc0OJ+hMbKKVE+f3QJBQIwT3ayys8QK0m5CCo91/f+DjoN
# noj+t5YN9x8GREkF0wrdIi7hevkwrL2/SJQbq1bL1BLB+mMSXYR611lgT8YfYjyZ
# 7tmpNVC3O5Pj7l20snm1lVUSqS0PsFBvh6HQtBRwQDGppaIIhH1Nt9yIatmSiGZt
# 2YrMVNBzbQrJzSX+vWcAulkaPIt4t+XxmpO5IDNZ+4uMZ7XyJq1lAhIeyXx+Falf
# v7S+ZpJWFVNz0/N5z6lBbADD855i+gFY6B5209xGyhd6FwaPOjISgQKkgBwF1AiW
# MDuTuP9lkh/U5gGBZIFTnbdEMgOAL4P+Hsw9Nozav+3QIpiU3Pv9F29a1erCkq09
# rpQyNglY7Jqme/RipzbYia8CAwEAAQ==
# -----END PUBLIC KEY-----

Stay safe, .. code-block:

# SHA256 (OPNsense-26.7-dvd-amd64.iso.bz2) = 95cafedda6d5b22ce832e249dc2309110fbee19f813ad78cf28bb3d387186bfb
# SHA256 (OPNsense-26.7-nano-amd64.img.bz2) = 28d5e2f37e40d87468a924e3006ef10e2ddc6de485b85333d9e3958c84d0cb9d
# SHA256 (OPNsense-26.7-serial-amd64.img.bz2) = 259b441646f1b0d77075a7281e368fe7f4c980360498ed6bc23740bd83c67e32
# SHA256 (OPNsense-26.7-vga-amd64.img.bz2) = d975ed876e0650f6a5bf30b2e97218c5eaa370bef6597b19f43e22c1b950d3fc

Original source

Summer challenges aside: 26.7 is almost here! It includes FreeBSD 15.1 and a somewhat small list of other highlights. The reason for that is a stringent backporting strategy that was employed in the 26.1 series.

Keep in mind this is an online-based pre-production test release. Upgrades from the 26.1.11 development version are already available. The final release date for 26.7 is July 15.

Here are the development highlights since version 26.1 came out:

• Interfaces assignments to MVC/API
• Gateway groups to MVC/API
• Firewall rules MVC page is now the default
• Source NAT is now a replacement for outbound NAT
• Captive portal IPv6 support
• Kea DDNS, custom options and dynamic prefix delegation support
• OpenVPN 2.7 with TLS-Crypt v2 support
• FreeBSD 15.1
• Python 3.13
• PHP 8.5

And these are the changes against version 26.7-RC1:

• system: include interfaces widget in dashboard default
• firewall: constraint source NAT getAction() to only general page and align setAction() accordingly
• firewall: use proper path for one-to-one NAT rules for renaming operations
• firewall: avoid emitting reply-to on block rules as well
• captive portal: adjust accounting interval to Acct-Interim-Interval
• firmware: remove overzealous cleansing in output_cmd to unhide individual character progress
• monit: fix mail-format and poll-time validation
• mvc: add file type to forms
• ports: suricata 8.0.6

A hotfix release was issued as 26.7.r2_3:

• interfaces: fix faulty netmask on loopback address due to upstream change
• firewall: change interface group render/apply order
• backend: swap “strict” template logic as it was reversed
• src: pf: do not mangle IP header before shared forwarding
• src: additional stable/15 networking patches

Original source

Summer challenges aside: 26.7 is almost here! It includes FreeBSD 15.1 and a somewhat small list of other highlights. The reason for that is a stringent backporting strategy that was employed in the 26.1 series.

Keep in mind this is mostly an image-based pre-production test release. Upgrades from the 26.1.11 development version will be available later this week. An online-only RC2 will probably follow as well. The final release date for 26.7 is July 15.

Here are the development highlights since version 26.1 came out:

• Interfaces assignments to MVC/API
• Gateway groups to MVC/API
• Firewall rules MVC page is now the default
• Source NAT is now a replacement for outbound NAT
• Captive portal IPv6 support
• Kea DDNS, custom options and dynamic prefix delegation support
• OpenVPN 2.7 with TLS-Crypt v2 support
• FreeBSD 15.1
• OPENSSL 3.5
• Python 3.13
• PHP 8.5

And these are the changes against version 26.1.11:

• system: remove periodic backups settings and backend code
• system: migrate gateway groups to MVC/API
• system: new service widget flat tile layout (partially contributed by Konstantinos Spartalis)
• system: make LDAP auth adhere to bad login penalty as well (contributed by Matt Andreko)
• system: move ldap_escape() to caller for now to avoid side effects
• system: improve the log_archive script to also work on log subdirectories
• system: change our version of “certctl” to emit files instead of links like it is the case in FreeBSD 15.1
• reporting: migrate several settings pages to MVC/API and assorted changes
• interfaces: migrate interface assignments to MVC/API
• firewall: move config.xml default LAN allow rules to new rules GUI
• firewall: legacy rules pages move to plugin
• firewall: restrict automatic DHCPv6 filter rules to plugin/track6 use
• firewall: always set a sequence at the end of the rule set when cloning a NAT rule
• firewall: remove unused “safepoint” actions
• firewall: fix automatic source NAT rules not displayed for PPPoE interfaces
• firewall: flatten automatic source NAT rules into two per WAN type interface
• firewall: prevent deletion if a group is referenced in MVC rules
• captive portal: move template actions out of the ServiceController into its own TemplateController
• dnsmasq: possible use before define in lease watcher
• intrusion detection: rename “uncategorized” rule package to “adult” (contributed by Konstantinos Spartalis)
• unbound: missing NetMaskAllowed=N on override address
• wireguard: add allowed-ips to reresolve-dns.py in case none are set yet
• acl: merge user management ACLs into one single privilege
• backend: allow “strict” mode +TARGETS using the preamble “!”
• backend: swap “strict” template logic as it was reversed
• mvc: refactor base_dialog and parseFormNode() to simplify the template
• mvc: remove unused argument from getFormGrid()
• mvc: BaseField: emit descriptions in getNodes() when they are not the same as the value to match getNodeContent()
• mvc: PortField: reject whitespaces in port ranges during validation
• mvc: ModelRelationField: remove grouped option handling
• ui: add “opnsense-auto” theme which switches between “opnsense” and “opnsense-dark” depending on browser setting
• ui: decrease flashing in opnsense-auto theme when switching (contributed by Konstantinos Spartalis)
• ui: remove direct apply_btn_id usage in favour of base_apply_button template partial
• ui: fix menu registration not setting “active”
• plugins: os-firewall-legacy 1.0 contains the static PHP firewall rules pages
• plugins: os-ndproxy has been removed, use os-ndp-proxy-go instead
• src: FreeBSD 15.1-RELEASE-p1 plus assorted stable/15 networking commits

Original source

Back already with a bag of security advisories also for FreeBSD which came out just yesterday. We highly appreciate the increased amount of reports we are getting for the core code and we are working through them, but need to improve our process and guidelines somewhat in order to make more sense of the result for all of you. This will probably take additional effort after 26.7 is out.

Note that this update brings the outbound to source NAT migration page, but it is only a formality as outbound NAT will stay in 26.7 although the legacy firewall rules page will move to a plugin during the major upgrade. It is the same process that was employed with ISC-DHCP. Due to this addition, however, the source NAT rules entered in the system will no longer work unless the mode is set to either “manual” or “hybrid”.

And thanks everyone for early 26.7-BETA testing! We are content to ship 26.7-RC1 early next week as a follow-up. The final release of 26.7 is planned for July 15.

Here are the full patch notes:

• system: configuration line injection via multiple GUI text fields (reported by lujiefsi)
• system: add missing legacy_html_escape_form_data() for $a_cert on administration settings (reported by Jonas Ampferl of Hacking Cult)
• system: lockout: address newline injection and correct IP parsing (reported by lujiefsi)
• system: add “local_uri” type in SanitizeFilter() and use it to avoid hardcoding
• system: several compatible adjustments for upcoming PHP 8.5
• system: fix ACL pattern for carp_status action (contributed by Etienne Girault)
• system: enhance live log widget (contributed by Greelan)
• firewall: safeguard ISO country codes in alias download (reported by Jonas Ampferl of Hacking Cult)
• firewall: escape user-controlled values in tooltip attributes (reported by Jonas Ampferl of Hacking Cult)
• firewall: add the same new rules GUI design to the MVC NAT pages
• firewall: add CSV download/upload to MVC NAT pages
• firewall: add migration for outbound NAT into source NAT page
• firewall: destination NAT: display effective port when local-port is omitted
• firewall: source NAT: allow empty target which means the interface address
• firewall: source NAT: skip rendering rules when mode is not advanced/manual or hybrid
• firewall: improve performance on MVC pages using virtualDOM
• firewall: allow WAN as “associated interface” for NPTv6 when prefix ID is set
• firewall: fix TypeError on alias getItem() with unknown UUID (contributed by haxorton)
• firewall: unify group names of OpenVPN, WireGuard and IPsec encapsulation
• firewall: show rule counts that can be exported and hide tab if no rules exist
• firewall: improve interface filter logic to include floating rules with multiple interfaces when they overlap with at least one interface in the interface filter request
• firewall: add validations for “No RDR” option to prevent target and local-port being set
• firewall: skip alias on new rules GUI apply
• interfaces: prohibit the use of advanced DHCP option settings by non-administrators
• interfaces: properly format API times to ISO format and convert timezone for display in automatic discovery
• captive portal: pass in ip_address as a set for accounting
• firmware: fix small glitch that re-prompts for showing community plugins
• kea: add widget to show DHCP leases
• kea: simplify model option values
• monit: use throwNotFullAdmin() to restrict monit GUI write access to full admins due to intended system wide execution rights
• network time: fix stored XSS in GPS init string display (reported by Jonas Ampferl of Hacking Cult)
• openvpn: prevent path traversal in “common_name” attribute (reported by lujiefsi)
• openvpn: escape client common_name in connection-status views (reported by Jan Kahmen of turningpoint and lujiefsi)
• openvpn: simplify model option values
• mvc: checkAndThrowValueInUse validate input token which may only contain alphanum and dashes (reported by Jonas Ampferl of Hacking Cult)
• mvc: guard BaseField::setNodes() against a list given for a scalar leaf (contributed by haxorton)
• mvc: DescriptionField: disable special and newline characters
• mvc: FileObject: fix exception bug (contributed by Greelan)
• mvc: also do not translate empty labels in grids
• mvc: give throwReadOnly() a sibling named throwNotFullAdmin()
• mvc: use camelCase for carp_status action
• ui: bootgrid: minor optimizations
• ui: add generic escaping function htmlSafe() for JavaScript
• plugins: os-cloudflared 1.1
• plugins: os-freeradius 1.10.2
• plugins: os-vnstat 1.4
• src: vm: use-after-free in device pager page list
• src: execve: local privilege escalation via execve(2) TOCTOU race
• src: openzfs: multiple vulnerabilities in OpenZFS
• src: libalias: bffer overflow in libalias RTSP handler
• src: unlinkat: unlinkat(2) ignores AT_RESOLVE_BENEATH flag
• src: tcp: use-after-free in TCP RACK stack option handler
• src: posixshm: multiple vulnerabilities in POSIX largepage objects
• src: audit: incorrect audit records for ptrace(2) syscall requests
• src: ktls: remote DOS via uninitialized memory access in KTLS receive
• src: linux: kernel stack disclosure in Linux compatibility layer
• src: iconv: multiple vulnerabilities in iconv(3)
• ports: curl 8.21.0
• ports: expat 2.8.2
• ports: ldns 1.9.2
• ports: lighttpd 1.4.84
• ports: phalcon 5.16.0
• ports: py-duckdb 1.5.4
• ports: syslog-ng 4.12.0

A hotfix release was issued as 26.1.11_3:

• system: hasPrivilege() not merging user privs correctly (reported by iys8)
• firewall: fix some small issues in menu registration for legacy pages
• monit: re-allow spaces in start, stop and condition

A hotfix release was issued as 26.1.11_5:

• firmware: support for patch release matching
• openvpn: add a specific regex constraint for static keys to fix previous safeguarding

A hotfix release was issued as 26.1.11_6:

• openvpn: further fix validation for auth token secret and static key

A hotfix release was issued as 26.1.11_10:

• firmware: remove overzealous cleansing in output_cmd to unhide individual character progress
• firmware: add fingerprint and upgrade hint for 26.7
• monit: fix mail-format and poll-time validation
• unbound: missing NetMaskAllowed=N on override address
• ports: openvpn 2.7.5
• ports: suricata 8.0.6

Original source

This update is the obvious answer to recent reports throughout the ecosystem

There are 3 core security issues fixed, FreeBSD security advisories, third party updates as well as assorted fixes plus improvements in the new rules GUI.

The firmware page had a number of minor regressions that should be sorted out with this release. They did not affect updates, but made the process a bit less smooth than usual. Be assured that each minor update is tested quite extensively, but non-functional issues like these can always slip through a test cycle and will be found in the next one. In the worst case that means two stable releases: the issues appeared with 26.1.8 but were not visible before 26.1.9 was being tested.

Under the hood the preparation for Source NAT migration, MVC/API support for interface assignments and FreeBSD 15.1 support is underway. We expect a 26.7-BETA in the near future once we are satisfied with the overall quality.

Here are the full patch notes

• system: routing: changed “disable” option to “enable”
• system: dashboard: explicitly compact on layout shift if there is no predefined layout
• system: dashboard: update result on default restore
• interfaces: parse ifconfig output despite exit error in legacy_interfaces_details()
• interfaces: hostwatch: pin warning banner to enabled flag
• firewall: always show automatic and legacy rules in new rules GUI
• firewall: add banner if no rules defined in new rules GUI to match legacy GUI
• firewall: use strnatcasecmp() for interface list in new rules GUI
• firewall: fix typo that prevented queues to be selectable in pf-based traffic shaping
• firewall: escape shaper targets in rule edit (contributed by lujiefsi)
• dnsmasq: change widget link from settings to leases page
• firmware: stop buffering in sed to fix chunked update log output
• firmware: retain ordering in update servers for connectivity check
• firmware: allow “local” business mirror subscription
• firmware: put clickable trailer for community plugins
• firmware: fix return value masking during updates
• firmware: opnsense-update: do not clean obsolete files on manual -r invokes
• intrusion detection: fix drop and alert buttons on rules tab
• ipsec: disable scroll in authentication and children grids (contributed by Konstantinos Spartalis)
• ipsec: validate the use of refid in CA certificates (reported by lujiefsi)
• kea: prevent converting the decimal prefix_id using hexdec() for dynamic PD
• openvpn: fix client export not showing common names
• openvpn: require an integer of at least 1 for “vpnid” field
• mvc: add new validators to TextField: AllowSpaces, AllowNewlines, AllowSpecial and introduce new StrictTextField
• mvc: strict alphanumeric-only regex for certificate refid (contributed by eev4n)
• mvc: simplify assorted option values to reduce duplication
• mvc: static header support for forms
• rc: move system_powerd_configure() to bootup plugin hook
• ui: bootgrid: allow column selection exclusions
• ui: allow passing of data attributes for select items in setFormData()
• ui: remove banner on inline reload if applicable
• ui: button padding when injecting next to apply button
• ui: fix spurious padding in apply button section (contributed by Konstantinos Spartalis)
• plugins: os-cloudflared 1.0 (contributed by Richard Aspden)
• plugins: os-frr 1.53
• plugins: os-rfc2136 1.10
• plugins: os-stunnel fix for missing include in script
• plugins: os-telegraf 1.12.15
• src: missing permission check in thr_kill2
• src: arbitrary file overwrite via the KTLS receive path
• src: multiple vulnerabilities in the sound mmap path
• src: sigqueue missing capability mode restriction
• src: use-after-free bug in the IPV6_MSFILTER socket option handler
• src: flaw in Linuxulator execution of setugid binaries
• src: ASLR bypass for setuid executables via procctl
• src: integer overflow in vt CONS_HISTORY ioctl
• src: openssl: fix multiple vulnerabilities
• src: ldns: fix query response validation
• src: netlink: fix lock leak in nl_find_nhop
• src: pf: avoid taking the pf rules write lock in a couple of ioctls
• src: ipfw: add ability to run ipfw binary with 15.0+ kernel module
• src: ipfw: treat ipv6 address with zero mask as “any”
• ports: dnsmasq 2.93
• ports: filterlog 0.8 changes rule label fetch to libpfctl
• ports: openssl 3.0.21
• ports: phalcon 5.14.2
• ports: py-duckdb 1.5.3
• ports: py-numpy 2.4.6
• ports: python 3.13.14
• ports: sqlite3 3.53.1
• ports: strongswan 6.0.7

Original source

As a sign of the times this update ships 3 core security fixes as well as OS and third party updates. Kea dynamic prefix delegation is also included plus more GUI improvements.

Time to 26.7 is short. See you soon! :)

Here are the full patch notes:

system

remove unused data-tooltip that is not properly escaped from certificates widget

fix passing null into getRealInterface()

fix regression in selective group delete introduced previously

allow unregistered plugin cron actions to be deleted

disable MAILTO for cron jobs

tighten landing page redirect (contributed by Konstantinos Spartalis)

reporting

render NaN values as empty values and omit leading empty records from data set for health graphs

add max on Y axis for traffic graphs

interfaces

dhclient.conf does not cope with multi-line request/require

account for multiple UUIDs in VIP deletion

more safe iteration through config_read_array()

fix wrong DUID-UUID format but keep accepting the wrong one

fix regression in selective device delete introduced previously

IAID selection and prefix range reservation for WAN DHCPv6

firewall

fix for missing HTML escape in description render in legacy rules GUI

add an alias formatter to show content fields as 7dynamic8 when populated by other components

fix Tabulator regression with alias batch delete

use safe config iteration in interface registration

fix unintended change in filtering logic for new rules GUI

fix action, ipprotocol and protocol translations for legacy rules in new rules GUI

use safe iteration over rules in filter_core_rules_user()

add missing exclamation mark for 7not8 in scrub rules

fix interface sorting by value for live log and groups

captive portal

remove redirection on HTTPS and ditch non-functional pass statement

dnsmasq

change DHCP tag to DescriptionField

ipsec

move swanctl.conf download button to the tab

restyle the connections page for clarity

kea

dynamic prefix delegation support

always start the prefix watcher when DHCPv6 is enabled

cleanups for IntegerField using isSet() and no negative numbers allowed

add decline_probation_period and set lower default to mitigate faulty client implementations to consume the whole pool

add subnet allocator field (contributed by Marcos Della)

add DHCPv4 compatibility options (contributed by Marcos Della)

hook up reservation.next_server (contributed by Ian Munsie)

fix missing visual cues for manual mode in DDNS and DHCPv4/6

monit

sanitize monit output before offering it

network time

cleanse port option before use (reported by Konstantinos Spartalis)

small cleanups in ntpd_configure_gps()

unbound

blocklists categorization and apply button message update (contributed by Konstantinos Spartalis)

acl

some missing references and using camelCase pointers instead of snake_case

mvc

add support for pluggable dynamic menu items and move some existing parts out of the MenuSystem class

stricter email address validation

OptionsField: use key as value if no value is set

unify migration message returns

do not translate empty strings

ui

clean up useRequestHandlerOnGet usage

use space in apply box for the apply reminder

improve form validation error append

tab exclusion for SimpleActionButton

split form button row render as some forms only use save

override selectpicker defaults for translations

hide apply button for specific tabs on multiple pages (contributed by Konstantinos Spartalis)

bootgrid

align datakey with the rest of the options, but allow top-level placement

mark state variables as such

safeguard replace() function

remove unused getTotalRowCount() method

prevent NaN pagination values for non-ajax grids when row count is set to all

clean up converter compatibility code

replace 7append8 with 7replace8 for ajax: false grids

adjust column persistence behavior to prevent horizontal dead space

plugins

use safe config iteration in interface registration code

os-tinc fixes evaluation of hosts enabled flag (contributed by Konstantinos Spartalis)

src

dhclient: improve server and filename validation

setcred: fix buffer overflow

kern: make sure to drain selinfo sleepers

fusefs: handle buggy server LISTXATTR response

ptrace: fix validation of PT_SC_REMOTE arguments

libcasper: switch from select(2) to poll(2)

cap_net: do not allow new limits to drop keys from the old ones

ipfw: fix parsing error in nat config port_range

ipfw: fix checksum after NAT

igmp: Avoid leaving dangling pointers in the state-change queue

vxlan: Update *m0 after a pullup

routing: use a better error number in sysctl_fibs()

routing: initialize V_rt_numfibs earlier during boot

pfsync: reject invalid SCTP states

pf: do not reject rules with colliding hashes

rtnetlink: check for allocation failure in nlattr_get_multipath()

rtnetlink: align RTA_MULTIPATH length validation in nlattr_get

ports

nss 3.124

openvpn 2.7.4

php 8.3.31

py-numpy 2.4.4

suricata 8.0.5

unbound 1.25.1

Original source

This updated fixes two recently reported vulnerabilities in the core code pertaining to WAN DHCPv4 configuration and user management. It also includes third party updates to Dnsmasq, OpenSSH and Unbound amongst others.

Captive portal IPFW accounting rules will regain a performance boost by bringing back hash lookups. Since this update does not issue a reboot by itself either do so or restart the captive portal instances to activate this change.

Here are the full patch notes:

system: properly escape username in sync_user.php command invoke (contributed by Konstantinos Spartalis)
system: fix XMLRPC sync with VIP and 7nosync8 option
system: link CA references after all changes
system: parse certificate 7key_type8 and 7digest8
system: allow flushing legacy OpenVPN legacy config
system: audit 7staticroute8 config access
system: use safe config iteration in core_user_changed_groups()

interfaces: safeguard DHCPv4 settings against arbitrary command injection (reported by Kchigo)
interfaces: add missing config locks in device controllers
interfaces: use safe iteration in backend code
interfaces: adjust and annotate interface_dhcpv6_id()

firewall: use save method from ApiMutableModelControllerBase for log command, move rule command and savepoint action
firewall: safe config access in list_legacy_rules.php
firewall: remove duplicated CSV button hook
firewall: fix NPTv6 validation for empty external subnet
firewall: make getRealInterface() a static utility function
firewall: refactor searchRuleAction() to use the same filtering and sorting logic on MVC and legacy data
firewall: fix inverted source/destination cosmetic issue in SNAT and One-to-One NAT grids

captive portal: re-introduce hash lookup for accounting purposes
captive portal: reload IPFW on captive portal reconfigure too

dnsmasq: ignore DHCP names for 7wpad8 to fix CERT Vulnerability VU#598349

firmware: opnsense-bootstrap: add 7-B8 bare bootstrap mode
firmware: add repo configuration output to connectivity audit

kea: plug socket into dynamic PD route installation script
kea: add prefix to reservations to allow for static PD allocations based on DUID/MAC
kea: infer IPv6 lease type in delete script via lease lookup so IA_NA/IA_PD can be deleted
kea: allow customizing 7mac_sources8 and change default to 7ipv6-link-local8
kea: add user-context object to config to emit description
kea: fix option_data_autocollect mismatch in DHCPv6 page
kea: enable internalModelSafeDelete due to increased model relation field usage
kea: build reservation status from control socket output
kea: add subnet vltime (partially contributed by Brandan Giles)
kea: add client-id to DHCPv4 reservations

network time: fix ACL definitions (contributed by Konstantinos Spartalis)

openvpn: reload configuration for group sync after successful authentication
openvpn: add tls-crypt-v2 support
openvpn: allow restart action via cron

radvd: allow to start a manual configuration without primary IPv6

unbound: minor style/refactor for safe config access
unbound: hide unused tree row in form output for overrides
unbound: restyle statistics page

wireguard: use getValues() consistently in control script

mvc: remove unused UIModelGrid imports in IDS, Monit and Syslog controllers
mvc: remove Util imports where not needed
mvc: BaseField: add count() helper
mvc: fix validation to use getValue instead of plain string cast
mvc: UIModelGrid: remove flatten() method as getFlatNodes() is almost the same

shell: safe iteration for VLAN/LAGG in port assignment
shell: use safe config iteration in live mode banner

ui: add static dialog header support and fix bool/string compare
ui: add type_formatter keyword to form rendering
ui: add save/cancel button support to form rendering
ui: remove 7event8 use from bootgrid showSaveAlert()

plugins: os-ddclient 1.31
plugins: os-frr 1.52
plugins: os-netbird 1.3
plugins: os-q-feeds-connector 1.6
plugins: os-turnserver 1.3

ports: curl 8.20.0
ports: dnsmasq 2.92rel2
ports: expat 2.8.1
ports: kea 3.0.3
ports: krb5 1.22.2
ports: libxml 2.15.3
ports: nss 3.123.1
ports: openssh 10.3p1
ports: phalcon 5.12.1
ports: py-duckdb 1.5.2
ports: py-requests 2.33.1
ports: unbound 1.25.0

A hotfix release was issued as 26.1.8_5:

interfaces: follow up on DHCPv4 settings sanitization
firewall: fix search for floating rules in new rules GUI
kea: use JSON_UNESCAPED_UNICODE when writing the JSON configuration
shell: fix syntax error in port assignment
ui: bootgrid: onRendered executed in wrong spot

Original source

This includes all very recent FreeBSD SA/EN patches, a number of system improvements (how are you doing, Kea!) and third party updates for OpenVPN and StrongSwan.

It also includes one high and one medium advisory for our code. GitHub has not issued a CVE for this yet, unfortunately, but this announcement will be updated as soon as that happens. See below for details.

Here are the full patch notes:

system

• protect popen() with exec_safe() (contributed by Konstantinos Spartalis)
• lockout bypass fix (contributed by Konstantinos Spartalis)
• refactor dashboard to use User model instead of direct config access
• throw UserException when dashboard size limit was reached on save
• add notes dashboard widget (contributed by Konstantinos Spartalis)
• allow gateway load balance weights from 1 to 10 for more flexibility (contributed by Matthew Hall)
• fix traffic dashboard widget initialization race condition (contributed by Greelan)
• avoid side effect rendering sysctl item in config.xml during console assignment
• improve cron command and parameter escaping
• add 7nosync8 option to gateway configuration
• support RADIUS NAS-IP-Address attribute for authentication
• add compatibility layer to future route disable/enable migration
• only split first colon when reading sysctls
• revisit snapshot name validation (partially contributed by Konstantinos Spartalis)

interfaces

• refactor bridge reconfigure script

firewall

• live view: decode HTML where necessary to aid filtering
• fix typo in alias update error log and make parser a bit more resilient

firmware

• opnsense-update: handle FreeBSD.conf disable internally

kea

• fix 7Delegated length must be longer than or equal to prefix length8 validation
• add ddns-override-no-update, ddns-override-client-update and ddns-update-on-renew per subnet
• add DDNS DNS server port can now be specified
• add explicit reverse DDNS zones support (contributed by XtraLarge)
• add DDNS manual config override
• remove depend constraint of ddns_reverse_zone

radvd

• allow user controlled hop limit (contributed by BPplays)

unbound

• improve hostname/domain override validation

backend

• configctl: properly quote parameters to avoid skipping empty ones (contributed by Majx)

lang

• numerous updates and fixes in existing languages

mvc

• introduce JSON field type and refactor dashboard to use it
• fixed a number of class import statements

shell

• config access refactor in password and setaddr scripts

ui

• generalize placeholders between controllers and JS
• improve user readability in SimpleFileUploadDlg()

plugins

• os-acme-client 4.16
• os-zabbix-agent 1.9
• os-zabbix-proxy 1.7

src

• vm_fault: reset m_needs_zeroing properly
• timerfd: Fix interval callout scheduling
• tty: avoid leaving dangling pointers in tty_drop_ctty()
• pkru: fix handling of 1GB largepage mappings
• contrib/tzdata: import tzdata 2025c, 2026a and 2026b
• amd64: fix INVLPGB range invalidation
• pf: improve SCTP validation
• execve: fix an operator precedence bug
• dhclient: check for unexpected characters in some DHCP server options
• dhclient: fix reallocation of dhclient script environments
• libnv: switch fd_wait() from select(2) to poll(2)
• libnv: fix heap overflow in nvlist_recv()
• libpcap: update to 1.10.6
• ipfw_nptv6: fix handling the ifaddr removal event
• if_tuntap: make SIOCIFDESTROY interruptible
• pfctl: parser must not ignore error from pfctl_optimize_ruleset()
• pf: fix duplicate rule detection for automatic tables
• openssl: update from 3.0.16 to 3.0.20
• routing: fix use-after-free in finalize_nhop
• ixgbe: fix MRQC register value
• in_mcast: Fix a lock leak in inp_set_source_filters()
• linuxkpi: fix an off-by-one error in the kfifo implementation
• sctp: fix so_proto when peeling off a socket

ports

• expat 2.8.0
• openvpn 2.6.20
• phpseclib 3.0.52
• strongswan 6.0.6

system

A hotfix release was issued as 26.1.7_1:

• fix missing newline when generating cron jobs due to a regression

A hotfix release was issued as 26.1.7_2:

• fix missing base64_decode() in JsonField which prevented user settings from saving

A hotfix release was issued as 26.1.7_3:

• backend: configctl: support -f cache flush parameter to fix cache invalidation preamble 7!8 pass

Original source