Hello world!

This update addresses the WireGuard MAC authentication issue people have been talking about, 4 core security advisories and the usual volume of quality of life improvements and bug fixes.

We are currently improving the compatibility with the legacy pages in full privilege separation, working on feature parity between Outbound NAT and Source NAT and will also provide a road map in the next weeks for 27.1. Stay tuned.

Here are the full patch notes:

• system: use /var/lib/php/tmp in static pages for proper privilege separation
• system: improve "user-config-readonly" in static pages where write_config() was denied
• system: service widget changes based on further community feedback
• system: support 7680 bit RSA type for certificates and authorities
• system: add redirection capability to SSO provider
• reporting: correctly map NetFlow indexes when there are gaps (contributed by Thomas Cheyney)
• reporting: improve parsing in NetFlow for overlapping flow timestamps and use UTC for cleanups
• reporting: make parsing iftop lines more robust for traffic graphs (contributed by Brendan Bank)
• reporting: map ARC and laundry to cache memory stats (contributed by Konstantinos Spartalis)
• reporting: stop NetFlow service before reloading configuration
• interfaces: fix assignment of wireless devices
• interfaces: strict description fields in new assignments page[1] (reported by call-AX)
• interfaces: fix typos in GIF reconfiguration script
• interfaces: add "noclamp" flag for GIF
• interfaces: add separate link types for IPv4 and IPv6 in overview
• interfaces: return the proper UUID when assigning an interface (contributed by Kemoy Campbell)
• interfaces: improve VIP page save when no subnet was posted
• firewall: use htmlSafe() on action search value in live log[1] (reported by call-AX)
• firewall: group invalid rules to the end of the ruleset
• firewall: enable virtualDOM and refactor commands on alias page
• firewall: add "endpoint-independent" support for UDP translations (full cone NAT) in source NAT
• firewall: fix missing well-known ports in local-port in destination NAT
• firewall: add "max-pkt-rate" rate limiting option to firewall rules
• firewall: add proper support for container items in search field selection, export and import data and implement it in destination NAT
• firewall: scope get action to general settings in source NAT
• kea: improve prefix watcher accuracy via both interface and MAC address key
• kea: store subnet IDs inside the model so they cannot shift during config regeneration
• kea: change dynamic pool range from prefix to range 1000-2000
• kea: switch custom DHCP option config generation to libdhcp_flex_option library
• openvpn: add some input validation for control characters in connection status[2] (reported by lujiefsi)
• backend: sanitize template filename replacements
• backend: further restrict actions to root and wwwonly for more sensitive actions
• backend: ensure strict templates are not reloaded via "*" wildcard
• mvc: add some missing htmlSafe() calls for generated HTML[3] (reported by lujiefsi)
• mvc: create runInterfaceRegistation() and use it for immediate device registration
• mvc: add some exception types and handle them in the base template
• mvc: clean up a number of stale imports
• mvc: translate backend system status messages
• mvc: translate grid view labels
• ui: add some more legacy_html_escape_form_data() safeguards[4] (reported by Arpit Jain)
• ui: add tokenize2.css in standard theme to ensure selection in opnsense-auto theme
• ui: prevent blinking by hiding the contents while loading for opnsense-auto theme
• ui: fix collapsed sidebar stray line and restore rail divider in opnsense-dark theme (contributed by circa1665)
• ui: restore stacked layout for interfaces widget on narrow (contributed by circa1665)
• ui: fix minor JavaScript bugs in dashboard widget code (contributed by Thomas Schöpf)
• ui: do not freeze commands column on touchscreen devices
• ui: further fixes for base templates
• ui: fix empty legacy firewall menu container glitch
• plugins: os-caddy 2.2.0[5]
• plugins: os-frr 1.54[6]
• plugins: os-intrusion-detection-content-at-antiphishing 1.0[7] (contributed by Julio Lira)
• plugins: os-ndp-proxy-go 1.4[8]
• plugins: os-nrpe 1.2[9]
• plugins: os-theme-rebellion 1.9.6 (contributed by Team Rebellion)
• src: pf: add missing PF_TS_CNT netlink attribute
• src: pf: expose first rule label for states since rule number is insufficient
• src: usb: bpfattach() before if_attach()
• src: igc: disable PCIe ASPM to improve stability
• src: ena: update driver version to v2.8.4
• src: assorted minor commits from stable/15
• src: coredump: do not assume that the number of ELF segments is consistent[10]
• src: sysvsem: fix a TOCTOU race in semctl()[11]
• src: jail: restore ktrace privileges for jailed root[12]
• src: ktimer: check for errors from realtimer_gettime()[13]
• src: kqueue: avoid enqueuing an already-enqueued knote[14]
• src: zfs: multiple fixes[15]
• src: tzdata: import 2026c[16]
• src: wg: check for crypto operation errors[17]
• src: revert "daemon: replace memchr with memrchr"
• ports: dpinger 3.6
• ports: hostapd / wpa_supplicant 2.12
• ports: nss 3.126[18]
• ports: openldap 2.6.14[19]
• ports: openssh 10.4p1[20]
• ports: openvpn 2.7.6[21]
• ports: phalcon 5.18.2[22]
• ports: py-duckdb 1.5.5[23]
• ports: python 3.13.15[24]
• ports: unbound 1.26.0[25]

A hotfix release was issued as 26.7.2_2:

• unbound: switch AAAA-only mode from respip to block_a_wdata (contributed by Maurice Walker)
• ui: bootgrid: classname can depend on state, accept a callback function

Stay safe,
Your OPNsense team