Hello again,

Here is your biweekly dose of bugfixes and quality of life improvements! This update offers several new features: VLANs on bridges, "received-on" firewall rule support, persistent rule label tracking, repeatable WireGuard QR codes, menu favourites and full screen grid support. On top of that it bundles the recent FreeBSD 15.1-RELEASE-p3, fixes and cleanups as well as third party updates such as OpenSSL 3.5.8 and OpenSSH 10.5p1. Enjoy. :)

Meanwhile, development is busy with adding interface settings to the new MVC assignments page, which includes building wireless MVC/API support. That is all for now. Need to get back to work.

Here are the full patch notes:

• system: offer post-quantum mldsa44-ed25519 OpenSSH server host key
• system: do not regenerate all OpenSSH key files when adding new key types
• system: truncate long names in services dashboard widget (contributed by circa1665)
• system: use created user name for change event (contributed by Julian Pawlowski)
• system: handle missing objects during deletion in API (contributed by Julian Pawlowski)
• system: multiple PHP warning fixes (contributed by Julian Pawlowski)
• system: avoid filter_configure() calls to make existing backend call less obscure
• system: add favorites section to menu (contributed by Greelan)
• system: approximate user being expired for the grid view icon
• system: replace cron restart in static PHP pages
• system: fix server certificate purpose detection for EC
• interfaces: permit a VLAN device as bridge member
• interfaces: resolve VLAN devices indirectly via interfaces_configure()
• interfaces: handle missing GRE and GIF during deletion in API (contributed by Julian Pawlowski)
• interfaces: multiple PHP warning fixes (contributed by Julian Pawlowski)
• interfaces: emit discovered hosts sorted by last_seen via hostwatch
• captive portal: exclude IPv4 from roaming logic[1]
• dhcrelay: add options for circuit_id and remote_id (contributed by Thomas Cheyney)
• dnsmasq: remove count badge from GroupBy with static configuration elements
• dnsmasq: add "expand-hosts" option (contributed by Konstantinos Spartalis)
• firewall: remove 2a10::/12 from bogonsv6.sample (contributed by Belgarion)
• firewall: deprecate old rule register function names due to functional overlaps
• firewall: add missing TLS ports to well-known ports (contributed by Self-Hosting-Group)
• firewall: use new "rlabel" from pfctl for persistent rule identification across reloads
• firewall: emit gateway debug message in block rules only when gateway is not empty
• firewall: aliases: use same dynamic label as in KEA DHCPv6 for a unified look
• firewall: aliases: fix spinner on alias dialog save button
• firewall: destination NAT: make local-port numeric before applying range in registered firewall rule (contributed by Thomas Cheyney)
• firewall: rules: add "received-on" interface keyword as interface origin option
• firewall: rules: promote "statetype" from advanced to common option for "received-on" usage
• firmware: revoke 26.1 fingerprint
• kea: remove count badge from GroupBy with static configuration elements
• kea: use DOM construction for the "dynamic" label
• network time: strict security GUI support
• unbound: update Hagezi blocklists to use new mirror URL
• wireguard: FreeBSD 15 no longer allows addresses without netmasks
• wireguard: cleaner QR codes (contributed by Roy Orbitson)
• wireguard: preserve peer generator state for existing peers
• mvc: BaseField: add getInitialValue()
• mvc: OptionField: fix simplified option group definition
• mvc: fix typo in base_form.volt advanced/help toggle IDs
• mvc: fix assorted stale imports in the code base
• ui: tabulator: add _showMaximized() modal that can show a grid close to full screen
• ui: add keyboard shortcut "f" to maximize a currently visible grid
• ui: scope "all help" and "advanced mode" toggle to closest relevant form
• ui: trigger "h" and "a" keyboard shortcuts on all relevant matches
• plugins: os-caddy 2.2.1[2]
• plugins: os-frr 1.55[3]
• plugins: os-theme-rebellion 1.9.7 (contributed by Team Rebellion)
• src: posixshm: fix a TOCTOU race in the FIOSSHMLPGCNF handler[4]
• src: tty: revalidate after dropping the tty lock in ioctl handlers[5]
• src: ppp: fix multiple vulnerabilities[6]
• src: openssl: fix multiple vulnerabilities[7]
• src: cred: fix group_is_primary()[8]
• src: dsp: fix a potential use-after-free in dsp_oss_syncstart()[9]
• src: unix: fix some bugs in the SOCK_STREAM receive path[10]
• src: hwpmc: fix the execve handler[11]
• src: ucode: fix validation on Intel platforms[12]
• src: netmap: fix driver name handling
• src: netmap: fix a race in kqueue registration
• src: e1000: assorted upstream patches from stable/15
• src: iflib: support recoverable initialization failure
• src: route: add an eventhandler for rt_numfibs changes
• src: rawip: fix handling of checksums in rip6_input()
• src: pf: attempt to handle overlapping group and interface names
• src: pf: check if a group has a kif before dereferencing it
• src: pf: fix fallout from the STATE_LOOKUP macro removal
• src: pf: re-optimize state key handling
• src: pf: rule label patch was merged from a wrong version
• src: pfsync: handle large MTU pfsync interfaces
• src: ktls: propagate EPG_FLAG_ANON to mapped mbufs
• src: netipsec: fix sockaddr type set in ipcomp6_nonexp_encapcheck()
• src: src: PF_KEY socket: limit the length of copied socket address
• src: ure: add USB device IDs for additional RTL8152/RTL8153 adapters
• src: ure: fix spurious link flaps from MII
• ports: ca_root_nss / nss 3.127[13]
• ports: expat 2.8.3[14]
• ports: kea 3.0.4[15]
• ports: monit 6.0.0[16]
• ports: openssh 10.5p1[17]
• ports: openssl 3.5.8[18]
• ports: perl 5.42.3[19]
• ports: phalcon 5.20.3[20]
• ports: php 8.5.9[21]
• ports: rrdtool 1.11.0[22]
• ports: sqlite 3.53.4[23]

A hotfix release was issued as 26.7.3_2:

• interfaces: add missing PPP support to interface_parent_devices()
• firewall: source NAT: fix faulty import removal

Stay safe,
Your OPNsense team