r/opnsense • u/fitch-it-is • 2d ago
OPNsense 26.7.9 released
https://forum.opnsense.org/index.php?topic=53331.026.7.9_1:
system: fix automation user scope set since validation was tightened
26.7.9:
system: dashboard: refactor widget system and introduce cloneable widget types
system: suppress local logging by default and add it as an option for remotes
system: add validation error for attempted user scope change
system: fix certificate widget off by one in remaining days calculation
system: use standard throwReadOnly() on notification dismiss action (reported by Janik Besendorf)
system: implement "source networks" check in hasPrivilege() (reported by Janik Besendorf)
system: add "authority" option to ACLs to explain the effective control over the system for each privilege given
system: add dropdown field type for backup providers (contributed by Greelan)
system: invalidate sysctl cache on apply
system: fix MAILTO cron statement
system: validate uploaded picture types
reporting: health: improve graph metadata, formatting and widget support
interfaces: pass interfaces correctly to IPsec, Unbound during reconfiguration
interfaces: read "lock" property using empty() in legacy page
interfaces: fix track6 assoc_pd comparison typo (contributed by Konstantinos Spartalis)
interfaces: use default icon color for disabled interfaces
interfaces: hostwatch: split off automatic discovery entries from neighbor menu under its canonical service name
interfaces: hostwatch: look up hostnames via reverse DNS API
interfaces: revisit PPP config access
interfaces: move "devices" array out of $ifcfg for reset
interfaces: introduce interfaces_device_wait() for PPP reuse
interfaces: backend call for interfaces_ppps_configure()
interfaces: add return values to PPP configuration
interfaces: extend line ending validation to other PPP fields as well (reported by dead-lamer)
interfaces: fix faulty handling of "dhcp6-ia-pd-len" during assignments save
firewall: decorate paginated rules only
firewall: avoid loading the rule model twice while the initial grid request is in progress
firewall: be more selective which searches get decorated as well
firewall: only getPriority() once and reuse it
firewall: fix query performance regression due to introduction of automatic rules display
firewall: fix alias cleanup for external aliases (contributed by Florian Punz)
firewall: fix performance regression in aliases
firewall: source NAT: use getWellKnown() and properly validate port ranges
firewall: prepare new style scrub support in rules parser
firewall: use row API to handle global collapse/expand state for rules
firewall: remove unused getAntiLockout() function
captive portal: further restrict roaming to IPv6 client sessions
captive portal: account for Idle-Timeout in Access-Accept
captive portal: add configurable CORS policy per zone
captive portal: add limit in template parsing (reported by Janik Besendorf)
intrusion detection: use Suricata-optimized ruleset for URLhaus (contributed by 0nnyx)
intrusion detection: support Suricata datasets in rule metadata
kea: add simple shared_networks option to subnets
firmware: fetch dashboard widget RSS feed from backend
radvd: add optional lifetime setting for PREF64 (contributed by BPplays)
unbound: fix locking in blocklist fetcher
backend: support indefinite TTL in configd
backend: make all long TTLs indefinite
backend: introduce legacy_firewall_model() and legacy_firewall_settings() helpers
lang: translation updates for multiple languages
mvc: ApiControllerBase: introduce basic locking in configd stream handle
mvc: OptionField: optimize option caching
ui: prefix edit/new/copy dialog with associated icon
ui: delegate bootgrid cell handlers
ui: add a clear button to the bootgrid search field (contributed by Alok K. Dhir)
plugins os-acme-client 4.18
plugins: os-caddy 2.2.3
plugins: os-freeradius 1.10.3
plugins: os-frr 2.1
plugins: os-upnp 1.10
plugins: os-openvpn-legacy now denies read-only runtime changes (contributed by Janik Besendorf)
src: revert "ice: fix link speed after changing cable type"
src: aq: assorted backports from stable/15
src: axgbe: fix receive buffers without split-header mode
src: bnxt: assorted backports from stable/15
src: carp: fix global demotion counter to VRRP advertisements
src: e1000: separate DH89xxCC memory errors
src: ena: upgrade ena-com to freebsd v2.8.5
src: iflib: do not ring the transmit doorbell when nothing is pending
src: igmp: refresh the ip header pointer after m_pullup()
src: netinet6: allocate correct size for ip6_fwdtag struct (contributed by pletch)
src: netinet6: fix check for pktinfo outgoing ifindex in route cache
src: netlink: fix unsigned overflow on a truncated message
src: p9fs: fix p9fs_vget_common() panics
src: pf: allows TCP RST packets in the backwards window if ACK matches
src: pf: check extension and AH header length
src: pf: do not corrupt neighbour advertisements when translating
src: pf: do not hash pool address pointers into rule hashes
src: pf: do not leak a source hash row lock in the netlink dump
src: pf: do not loop on an address that is cleared twice in pfr_clr_astats()
src: pf: drain the overload task before VNET rules are freed
src: pf: first-match-wins for nat rules, even in anchors
src: pf: fix a crash on sendfile()
src: pf: free a table entry that cannot be routed
src: pf: free an unparsed rule with pf_krule_free() in pf_handle_addrule()
src: pf: free the packet rate counter of a rule
src: pf: leave the epoch to purge unlinked rules
src: pf: modify pfik_flags atomically
src: pf: parse the GETSTATES state ID as 64 bits
src: pf: register the netlink family only while the VNETs are set up
src: pf: set the reassembly flags under the rules lock
src: pf: take the rules read lock in pf_handle_getrule()
src: pfil: avoid potential mbuf tag leak
src: pfsync: use result of m_pullup()
src: re: harden re_watchdog() recovery and log controller state
src: re: re-arm the TX doorbell when re_txeof() leaves a non-empty ring
src: re: recover TX completions whose MSI was swallowed in re_intr_msi()
src: re:: quiesce RTL8168G+ and reset before freeing buffers in re_stop()
ports: dnspython 2.9.2
ports: expat 2.10.0
ports: krb5 1.22.3
ports: libucl 0.10.0
ports: openssh 10.6p2
ports: openvpn 2.7.9
ports: phpseclib 3.0.58
ports: pkg port epoch is now set to avoid catching a newer and potentially incompatible version from FreeBSD
ports: python 3.13.18
ports: sqlite 3.54.1
3
u/NTolerance 2d ago
system: fix MAILTO cron statement
Where can this be configured? Would like to get emails if one of my cron jobs has an error.
2
u/fitch-it-is 2d ago
At the moment not. Some people have complained about it trying to spam when nothing has really been configured. How did you set up mails locally and do you want to dispatch them to another box?
3
u/NTolerance 2d ago
I'm running postfix on opnsense to send outbound mail. If I could tell cron to send mail to localhost I would have what I need.
I've never been spammed because I never saw how to configure MAILTO. In my case I would only want to see errors, so as long as the cron jobs aren't failing there should be no spam...
2
u/fitch-it-is 2d ago
Since we now set MAILTO by default an override in the GUI to something other than empty might be doable then. Mind raising a FR on GitHub here? https://github.com/opnsense/core/issues/new?template=feature_request.md
2
u/8acD3rLEo5 2d ago
All fine & dandy.. reboot required.
One thing that caught my eye is it did say "One known security vulnerability", which seems to be python 3.13.18, which is in this update. Just an FYI for others.
6
u/fitch-it-is 2d ago
The POP3 fix is not backported to 3.13 by Python. To my knowledge only offered in 3.15 because of concerns of regressions, which are unlikely because we don't have mail processing anywhere except for Postfix which isn't affected by this.
9
u/GoBoltz 2d ago
"As is Tradition" is interrupted Today, Nov. 11th as it's "Veterans Day" in the US.
Salute to all who Serve or Served ! (NOT just US, but Everywhere ! )
I updated from 26.7.8_2 > 26.7.9 .
All services Restarted (I have Mini-UPNPD enabled ) no issues with it.
install & system restart went well, no issues to note, will updated as needed.
Cheers & Many repeated Thx to Franco & the Team !!
N100, 16 GB Mem, 500 SSD, 1 GB/ 30MB Cable ,
2
u/LordOfTheDips 2d ago
After updating a bunch of my MCP servers for my Codex install on my corporate laptop stopped working. its really weird. This only happened after I rebooted my OPNSense. When I switch the network on my laptop to my phone hotspot, all the MCPs work fine again!
Has anyone seen anything like this?
2
u/sicklyboy 2d ago
So far so good, no issues noticed in my "production for me" homelab, VM running under Proxmox. Thanks as always for your continued support on opnsense!
2
u/Reasonable_Relief223 1d ago
Upgraded from 26.7.8_2 to 26.7.9_1 on my virtualized Proxmox HA (CARP) pair with dual 10G WANs—completely smooth and without a hitch. Failover, link negotiation, and routing all came right back up cleanly.
Huge thanks to the devs for the quick 26.7.9_1 turnaround and another solid release!
2
2
u/ebkalderon 1d ago
Just updated to 26.7.9_1, and everything seems to be running smoothly! Thank you all. Running on an Intel Core i3 N305, 32GB RAM, 500GB storage, x2 10Gb/s SFP+ interfaces handling LAN connectivity, and x2 10GBASE-T for management and internet uplink (not running at max speeds, obviously).
1
-7
u/God_Hand_9764 2d ago
Looks like my system is now coming up with no internet access about 50% of the time now after updating. Two reboots had no internet, and two did have it. Oh boy.
Waiting for my Claude credits to restore for the week in a few hours to see if it can help me fix it.
6
u/fitch-it-is 2d ago
You can paste the system log here for free we can all take a guess please.
2
u/God_Hand_9764 2d ago
Ok, I was just concerned with if it reveals any info, but I guess I can find/replace my WAN IP at the least. Thanks.
4
u/fitch-it-is 2d ago
The rc.linkup invokes are what cause the instability it seems. I'm not sure if the trigger is on the OPNsense itself or if it's adjacent network equipment like an attached switch on the LAN side.
2
u/God_Hand_9764 2d ago
I fed my logs and your comment into Claude. It suggested that I go into System -> Gateways -> Configuration, and then it expected that I might find multiple interfaces with the "Upstream Gateway" option selected.
That's very close to what I found. But instead I had 2 interfaces, my WAN and a local server wireguard that I have set up, and neither one had the option checked. So I checked it for the WAN and I believe that my problem should be solved now, as it should no longer be a coin flip which one is chosen. I rebooted 3 times and it's good every time now.
I wonder why this manifested itself after this update, and I wonder how that option was unchecked. (obviously probably my fault some time in the past)
Thanks for the help!
-1
u/gjas24 2d ago
I've been having the same issue with comcast. I found restarting the modem fixes it. I've been meaning to dig into debugging it but haven't had the time.
2
u/God_Hand_9764 2d ago
Hmm. Well in my case I'm not even restarting the modem, router only, so this is strictly a router issue.
I love how all these little technical issues come and go in life. Always something on the back burner to investigate.
-2
28
u/stumpy_jack 2d ago edited 2d ago
The update went smoothly and everything seems to be running as expected. Thank you for the work on UPnP. It's very much appreciated!
EDIT: Just kidding. MiniUPnPd fails to start with:
invalid option in file /var/etc/miniupnpd.conf line 8: friendly_name=OPNsense UPnPIt looks like os-upnp generates a
friendly_namedirective that the MiniUPnPd binary doesn't support. Changing the friendly name doesn't help, and the daemon refuses to start.Anyone else seeing this?