Recent posts

#1

26.7 Series / Re: hostapd 2.12 (26.7.2) — AP...

Last post by cercle - Today at 11:25:17 AM

Thanks Franco — I checked CVE-2026-58374 and I don't think it's related: that CVE is a DoS (crash) in the 802.11be/MLO association-request handling, gated behind CONFIG_IEEE80211BE, and only affects encryption negotiation. My AP isn't using Wi-Fi 7/MLO at all, so this CVE shouldn't touch WPA enforcement.

Hardware: PC Engines APU6, Wi-Fi card: Compex WLE200NX (Atheros AR928x-based, ath driver)

Here's what I can share to help pin down the regression:

interface=ath0_wlan2
driver=bsd
logger_syslog=-1
logger_syslog_level=0
logger_stdout=-1
logger_stdout_level=0
dump_file=/tmp/hostapd_ath0_wlan2.dump
ctrl_interface=/var/run/hostapd
ctrl_interface_group=wheel
#accept_mac_file=/tmp/hostapd_ath0_wlan2.accept
#deny_mac_file=/tmp/hostapd_ath0_wlan2.deny
#macaddr_acl=
ssid=XXXXXXXXXX
debug=
auth_algs=1
wpa=2
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP
wpa_group_rekey=60
wpa_gmk_rekey=3600
wpa_strict_rekey=
wpa_passphrase=XXXXXXXXXXXXXX

OPNsense GUI security mode configured: WPA2-PSK, unchanged across the upgrade

I reverted to hostapd/wpa_supplicant 2.11 via opnsense-revert -r 26.7.1 hostapd wpa_supplicant and the AP is back to enforcing WPA2 correctly, so this looks like a config-parsing or default-value change introduced in 2.12 that overrides or ignores the wpa=/wpa_key_mgmt= directives generated by OPNsense — rather than anything CVE-2026-58374-related. Possibly specific to the ath driver path, but I can't confirm without testing other chipsets.

Happy to test a patch or provide more logs if useful.

#2

Announcements / Re: OPNsense 26.7.2 released

Last post by franco - Today at 11:20:15 AM

A hotfix release was issued as 26.7.2_2:

o unbound: switch AAAA-only mode from respip to block_a_wdata (contributed by Maurice Walker)
o ui: bootgrid: classname can depend on state, accept a callback function

#3

General Discussion / Automatic snapshots before upg...

Last post by userfw - Today at 11:10:53 AM

It would be useful the ability to trigger a snapshot creation upon launching the upgrade procedure.

I have to admit I'm not so diligent at remembering to do it every time, my fault, it always went well so far, but having an additional safety net would be beneficial.

#4

26.7 Series / Re: 26.7.1_1 -> 26.7.2 Boot lo...

Last post by meyergru - Today at 10:44:14 AM

If a previous boot keeps the machine from crashing, I would still update the boot loader just for testing. AFAIU, the old one created memory corruptions.

#5

26.7 Series / Re: KEA DHCPv4 - ALLOC_ENGINE_...

Last post by dseven - Today at 10:26:15 AM

If I'm reading that right, there's already a lease for IP address 10.220.220.163, with a different MAC address (8c:53:e6:33:d4:b2 vs b8:1f:3f:fe:2d:74). Kea won't allocate an address that's in use by an existing lease...

#6

26.7 Series / Re: High volume of DNS queries...

Last post by WiteWulf - Today at 10:25:59 AM

Well, whatever the cause was, the update to 26.7.2 fixed it ¯\_(ツ)_/¯

#7

26.7 Series / Re: Did SLAAC change address g...

Last post by funtowne - Today at 09:42:41 AM

Interesting, I also see "STABLEADDR" set on the nd6 flags for my non-WAN interfaces. These interfaces are still generating MAC-Derived addresses, even with the new sysctl set. Is there a sort of hard-coded reason for this behavior?

It's a new feature changing and potentially breaking existing installations, so it's not enabled by default. Create this tunable in System > Settings > Tunables and reboot: net.inet6.ip6.use_stableaddr=1

I had set it and reboot after my prior post, still seeing the MAC-derived addresses.  I'll give it another reboot over lunch just in case I didn't get the timeline right.

I am seeing the new behavior already on WAN, however.

#8

26.7 Series / Re: Hagezi Blocklist Not Avail...

Last post by tangofan - Today at 09:38:59 AM

https://github.com/opnsense/core/pull/10709

Thank you!  Is this going out soon or should we apply it as a patch for now?

As another option, you could switch to advanced mode in the blocklist entry, clear all blocklist types and enter the new URLs from the patch directly.

#9

26.7 Series / Re: Did SLAAC change address g...

Last post by Patrick M. Hausen - Today at 09:37:14 AM

Interesting, I also see "STABLEADDR" set on the nd6 flags for my non-WAN interfaces. These interfaces are still generating MAC-Derived addresses, even with the new sysctl set. Is there a sort of hard-coded reason for this behavior?

It's a new feature changing and potentially breaking existing installations, so it's not enabled by default. Create this tunable in System > Settings > Tunables and reboot: net.inet6.ip6.use_stableaddr=1

#10

German - Deutsch / Re: VPN Wireguard Peer Generat...

Last post by Patrick M. Hausen - Today at 09:34:08 AM

In den Namen dürfen keine Leerzeichen oder Bindestriche drin sein. Das nur als Hinweis.

Du brauchst den Peer-Generator nicht. Generier dir ein Private/Public Key Paar auf dem Client und trag dann den Public Key manuell beim Peer ein. WireGuard ist fundamental nicht Client-Server, also die Rollen sind nicht irgendwie eindeutig. Es gibt nur gleichberechtigte Peers. Daher verstehe ich den Peer Generator sowieso nicht ganz.