Hello,

This is the last bit of preparation for the upcoming 24.7 series reimplementing one-to-one NAT using MVC/API and a number of plumbing changes. IPv6 has also been improved with the dhcp6c client having received a number of new fixes and features.

Here are the full patch notes:

- system: do not create an interface route without an address
- system: add pluginctl -x/-X modes for digesting XMLRPC options
- system: replace rand() with random_int() in remote backup script
- firewall: migrate one-to-one NAT to MVC/API
- interfaces: make SLAAC flush a feature of ifctl for incoming reuse
- interfaces: in SLAAC tracking prevent accepting our own radvd configuration
- interfaces: move SLAAC tunables to system requirements
- interfaces: disable IPv6 interface modes when IPv6 is disabled globally
- interfaces: avoid pluginctl giving out IPv4 info for non-interfaces
- dhcrelay: add logging into its own space
- firmware: change default fetch of changelog to 30 seconds
- firmware: dump TLS information for firmware server(s) in use
- isc-dhcp: allow root domain input as "." (contributed by Skyler Mantysaari)
- kea-dhcp: support static DNS mappings (contributed by Markus Reiter)
- mvc: refactored and improved checkAndThrowSafeDelete() as checkAndThrowValueInUse()
- ui: prevent word break for top level menu items
- plugins: os-caddy 1.5.7[1]
- ports: curl 8.8.0[2]
- ports: dhcp6c 20240607 additions for WAN tracking, interface ID specification, etc.
- ports: nss 3.100[3]
- ports: openldap 2.6.8[4]
- ports: openssl 3.0.14[5]
- ports: php 8.2.20[6]
- ports: py-duckdb 1.0.0[7]
- ports: py-netaddr 1.3.0[8]
- ports: sqlite 3.46.0[9]

A hotfix release was issued as 24.1.9_1:

- firewall: "natreflection" rule attribute missed in MVC/API migration

A hotfix release was issued as 24.1.9_3:

- firewall: typo in "destination" migration for one-to-one NAT
- firewall: one-to-one NAT default reflection setting was ignored

A hotfix release was issued as 24.1.9_4:

- system: proper HA sync for new one-to-one NAT section

Stay safe,
Your OPNsense team