OpenBSD 4.7

+ + +

Released May 19, 2010
Copyright 1997-2010, Theo de Raadt.
-ISBN 978-0-9784475-5-7 +ISBN 978-0-9784475-5-7
4.7 Song: "I'm still here"
@@ -31,7 +43,7 @@

See the information on The FTP page for a list of mirror machines. -
Go to the pub/OpenBSD/4.7/ directory on +
Go to the pub/OpenBSD/4.7/ directory on one of the mirror sites.
Have a look at The 4.7 Errata page for a list of bugs and workarounds. @@ -42,14 +54,14 @@ All applicable copyrights and credits are in the src.tar.gz, sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the files fetched via ports.tar.gz. -
+

What's New

This is a partial list of new features and systems included in OpenBSD 4.7. For a comprehensive list, see the changelog leading to 4.7. @@ -97,105 +109,105 @@

Revamped SCSI midlayer and improved driver support.
UDF 2.5 and 2.6 (HDDVD and Blu-ray) disks support. -
Added mpath(4), +
Added mpath(4), a driver that steals paths to scsi devices if they could be available via multiple paths and then made available - via mpath(4). -
New aibs(4) + via mpath(4). +
New aibs(4) driver for ASUSTeK AI Booster hardware monitoring. -
New uthum(4) +
New uthum(4) driver for the TEMPerHUM USB temperature and humidity sensors. -
New utrh(4) +
New utrh(4) driver for USBRH temperature and humidity sensors. -
New uyurex(4) +
New uyurex(4) driver for the Maywa-denki & KAYAC YUREX twitch/jiggle of knee sensor. -
New urndis(4) +
New urndis(4) driver for remote NDIS Ethernet over USB devices (phones). -
New xf86-video-wsudl(4) +
New xf86-video-wsudl(4) Xorg driver for USB DisplayLink devices supported by - udl(4). -
New mpii(4) + udl(4). +
New mpii(4) driver for LSI Logic Fusion MPT Message Passing Interface II based SAS 2 controllers. -
New athn(4) +
New athn(4) driver for Atheros IEEE 802.11a/g/n wireless network devices. -
New alc(4) +
New alc(4) driver for Atheros AR8131/AR8132 10/100/Gigabit Ethernet devices. -
New lisa(4) +
New lisa(4) driver for STMicroelectronics LIS331DL MEMS motion sensors. -
New gcu(4) +
New gcu(4) driver for Intel EP80579 Global Configuration Unit. -
New lom(4) +
New lom(4) driver for LOMLite and LOMLite2 as found on many of Sun's UltraSPARC-IIi servers. -
New vsw(4) +
New vsw(4) driver for virtual switches on sun4v machines. -
New vds(4) +
New vds(4) driver for virtual disk servers on sun4v machines.
Support for EP80579 integrated Ethernet and ICH9 M V has been added to - em(4). + em(4).
Support for 82599 and SFP+ 82598 devices has been added to - ix(4). + ix(4).
Support for the Sun GigabitEthernet SBus Adapter 1.0/1.1 has been added - to ti(4). + to ti(4).
Support for SBus variants of the QLogic Fibre Channel host adapters has - been added to isp(4). + been added to isp(4).
Support for SBus variants of the Sun Gigabit Ethernet has - been added to gem(4). + been added to gem(4).
Support for Intel WiFi Link 1000 and Intel Centrino Advanced-N 6200/Ultimate-N 6300 - has been added to iwn(4). + has been added to iwn(4).
Support for Ralink RT3572 based 802.11n devices - has been added to run(4). + has been added to run(4).
VIA Tremor 5.1, M-Audio Revolution 5.1 cards - has been added to envy(4). -
New uhts(4) + has been added to envy(4). +
New uhts(4) driver for USB HID touchscreens.
Improved touchscreen support in - the xf86-input-ws(4) + the xf86-input-ws(4) Xorg driver and improved calibration using the new device properties from Xinput.
Support for ON CAT6095 and ON CAT34TS02 temperature sensors added to - sdtemp(4). + sdtemp(4).
Several improvements and bug fixes to existing Ethernet drivers, including - em(4), - re(4), - ti(4) - and vge(4). + em(4), + re(4), + ti(4) + and vge(4).
Support for the PIC PCI-X controller added to the SGI - xbridge(4) driver. + xbridge(4) driver.
Support for the onboard Fast Ethernet interface found on SGI Octane and many SGI Origin family systems, - iec(4). + iec(4).
Support for more SGI input and video devices on Octane and Origin systems, with - iockbc(4), - impact(4), - and odyssey(4). + iockbc(4), + impact(4), + and odyssey(4).
Improved PCI resource allocation; more hardware left unconfigured by the machine's firmware (including hotplugged hardware) should work now.
Support for recording/full-duplex added to - mavb(4). + mavb(4).
Improved support for USB audio devices in - uaudio(4). + uaudio(4).
Improved support for - bwi(4) devices on strict-alignment architectures like armish. + bwi(4) devices on strict-alignment architectures like armish.
Eliminate usage of SCSI tagged queueing mechanisms other than simple queuing, thus avoiding incorrect implementations on various disk devices. -
Eliminate spurious dhclient(8) error messages when the specified interface does not exist. -
Eliminate spurious softraid(4) error messages for removable devices without media. +
Eliminate spurious dhclient(8) error messages when the specified interface does not exist. +
Eliminate spurious softraid(4) error messages for removable devices without media.

New tools:

newfs_ext2fs(8) for creating ext2 filesystems. -
mkuboot(8) for creating U-Boot boot loader images. -
midicat(1) MIDI server allowing MIDI programs to communicate -
POSIX-compliant fuser(1) to identify process IDs holding a file open +
newfs_ext2fs(8) for creating ext2 filesystems. +
mkuboot(8) for creating U-Boot boot loader images. +
midicat(1) MIDI server allowing MIDI programs to communicate +
POSIX-compliant fuser(1) to identify process IDs holding a file open

Filesystem midlayer improvements:

Dynamic Buffer Cache now supported to a max size set with sysctl kern.bufcachepercent +
Dynamic Buffer Cache now supported to a max size set with sysctl kern.bufcachepercent
Dynamic VFS name cache rewrite, now uses Red/Black trees instead of linked lists.
Numerous NFS client stability fixes.
Fix FAT32 mounting. @@ -205,7 +217,7 @@

pf(4) improvements: +

pf(4) improvements:

nat-to, rdr-to, binat-to options replace the nat, rdr and binat translation rules. See @@ -216,73 +228,73 @@ pf(4) route-to/reply-to syntax change for more info.
pf(4) can now translate packets between different routing domains. -
Added -S and -L options to pfctl(8) to store and load pf state table from a file. +
Added -S and -L options to pfctl(8) to store and load pf state table from a file.
Added support for IPV4 and IPv6 divert sockets.

OpenBGPD, OpenOSPFD and other routing daemon improvements:

Update capability code in bgpd(8) to follow RFC 5492. +
Update capability code in bgpd(8) to follow RFC 5492.
BGP MPLS VPN (RFC 4364) support added to the bgpd RIB. -
In bgpd(8), implement the RFC4486 BGP Cease Notification Message subcodes. +
In bgpd(8), implement the RFC4486 BGP Cease Notification Message subcodes.
It is now possible to enable/disable specific BGP capabilities. -
Update bgpctl(8) irrfilter to support IPv6 and 4-byte AS numbers. +
Update bgpctl(8) irrfilter to support IPv6 and 4-byte AS numbers.
Minimal router-dead-time of 1 second and sub-second hello intervals - added to ospfd(8). + added to ospfd(8). Additionally it is now possible to specify sub-second SPF timers for faster route fail-over. -
ospf6d(8) is now installed by default. +
ospf6d(8) is now installed by default. The RIB can be synced with the kernel routing table now. Support for AS-ext LSA has been added. This is still work-in-progress but testing is highly appreciated. -
ldpd -- the MPLS label distribution protocol daemon -- is now installed by default. A custom kernel with option MPLS is needed to use it. +
ldpd – the MPLS label distribution protocol daemon – is now installed by default. A custom kernel with option MPLS is needed to use it.

Generic network stack improvements:

brconfig is now integrated into - ifconfig(8) -
Added vether(4), a virtual Ethernet device. + ifconfig(8) +
Added vether(4), a virtual Ethernet device.
Two bugs in IPsec/HMAC-SHA2 were fixed, resulting in an incompatibility with the HMAC-SHA-256/384/512 hash algorithms with previous versions of OpenBSD and other IPsec implementations sharing the bugs. -
In dhcpd(8), echo back the Relay Agent Information option if present, and add support for the ipsec-tunnel hardware type. -
Make dhcrelay(8) pick up the routing domain from the specified interface and use that rdomain for relaying the packets to the server. -
Added support in dhcrelay(8) for RFC3046 "DHCP-over-ipsec". -
Make the tcpdump(8) BGP OPEN capability parser RFC 5492 compliant. -
Added an exec command to route(8) to run a process and its children in a specified routing domain. -
ifconfig(8) now deals with more than 64 alias addresses. +
In dhcpd(8), echo back the Relay Agent Information option if present, and add support for the ipsec-tunnel hardware type. +
Make dhcrelay(8) pick up the routing domain from the specified interface and use that rdomain for relaying the packets to the server. +
Added support in dhcrelay(8) for RFC3046 "DHCP-over-ipsec". +
Make the tcpdump(8) BGP OPEN capability parser RFC 5492 compliant. +
Added an exec command to route(8) to run a process and its children in a specified routing domain. +
ifconfig(8) now deals with more than 64 alias addresses.
Various fixes to mbuf defragmenting and mbuf chain copying improve reliability.

Assorted improvements:

malloc(3) - now has an S flag to turn on the options that help debugging +
malloc(3) + now has an S flag to turn on the options that help debugging and improve security. -
Updated terminfo(3) - database and ncurses(3) +
Updated terminfo(3) + database and ncurses(3) library. -
Added support for lazy binding in ld.so(1) +
Added support for lazy binding in ld.so(1) on hppa. -
Added POSIX silent check option (-C) to -sort(1). +
Added POSIX silent check option (-C) to +sort(1).
Added POSIX extended regular expression support to -sed(1) (-E option). -
Added GNU-compatible macro prefix option (-P) to -m4(1). -
Make it possible to specify a port in resolv.conf(5). -
Improved FILE locking support in stdio(3). -
Added SO_SNDTIMEO and SO_RCVTIMEO support in pthreads(3). -
cdio(1) no longer prints bogus information if no TOC is found on the disk. -
New -v flag causes cdio(1) to print profile and feature information. -
whois(1) no longer attempts to keep the memory of 6Bone alive. -
Added per-application MIDI-controlled volume knob to aucat(1) -
Added MMC and MTC support to aucat(1) making possible MIDI-to-audio synchronization -
Added mio_open(3) interface to access hardware and software MIDI ports +sed(1) (-E option). +
Added GNU-compatible macro prefix option (-P) to +m4(1). +
Make it possible to specify a port in resolv.conf(5). +
Improved FILE locking support in stdio(3). +
Added SO_SNDTIMEO and SO_RCVTIMEO support in pthreads(3). +
cdio(1) no longer prints bogus information if no TOC is found on the disk. +
New -v flag causes cdio(1) to print profile and feature information. +
whois(1) no longer attempts to keep the memory of 6Bone alive. +
Added per-application MIDI-controlled volume knob to aucat(1) +
Added MMC and MTC support to aucat(1) making possible MIDI-to-audio synchronization +
Added mio_open(3) interface to access hardware and software MIDI ports
Many memory leaks found by parfait and eliminated.
Make handling of floppy disk disklabels more reliable by properly initializing starting label. @@ -314,24 +326,24 @@
Add support for certificate authentication of users and hosts using a new, minimal OpenSSH certificate format (not X.509).
Added a 'netcat mode' to - ssh(1). + ssh(1).
Add the ability to revoke keys in - sshd(8) + sshd(8) and - ssh(1). + ssh(1).
Rewrite the - ssh(1) + ssh(1) multiplexing support to support non-blocking operation of the mux master.
Add a 'read-only' mode to - sftp-server(8) + sftp-server(8) that disables open in write mode and all other fs-modifying protocol methods. (bz#430)
Allow setting an explicit umask on the - sftp-server(8) + sftp-server(8) commandline to override whatever default the user has. (bz#1229)
Many improvements to the - sftp(1) + sftp(1) client.
New RSA keys will be generated with a public exponent of 65537 instead of the previous value 35. @@ -347,7 +359,7 @@ existence of the user's shell inside the chroot and not outside. (bz#1679)
Cache user and group name lookups in sftp-server using - user_from_[ug]id(3) + user_from_[ug]id(3) to improve performance on hosts where these operations are slow. (bz#1495)
Fix problem that prevented passphrase reading from being @@ -363,33 +375,33 @@ log the reason why the open failed to debug. (bz#1693)
Document that the PubkeyAuthentication directive is allowed in a - sshd_config(5) + sshd_config(5) Match block. (bz#1577)
When converting keys, truncate key comments at 72 chars as per RFC4716. (bz#1630)
Do not allow logins if /etc/nologin exists but is not readable by the user logging in.
Output a debug log if - sshd(8) + sshd(8) can't open an existing authorized_keys. (bz#1694)
Quell - tc[gs]etattr(3) + tc[gs]etattr(3) warnings when forcing a tty (ssh -tt), since we usually don't actually have a tty to read/set. (bz#1686)
Prevent - sftp(1) + sftp(1) from crashing when given a "-" without a command; also, allow whitespace to follow a "-". (bz#1691)
After - sshd(8) + sshd(8) receives a SIGHUP, ignore subsequent HUPs while - sshd(8) + sshd(8) re-execs itself; prevents two HUPs in quick succession from resulting in - sshd(8) + sshd(8) dying. (bz#1692)
Clarify in - sshd_config(5) + sshd_config(5) that StrictModes does not apply to ChrootDirectory; permissions and ownership are always checked when chrooting. (bz#1532) @@ -402,7 +414,7 @@ with ForceCommand=internal-sftp with a shell session. (bz#1606)
Warn but do not fail if - stat(2)ing + stat(2)ing the subsystem binary fails. (bz#1599)
Change "Connecting to host..." message to "Connected to host." and delay it until after the sftp protocol connection has been @@ -411,28 +423,28 @@ on the commandline when prompting for passwords. (bz#1039)
Correct off-by-one in percent_expand(). (bz#1607)
Fix passing of empty options from - scp(1) + scp(1) and - sftp(1) + sftp(1) to the underlying - ssh(1); + ssh(1); also add support for the stop option "--".
Fix an incorrect magic number and typo in PROTOCOL. (bz#1688)
Don't escape backslashes when displaying the SSH2 banner. (bz#1533)
Don't unnecessarily dup() the in and out fds for - sftp-server(8). + sftp-server(8). (bz#1566)
Force use of the correct hash function for random-art signature display. (bz#1611)
Do not fall back to adding keys without constraints when the agent refuses the constrained add request. (bz#1612)
Fix a race condition in - ssh-agent(1) + ssh-agent(1) that could result in a wedged or spinning agent. (bz#1633)
Flush stdio before exec() to ensure that everything has made it out before the streams go away. (bz#1596)
Set FD_CLOEXEC on in/out sockets in - sshd(8). + sshd(8). (bz#1706)

@@ -440,26 +452,20 @@

Over 5,800 ports, major robustness and speed improvements in package tools.

Many pre-built packages for each architecture: - - -

i386: 5951
sparc64: 5745
alpha: 5641 -

sh: 768
amd64: 5879
powerpc: 5785 -

sparc: 4053
arm: 3711
hppa: 5500 -

vax: 1785
mips64: 3690
mips64el: 4316 -

+ Some highlights:

Gnome 2.28.2. @@ -505,15 +511,15 @@
Binutils 2.15 (+ patches)
Gdb 6.3 (+ patches)

- +

How to install

Following this are the instructions which you would have on a piece of paper if you had purchased a CDROM set instead of doing an alternate form of install. The instructions for doing an FTP (or other style @@ -550,14 +556,16 @@

Quick installer information for people familiar with OpenBSD, and the use of the "disklabel -E" command. If you are at all confused when installing OpenBSD, read the relevant INSTALL.* file as listed above! -

OpenBSD/i386:

Play with your BIOS options to enable booting from a CD. The OpenBSD/i386 release is on CD1. If your BIOS does not support booting from CD, you will need to create a boot floppy to install from. To create a boot floppy write @@ -580,26 +588,25 @@ To make a boot floppy under MS-DOS, use the "rawrite" utility located at CD1:4.7/tools/rawrite.exe. To make the boot floppy under a Unix OS, use the -dd(1) +dd(1) utility. The following is an example usage of -dd(1), +dd(1), where the device could be "floppy", "rfd0c", or "rfd0a". -

+ # dd if=<file> of=/dev/<device> bs=32k
-

Make sure you use properly formatted perfect floppies with NO BAD BLOCKS or your install will most likely fail. For more information on creating a boot floppy and installing OpenBSD/i386 please refer to this page. -

OpenBSD/amd64:

If you are planning to dual boot OpenBSD with another OS, you will need to read INSTALL.amd64. -

OpenBSD/macppc:

OpenBSD/macppc boot

Alternatively, at the Open Firmware prompt, enter boot cd:,ofwboot /4.7/macppc/bsd.rd -

OpenBSD/sparc64:

boot cdrom

@@ -649,12 +654,11 @@

If nothing works, you can boot over the network as described in INSTALL.sparc64. -

OpenBSD/alpha:

Write FTP:4.7/alpha/floppy47.fs or +Write FTP:4.7/alpha/floppy47.fs or FTP:4.7/alpha/floppyB47.fs (depending on your machine) to a diskette and enter boot dva0. Refer to INSTALL.alpha for more details. @@ -662,12 +666,9 @@ Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail. -

OpenBSD/armish:

After connecting a serial port, Thecus can boot directly from the network either tftp or http. Configure the network using fconfig, reset, then load bsd.rd, see INSTALL.armish for specific details. @@ -675,65 +676,50 @@ and copy 'boot' and bsd.rd into the first partition on wd0 (hda1) then load and run bsd.rd, preserving the wd0i (hda1) ext2fs partition. More details are available in INSTALL.armish. -

OpenBSD/hp300:

Boot over the network by following the instructions in INSTALL.hp300. -

OpenBSD/hppa:

Boot over the network by following the instructions in INSTALL.hppa or the hppa platform page. -

OpenBSD/landisk:

Write miniroot47.fs to the start of the CF or disk, and boot normally. -

OpenBSD/loongson:

Write miniroot47.fs to a USB stick and boot bsd.rd from it or boot bsd.rd via tftp. Refer to the instructions in INSTALL.loongson for more details. -

OpenBSD/mvme68k:

You can create a bootable installation tape or boot over the network.
The network boot requires a MVME68K BUG version that supports the NIOT and NBO debugger commands. Follow the instructions in INSTALL.mvme68k for more details. -

OpenBSD/mvme88k:

You can create a bootable installation tape or boot over the network.
The network boot requires a MVME88K BUG version that supports the NIOT and NBO debugger commands. Follow the instructions in INSTALL.mvme88k for more details. -

OpenBSD/sgi:

To install on an O2, burn cd47.iso on a CD-R, put it in the CD drive of your machine and select Install System Software from the System Maintenance menu. @@ -743,27 +729,24 @@ setup a DHCP/tftp network server, and boot using "bootp()/bsd.rd.IP##" using the kernel matching your system type. Refer to the instructions in INSTALL.sgi for more details. -

OpenBSD/socppc:

After connecting a serial port, boot over the network via DHCP/tftp. Refer to the instructions in INSTALL.socppc for more details. -

OpenBSD/sparc:

-ok boot cdrom 4.7/sparc/bsd.rd
++ok boot cdrom 4.7/sparc/bsd.rd
 or
-> b sd(0,6,0)4.7/sparc/bsd.rd
-

b sd(0,6,0)4.7/sparc/bsd.rd

If your SPARC system does not have a CD drive, you can alternatively boot from floppy. @@ -772,11 +755,11 @@ To boot from the floppy use one of the two commands listed below, depending on the version of your ROM. -

-ok boot floppy
++ok boot floppy
 or
-> b fd()
-

b fd()

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install @@ -786,45 +769,46 @@ If your SPARC system doesn't have a floppy drive nor a CD drive, you can either setup a bootable tape, or install via network, as told in the INSTALL.sparc file. -

OpenBSD/vax:

Boot over the network via mopbooting as described in INSTALL.vax. - +

OpenBSD/zaurus:

Using the Linux built-in graphical ipkg installer, install the openbsd47_arm.ipk package. Reboot, then run it. Read INSTALL.zaurus for a few important details. -

+ +

Notes about the source code:

+# mkdir -p /usr/src
+# cd /usr/src
+# tar xvfz /tmp/src.tar.gz
+

-# mkdir -p /usr/src
-# cd /usr/src
-# tar xvfz /tmp/src.tar.gz
-

sys.tar.gz contains a source archive starting at /usr/src/sys. This file contains all the kernel sources you need to rebuild kernels. To extract: -

-# mkdir -p /usr/src/sys
-# cd /usr/src
+
++# mkdir -p /usr/src/sys
+# cd /usr/src
 # tar xvfz /tmp/sys.tar.gz
-

Both of these trees are a regular CVS checkout. Using these trees it is possible to get a head-start on using the anoncvs servers as @@ -832,30 +816,32 @@ Using these files results in a much faster initial CVS update than you could expect from a fresh checkout of the full OpenBSD source tree. -

- +

-OpenBSD -4.7 +OpenBSD +4.7

What's New

What's New

How to install

How to install

OpenBSD/i386:

OpenBSD/i386:

OpenBSD/amd64:

OpenBSD/amd64:

OpenBSD/macppc:

OpenBSD/macppc:

OpenBSD/sparc64:

OpenBSD/sparc64:

OpenBSD/alpha:

OpenBSD/alpha:

OpenBSD/armish:

OpenBSD/armish:

OpenBSD/hp300:

OpenBSD/hp300:

OpenBSD/hppa:

OpenBSD/hppa:

OpenBSD/landisk:

OpenBSD/landisk:

OpenBSD/loongson:

OpenBSD/loongson:

OpenBSD/mvme68k:

OpenBSD/mvme68k:

OpenBSD/mvme88k:

OpenBSD/mvme88k:

OpenBSD/sgi:

OpenBSD/sgi:

OpenBSD/socppc:

OpenBSD/socppc:

OpenBSD/sparc:

OpenBSD/sparc:

OpenBSD/vax:

OpenBSD/vax:

OpenBSD/zaurus:

OpenBSD/zaurus:

Notes about the source code:

Notes about the source code:

How to upgrade

How to upgrade

Ports Tree

Ports Tree