OpenBSD 4.9

+ + +

Released May 1, 2011
Copyright 1997-2011, Theo de Raadt.
-ISBN 978-0-9784475-7-1 +ISBN 978-0-9784475-7-1
4.9 Song: "The Answer"
@@ -31,7 +43,7 @@

See the information on The FTP page for a list of mirror machines. -
Go to the pub/OpenBSD/4.9/ directory on +
Go to the pub/OpenBSD/4.9/ directory on one of the mirror sites.
Have a look at The 4.9 Errata page for a list of bugs and workarounds. @@ -42,14 +54,14 @@ All applicable copyrights and credits are in the src.tar.gz, sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the files fetched via ports.tar.gz. -
+

What's New

This is a partial list of new features and systems included in OpenBSD 4.9. For a comprehensive list, see the changelog leading to 4.9. @@ -62,8 +74,8 @@

OpenBSD/amd64 and OpenBSD/i386:

Enabled NTFS by default (read-only) on GENERIC kernels. -
Enabled the vmt(4) driver by default for VMWare tools support as a guest. +
Enabled NTFS by default (read-only) on GENERIC kernels. +
Enabled the vmt(4) driver by default for VMWare tools support as a guest.
SMP kernels can now boot on machines with up to 64 cores.
Maximum allocation size for i386 bumped to 2G.
Handle >16 disks when searching for kernel boot device. @@ -86,7 +98,7 @@

OpenBSD/sparc64:

The vdsp(4) driver now supports the vDisk 1.1 +
The vdsp(4) driver now supports the vDisk 1.1 protocol, allowing Solaris to run on top of an OpenBSD control domain.

@@ -95,48 +107,48 @@

Improved hardware support, including:

New vte(4) +
New vte(4) driver for RDC R6040 10/100 Ethernet devices.
New rdcphy(4) +
New rdcphy(4) driver for RDC Semiconductor R6040 10/100 Ethernet PHY. -
New rsu(4) +
New rsu(4) driver for Realtek RTL8188SU/RTL8191SU/RTL8192SU USB IEEE 802.11b/g/n wireless devices. -
New urtwn(4) +
New urtwn(4) driver for Realtek RTL8188CU/RTL8192CU USB IEEE 802.11b/g/n wireless devices. -
New utwitch(4) +
New utwitch(4) driver for YUREX USB twitch/jiggle of knee sensor.
Support for AR9271, AR9280+AR7010 and AR9287+AR7010 USB IEEE 802.11a/g/n wireless - adapters has been added to athn(4). + adapters has been added to athn(4).
Support for 82583V - has been added to em(4). + has been added to em(4).
Support for Yukon 88E8059 - has been added to msk(4). + has been added to msk(4).
Support for SiS191 - has been added to se(4). + has been added to se(4).
Support for SAS2004 - has been added to mpii(4). + has been added to mpii(4).
Support for NVIDIA MCP89 SATA - has been added to pciide(4). + has been added to pciide(4).
Support for Mobility Radeon HD 4200 - has been added to radeondrm(4). -
pms(4) support has been significantly reworked and expanded. -
MCLGETI support has been added to xl(4). + has been added to radeondrm(4). +
pms(4) support has been significantly reworked and expanded. +
MCLGETI support has been added to xl(4).
Support for low latency interrupt modulation has been added to - ix(4). + ix(4).
Port multiplier support has been added to - ahci(4) and - sili(4). -
Support for Sun XVR-300 graphics has been added to radeonfb(4). + ahci(4) and + sili(4). +
Support for Sun XVR-300 graphics has been added to radeonfb(4).
Added workaround for BCM5906 A0/1/2 controller silicon bug in - bge(4). -
ugen(4) + bge(4). +
ugen(4) can now be attached along with other drivers to multifunction devices. -
umodem(4) +
umodem(4) now supports more devices. -
umsm(4) +
umsm(4) now supports more mobile broadband devices.
Support for more image processing controls was added to - uvideo(4). + uvideo(4).

@@ -144,43 +156,43 @@

Reworking of the MCLGETI livelock algorithm to improve forwarding and host performance under high network load.
Added support for socket splicing; sockets can be temporarily connected so that the kernel moves data without userland intervention. This will be used by relayd(8) in the next release. +
Added support for socket splicing; sockets can be temporarily connected so that the kernel moves data without userland intervention. This will be used by relayd(8) in the next release.
Added AES-GCM support for IPsec.
Added automatic send and receive buffer scaling for TCP. -
Added wpakey option to ifconfig(8) replacing wpa-psk(8). +
Added wpakey option to ifconfig(8) replacing wpa-psk(8).
TCP acknowledgments are no longer delayed on the loopback interface. -
Network livelock counters are now exported via sysctl(3). +
Network livelock counters are now exported via sysctl(3).
A radix tree sorting bug was fixed, which results in significant improvements to IPsec performance under certain conditions. -
tcpdump(8) now decodes Multicast DNS (mDNS) traffic. -
Wake on Lan support has been added to arp(8). -
Enabled MPLS and mpe(4) by default on GENERIC kernels.
Added a mpls option to ifconfig(8) to enable MPLS on a per interface basis replacing the global sysctl knob.
tcpdump(8) now decodes Multicast DNS (mDNS) traffic. +
Wake on Lan support has been added to arp(8). +
Enabled MPLS and mpe(4) by default on GENERIC kernels.
Added a mpls option to ifconfig(8) to enable MPLS on a per interface basis replacing the global sysctl knob.

OpenBGPD, OpenOSPFD and other routing daemon improvements:

bgpd(8) handles various message encoding errors more gracefully now.
Notification messages are now logged in bgpd(8).
ospfd(8) will now correctly redistribute overlapping routes.
ospfctl(8) now prints the LSDB checksum in the show summary output for quick verification that two LSDBs are in sync.
Fixed ldpd(8)'s message parser to work on all architectures and more LDP messages are now implemented.
Various improvements in ospf6d(8).
bgpd(8) handles various message encoding errors more gracefully now.
Notification messages are now logged in bgpd(8).
ospfd(8) will now correctly redistribute overlapping routes.
ospfctl(8) now prints the LSDB checksum in the show summary output for quick verification that two LSDBs are in sync.
Fixed ldpd(8)'s message parser to work on all architectures and more LDP messages are now implemented.
Various improvements in ospf6d(8).

pf(4) improvements: +

pf(4) improvements:

The logging subsystem has been largely rewritten, now logging the translated addresses again instead of the original ones.
match log rules cause a log on the fly, showing the packet exactly - as pf(4) sees it at the moment of evaluating that rule. A packet can also + as pf(4) sees it at the moment of evaluating that rule. A packet can also be logged more than once now.
match log(matches) rules allow the further rule matching to be traced. -
pflog(4) +
pflog(4) now includes the original addresses and ports for packets that have been rewritten. This is also displayed by - tcpdump(8). + tcpdump(8).

@@ -190,7 +202,7 @@

ARC4 based PRNG code was audited and revamped.

New explicit_bzero kernel function was introduced to prevent a compiler from optimizing - bzero + bzero calls away.

@@ -199,42 +211,42 @@

Improved safety when detaching SCSI devices by waiting for the completion of pending commands.
Improved hotplug support on mpi(4) and - mpii(4).
Improved hotplug support on mpi(4) and + mpii(4).
Continued iopoolification of SCSI drivers, notably on - umass(4) which improves the + umass(4) which improves the reliability and performance of multi-LUN devices.
Added vscsi(4), a driver for +
Added vscsi(4), a driver for userland handling of SCSI device commands. -
Added iscsid(8), an iSCSI initiator. +
Added iscsid(8), an iSCSI initiator.
Forcibly restrict devices incapable of tagged I/O to executing one command at a time. -
Discover and honour read-only status of sd(4) devices. -
Improve st(4) handling of I/O residual information. -
sd(4) devices that can only execute one command at a time (e.g. USB) will now be allowed to spin up if necessary. -
cd(4) will now attach CDROM devices identified as non-removable. +
Discover and honour read-only status of sd(4) devices. +
Improve st(4) handling of I/O residual information. +
sd(4) devices that can only execute one command at a time (e.g. USB) will now be allowed to spin up if necessary. +
cd(4) will now attach CDROM devices identified as non-removable.

Assorted improvements:

Enabled wide character support in ncurses(3). -
Added nsd(8), an authoritative name server implementation. +
Enabled wide character support in ncurses(3). +
Added nsd(8), an authoritative name server implementation.
Disklabel UID support improved and added to more utilities. -
rarpd(8) now accepts a list of interfaces to listen on. -
dhclient(8) now accepts 'egress' as an interface name, meaning whichever interface is marked as being in the 'egress' group. -
dhcpd(8) no longer listens on interfaces without a broadcast address (e.g. pflog(4)). -
who(1) now displays as much of the hostname as fits on the line. -
tcpdump(8) now correctly handles 'net' primitives when processing pflog(4) traffic. -
fdisk(8) now respects failure to read the MBR. -
fdisk(8) will no longer infinitely loop when encountering an improperly constructed EBR. -
disklabel(8) no longer reuses information from a failed partition addition on the next addition of the same partition. -
Many unused and obsolete disktab(5) entries removed. +
rarpd(8) now accepts a list of interfaces to listen on. +
dhclient(8) now accepts 'egress' as an interface name, meaning whichever interface is marked as being in the 'egress' group. +
dhcpd(8) no longer listens on interfaces without a broadcast address (e.g. pflog(4)). +
who(1) now displays as much of the hostname as fits on the line. +
tcpdump(8) now correctly handles 'net' primitives when processing pflog(4) traffic. +
fdisk(8) now respects failure to read the MBR. +
fdisk(8) will no longer infinitely loop when encountering an improperly constructed EBR. +
disklabel(8) no longer reuses information from a failed partition addition on the next addition of the same partition. +
Many unused and obsolete disktab(5) entries removed.
Enabled X11 autoconfiguration on sparc and sparc64. -
Implement attribute syntax from RFC4517 and support bsdauth in ldapd(8). -
New video(1) utility which can record or display images from video(4). -
httpd(8) mod_headers now handles apache2 style RequestHeader directives. -
UNIX-domain datagram socket support has been added to nc(1) (-uU option). -
Added support for terabyte units in disklabel(8). +
Implement attribute syntax from RFC4517 and support bsdauth in ldapd(8). +
New video(1) utility which can record or display images from video(4). +
httpd(8) mod_headers now handles apache2 style RequestHeader directives. +
UNIX-domain datagram socket support has been added to nc(1) (-uU option). +
Added support for terabyte units in disklabel(8).
loongson and sgi platforms have been switched over to gcc4. @@ -244,21 +256,21 @@ landisk platform, resulting in a 44-50% gain in performance.
PCIe extended configuration space can now be viewed using - pcidump(8) (-xxx option). + pcidump(8) (-xxx option).
The number of spurious IPIs has been decreased on the amd64 platform, resulting in improved performance.
Numerous improvements and bug fixes to - tmux(1). + tmux(1).
Considerable robustness and interoperability improvements in the IKEv2 daemon - iked(8). + iked(8).
Skipjack and libdes were retired from the system. CAST-128 implementation was also removed from libc.
Removed some races in the USB subsystem, substantially increasing reliability.
Added a few more - compat_linux(8) + compat_linux(8) system calls to make it possible for newer versions of applications, such as Skype, to execute.
OpenBSD-specific package documentation is now centralised in @@ -279,19 +291,19 @@
Upgrade now defaults to checking only the root filesystem.
Upgrade no longer checks filesystems with a fs_passno of 0.
Upgrade now asks if it should proceed even if one or more filesystem mounts fail. -
Installer now configures ntpd(8) to use all provided time source IPs. +
Installer now configures ntpd(8) to use all provided time source IPs.

New rc.d(8) +

New rc.d(8) for starting, stopping and reconfiguring package daemons:

The rc.subr(8) +
The rc.subr(8) framework allows for easy creation of rc scripts. This framework is still evolving.
Only a handful of packages have migrated for now.
rc.local can still be used instead of or in addition to - rc.d(8). + rc.d(8).

@@ -303,93 +315,93 @@ and host/user keys (ECDSA) as specified by RFC5656. ECDH and ECDSA offer better performance than plain DH and DSA at the same equivalent symmetric key length, as well as much shorter keys.

sftp(1) +

sftp(1) and - sftp-server(8): + sftp-server(8): add a protocol extension to support a hard link operation. It is available through the "ln" command in the client. The old "ln" behaviour of creating a symlink is available using its "-s" option or through the preexisting "symlink" command.

scp(1): +

scp(1): Add a new -3 option to scp: Copies between two remote hosts are transferred through the local host. Without this option the data is copied directly between the two remote hosts.

ssh(1): +

ssh(1): automatically order the hostkeys requested by the client based on which hostkeys are already recorded in known_hosts. This avoids hostkey warnings when connecting to servers with new ECDSA keys, since these are now preferred when learning hostkeys for the first time.

ssh(1) +

ssh(1) and - sshd(8): + sshd(8): add a new IPQoS option to specify arbitrary TOS/DSCP/QoS values instead of hardcoding lowdelay/throughput. (bz#1733)

sftp(1): +

sftp(1): the sftp client is now significantly faster at performing directory listings, using OpenBSD glob(3) extensions to preserve the results of stat(3) operations performed in the course of its execution rather than performing expensive round trips to fetch them again afterwards.

ssh(1): +

ssh(1): "atomically" create the listening mux socket by binding it on a temporary name and then linking it into position after listen() has succeeded. This allows the mux clients to determine that the server socket is either ready or stale without races. Stale server sockets are now automatically removed. (also fixes bz#1711)

ssh(1) +

ssh(1) and - sshd(8): + sshd(8): add a KexAlgorithms knob to the client and server configuration to allow selection of which key exchange methods are used by - ssh(1) + ssh(1) and - sshd(8) + sshd(8) and their order of preference.

sftp(1) +

sftp(1) and - scp(1): + scp(1): factor out bandwidth limiting code from - scp(1) + scp(1) into a generic bandwidth limiter that can be attached using the atomicio callback mechanism and use it to add a bandwidth limit option to - sftp(1). + sftp(1). (bz#1147)

The following significant bugs have been fixed in this release:

ssh(1) +
ssh(1) and - ssh-agent(1): + ssh-agent(1): honour $TMPDIR for client xauth and ssh-agent temporary directories. (bz#1809)
ssh(1): +
ssh(1): avoid NULL deref on receiving a channel request on an unknown or invalid channel. (bz#1842)
sshd(8): +
sshd(8): remove a debug() that pollutes stderr on client connecting to a server in debug mode. (bz#1719)
scp(1): +
scp(1): pass through ssh command-line flags and options when doing remote-remote transfers, e.g. to enable agent forwarding which is particularly useful in this case. (bz#1837)
sftp-server(8): +
sftp-server(8): umask should be parsed as octal.
sftp(1): +
sftp(1): escape '[' in filename tab-completion.
ssh(1): +
ssh(1): Typo in confirmation message. (bz#1827)
sshd(8): +
sshd(8): prevent free() of string in .rodata when overriding AuthorizedKeys in a Match block.
sshd(8): +
sshd(8): Use default shell /bin/sh if $SHELL is "".
ssh(1): +
ssh(1): kill proxy command on fatal() (we already killed it on clean exit).
ssh(1): +
ssh(1): install a SIGCHLD handler to reap expired child process. (bz#1812)
Support building against openssl-1.0.0a

Mandoc 1.10.9:

New integrated tbl(7) parser and renderer. -
Support the roff(7) .de, .rm, and .so requests. -
Support all roff code used in the standard pod2man(1) preamble. -
Fully support roff quoting in man(7) documents. +
New integrated tbl(7) parser and renderer. +
Support the roff(7) .de, .rm, and .so requests. +
Support all roff code used in the standard pod2man(1) preamble. +
Fully support roff quoting in man(7) documents.
Mandoc now copes with most formatting errors that used to be fatal.
Much simplified and improved reporting of errors and warnings.
Significantly improved -Thtml output quality. @@ -415,26 +427,20 @@
Over 6,800 ports, major robustness and speed improvements in package tools.

Many pre-built packages for each architecture: - - -

i386: 6620
sparc64: 6225
alpha: 6000 -

sh: 3656
amd64: 6570
powerpc: 6272 -

sparc: 4184
arm: 5679
hppa: 5838 -

vax: 1068
mips64: 5492
mips64el: 5499 -

Some highlights:

Gnome 2.32.1. @@ -481,15 +487,15 @@
Binutils 2.15 (+ patches)
Gdb 6.3 (+ patches)

How to install

Following this are the instructions which you would have on a piece of paper if you had purchased a CDROM set instead of doing an alternate form of install. The instructions for doing an FTP (or other style @@ -526,14 +532,16 @@

Quick installer information for people familiar with OpenBSD, and the use of the "disklabel -E" command. If you are at all confused when installing OpenBSD, read the relevant INSTALL.* file as listed above! -

OpenBSD/i386:

Play with your BIOS options to enable booting from a CD. The OpenBSD/i386 release is on CD1. If your BIOS does not support booting from CD, you will need to create a boot floppy to install from. To create a boot floppy write @@ -556,26 +564,25 @@ To make a boot floppy under MS-DOS, use the "rawrite" utility located at CD1:4.9/tools/rawrite.exe. To make the boot floppy under a Unix OS, use the -dd(1) +dd(1) utility. The following is an example usage of -dd(1), +dd(1), where the device could be "floppy", "rfd0c", or "rfd0a". -

+ # dd if=<file> of=/dev/<device> bs=32k
-

Make sure you use properly formatted perfect floppies with NO BAD BLOCKS or your install will most likely fail. For more information on creating a boot floppy and installing OpenBSD/i386 please refer to this page. -

OpenBSD/amd64:

If you are planning to dual boot OpenBSD with another OS, you will need to read INSTALL.amd64. -

OpenBSD/macppc:

OpenBSD/macppc boot

Alternatively, at the Open Firmware prompt, enter boot cd:,ofwboot /4.9/macppc/bsd.rd -

OpenBSD/sparc64:

boot cdrom

@@ -625,12 +630,11 @@

If nothing works, you can boot over the network as described in INSTALL.sparc64. -

OpenBSD/alpha:

Write FTP:4.9/alpha/floppy49.fs or +Write FTP:4.9/alpha/floppy49.fs or FTP:4.9/alpha/floppyB49.fs (depending on your machine) to a diskette and enter boot dva0. Refer to INSTALL.alpha for more details. @@ -638,12 +642,9 @@ Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail. -

OpenBSD/armish:

After connecting a serial port, Thecus can boot directly from the network either tftp or http. Configure the network using fconfig, reset, then load bsd.rd, see INSTALL.armish for specific details. @@ -651,65 +652,50 @@ and copy 'boot' and bsd.rd into the first partition on wd0 (hda1) then load and run bsd.rd, preserving the wd0i (hda1) ext2fs partition. More details are available in INSTALL.armish. -

OpenBSD/hp300:

Boot over the network by following the instructions in INSTALL.hp300. -

OpenBSD/hppa:

Boot over the network by following the instructions in INSTALL.hppa or the hppa platform page. -

OpenBSD/landisk:

Write miniroot49.fs to the start of the CF or disk, and boot normally. -

OpenBSD/loongson:

Write miniroot49.fs to a USB stick and boot bsd.rd from it or boot bsd.rd via tftp. Refer to the instructions in INSTALL.loongson for more details. -

OpenBSD/mvme68k:

You can create a bootable installation tape or boot over the network.
The network boot requires a MVME68K BUG version that supports the NIOT and NBO debugger commands. Follow the instructions in INSTALL.mvme68k for more details. -

OpenBSD/mvme88k:

You can create a bootable installation tape or boot over the network.
The network boot requires a MVME88K BUG version that supports the NIOT and NBO debugger commands. Follow the instructions in INSTALL.mvme88k for more details. -

OpenBSD/sgi:

To install on an O2, burn cd49.iso on a CD-R, put it in the CD drive of your machine and select Install System Software from the System Maintenance menu. @@ -719,27 +705,24 @@ setup a DHCP/tftp network server, and boot using "bootp()/bsd.rd.IP##" using the kernel matching your system type. Refer to the instructions in INSTALL.sgi for more details. -

OpenBSD/socppc:

After connecting a serial port, boot over the network via DHCP/tftp. Refer to the instructions in INSTALL.socppc for more details. -

OpenBSD/sparc:

-ok boot cdrom 4.9/sparc/bsd.rd
++ok boot cdrom 4.9/sparc/bsd.rd
 or
-> b sd(0,6,0)4.9/sparc/bsd.rd
-

b sd(0,6,0)4.9/sparc/bsd.rd

If your SPARC system does not have a CD drive, you can alternatively boot from floppy. @@ -748,11 +731,11 @@ To boot from the floppy use one of the two commands listed below, depending on the version of your ROM. -

-ok boot floppy
++ok boot floppy
 or
-> b fd()
-

b fd()

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install @@ -762,45 +745,46 @@ If your SPARC system doesn't have a floppy drive nor a CD drive, you can either setup a bootable tape, or install via network, as told in the INSTALL.sparc file. -

OpenBSD/vax:

Boot over the network via mopbooting as described in INSTALL.vax. - +

OpenBSD/zaurus:

Using the Linux built-in graphical ipkg installer, install the openbsd49_arm.ipk package. Reboot, then run it. Read INSTALL.zaurus for a few important details. -

+ +

Notes about the source code:

+# mkdir -p /usr/src
+# cd /usr/src
+# tar xvfz /tmp/src.tar.gz
+

-# mkdir -p /usr/src
-# cd /usr/src
-# tar xvfz /tmp/src.tar.gz
-

sys.tar.gz contains a source archive starting at /usr/src/sys. This file contains all the kernel sources you need to rebuild kernels. To extract: -

-# mkdir -p /usr/src/sys
-# cd /usr/src
+
++# mkdir -p /usr/src/sys
+# cd /usr/src
 # tar xvfz /tmp/sys.tar.gz
-

Both of these trees are a regular CVS checkout. Using these trees it is possible to get a head-start on using the anoncvs servers as @@ -808,30 +792,32 @@ Using these files results in a much faster initial CVS update than you could expect from a fresh checkout of the full OpenBSD source tree. -

- +

-OpenBSD -4.9 +OpenBSD +4.9

What's New

What's New

How to install

How to install

OpenBSD/i386:

OpenBSD/i386:

OpenBSD/amd64:

OpenBSD/amd64:

OpenBSD/macppc:

OpenBSD/macppc:

OpenBSD/sparc64:

OpenBSD/sparc64:

OpenBSD/alpha:

OpenBSD/alpha:

OpenBSD/armish:

OpenBSD/armish:

OpenBSD/hp300:

OpenBSD/hp300:

OpenBSD/hppa:

OpenBSD/hppa:

OpenBSD/landisk:

OpenBSD/landisk:

OpenBSD/loongson:

OpenBSD/loongson:

OpenBSD/mvme68k:

OpenBSD/mvme68k:

OpenBSD/mvme88k:

OpenBSD/mvme88k:

OpenBSD/sgi:

OpenBSD/sgi:

OpenBSD/socppc:

OpenBSD/socppc:

OpenBSD/sparc:

OpenBSD/sparc:

OpenBSD/vax:

OpenBSD/vax:

OpenBSD/zaurus:

OpenBSD/zaurus:

Notes about the source code:

Notes about the source code:

How to upgrade

How to upgrade

Ports Tree

Ports Tree