www/55.html - diff

<li>Support for CoreChip RD9700 USB Ethernet devices has been added to the <a href="https://man.openbsd.org/?query=udav&sektion=4">udav(4)</a> driver.

<li>Further reliability improvements regarding suspend/resume and hibernation.

<li>Enabled IPv6 transmit TCP/UDP checksum offload in

<a href="http://man.openbsd.org/?query=jme&sektion=4">jme(4)</a>.

<a href="https://man.openbsd.org/?query=jme&sektion=4">jme(4)</a>.

</ul>

<li>Generic network stack improvements:

<ul>

<li>Added <a href="http://man.openbsd.org/?query=vxlan&sektion=4">vxlan(4)</a>,

<li>Added <a href="https://man.openbsd.org/?query=vxlan&sektion=4">vxlan(4)</a>,

a virtual extensible local area network tunnel interface.

<li><a href="http://man.openbsd.org/?query=pflow&sektion=4">pflow(4)</a>

<li><a href="https://man.openbsd.org/?query=pflow&sektion=4">pflow(4)</a>

now sends 64 bit time values for pflowproto 10. The changed templates /

flows for pflowproto 10 are now parsable by existing receivers.

<li>Continued improvement of the checksum offload framework to streamline

Line 210

<li>Routing daemons and other userland network improvements:

<ul>

<li>The popa3d POP3 server has been removed.

<li>Added <a href="http://man.openbsd.org/?query=ntpctl&sektion=8">ntpctl(8)</a>,

<li>Added <a href="https://man.openbsd.org/?query=ntpctl&sektion=8">ntpctl(8)</a>,

a program to control the Network Time Protocol daemon.

<li><a href="http://man.openbsd.org/?query=slowcgi&sektion=8">slowcgi(8)</a>

<li><a href="https://man.openbsd.org/?query=slowcgi&sektion=8">slowcgi(8)</a>

now works with a high number of concurrent connections.

<li>The inetd-based identd has been replaced by a new libevent-based

<a href="http://man.openbsd.org/?query=identd&sektion=8">identd(8)</a>.

<a href="https://man.openbsd.org/?query=identd&sektion=8">identd(8)</a>.

<li><a href="http://man.openbsd.org/?query=tcpdump&sektion=8">tcpdump(8)</a>

<li><a href="https://man.openbsd.org/?query=tcpdump&sektion=8">tcpdump(8)</a>

can now detect bad ICMP and ICMPv6 checksums when used with the -v flag.

<li>Added rdomain support to IPv6 configuration tools

<a href="http://man.openbsd.org/?query=ndp&sektion=8">ndp(8)</a>,

<a href="https://man.openbsd.org/?query=ndp&sektion=8">ndp(8)</a>,

<a href="http://man.openbsd.org/?query=rtsold&sektion=8">rtsold(8)</a>,

<a href="https://man.openbsd.org/?query=rtsold&sektion=8">rtsold(8)</a>,

<a href="http://man.openbsd.org/?query=ping6&sektion=8">ping6(8)</a>, and

<a href="https://man.openbsd.org/?query=ping6&sektion=8">ping6(8)</a>, and

<a href="http://man.openbsd.org/?query=traceroute6&sektion=8">traceroute6(8)</a>.

<a href="https://man.openbsd.org/?query=traceroute6&sektion=8">traceroute6(8)</a>.

<li>Added SNMPv2 client support to

<a href="http://man.openbsd.org/?query=snmpctl&sektion=8">snmpctl(8)</a>

<a href="https://man.openbsd.org/?query=snmpctl&sektion=8">snmpctl(8)</a>

("get", "walk", and "bulkwalk").

<li><a href="http://man.openbsd.org/?query=relayd&sektion=8">relayd(8)</a>

<li><a href="https://man.openbsd.org/?query=relayd&sektion=8">relayd(8)</a>

now supports TLS Perfect Forward Secrecy (PFS) with ECDHE (Elliptic curve Diffie-Hellman) that is enabled by default.

</ul>

<li><a href="http://man.openbsd.org/?query=pf&sektion=4">pf(4)</a> improvements:

<li><a href="https://man.openbsd.org/?query=pf&sektion=4">pf(4)</a> improvements:

<ul>

<li>New queueing system with new syntax.

<li>The "received-on" parameter can now be used with the "any" keyword to

match any existing interface except loopback ones.

<li>The block policy in the default <a href="http://man.openbsd.org/?query=pf.conf&sektion=5">pf.conf(5)</a> is now "block return".

<li>The block policy in the default <a href="https://man.openbsd.org/?query=pf.conf&sektion=5">pf.conf(5)</a> is now "block return".

</ul>

<li><a href="http://man.openbsd.org/?query=dhcpd&sektion=8">dhcpd(8)</a> and <a href="http://man.openbsd.org/?query=dhclient&sektion=8">dhclient(8)</a> improvements:

<li><a href="https://man.openbsd.org/?query=dhcpd&sektion=8">dhcpd(8)</a> and <a href="https://man.openbsd.org/?query=dhclient&sektion=8">dhclient(8)</a> improvements:

<ul>

<li>No longer create a route to the bound address via 127.0.0.1.

<li>The options 'dhcp-lease-time', 'dhcp-rebinding-time', and 'dhcp-renewal-time' can now be configured in <a href="http://man.openbsd.org/?query=dhclient.conf&sektion=5">dhclient.conf(5)</a>.

<li>The options 'dhcp-lease-time', 'dhcp-rebinding-time', and 'dhcp-renewal-time' can now be configured in <a href="https://man.openbsd.org/?query=dhclient.conf&sektion=5">dhclient.conf(5)</a>.

<li>'next-server' (a.k.a. siaddr) info now saved in lease files.

<li>Fall back to broadcasting when unicast renewal fails, as specified in

RFC 2131 and friends.

Line 254

<li>Fix 'effective' lease created by '-L' to have correct address, 'next_server', 'timestamp', and 'resolv_conf' fields.

<li>Fix handling of non-printable characters in lease file strings.

<li>Fix many edge cases in config file and lease parsing and ensure that error messages refer to the correct position in erroneous line.

<li><a href="http://man.openbsd.org/?query=dhclient.conf&sektion=5">dhclient.conf(5)</a> can now override anything in an offer or saved lease when creating the effective lease. In particular, 'fixed-address', 'next-server', 'filename' and 'server-name'.

<li><a href="https://man.openbsd.org/?query=dhclient.conf&sektion=5">dhclient.conf(5)</a> can now override anything in an offer or saved lease when creating the effective lease. In particular, 'fixed-address', 'next-server', 'filename' and 'server-name'.

<li>Fix parsing of <a href="http://man.openbsd.org/?query=dhclient.conf&sektion=5">dhclient.conf(5)</a> statements 'fixed-address' and

<li>Fix parsing of <a href="https://man.openbsd.org/?query=dhclient.conf&sektion=5">dhclient.conf(5)</a> statements 'fixed-address' and

'next-server'.

<li>Log failures to fchmod() or fchown() files being written.

<li>Create lease files with permissions 0640.

<li>Fix possible failure to write <a href="http://man.openbsd.org/?query=resolv.conf&sektion=5">resolv.conf(5)</a> when -L is used.

<li>Fix possible failure to write <a href="https://man.openbsd.org/?query=resolv.conf&sektion=5">resolv.conf(5)</a> when -L is used.

<li>'send dhcp-client-identifier "";' in <a href="http://man.openbsd.org/?query=dhclient.conf&sektion=5">dhclient.conf(5)</a> will result in no 'dhcp-client-identifier' (option 61) being sent.

<li>'send dhcp-client-identifier "";' in <a href="https://man.openbsd.org/?query=dhclient.conf&sektion=5">dhclient.conf(5)</a> will result in no 'dhcp-client-identifier' (option 61) being sent.

</ul>

<li><a href="http://man.openbsd.org/?query=iked&sektion=8">iked(8)</a> improvements:

<li><a href="https://man.openbsd.org/?query=iked&sektion=8">iked(8)</a> improvements:

<ul>

<li>Support for OCSP ("Online Certificate Status Protocol"); enable with "set ocsp URL".

<li>Support for RSA public key authentication as an alternative to X.509 certificates or pre-shared keys.

<li>Support for DPD ("Dead Peer Detection") similar to the implementation in

<a href="http://man.openbsd.org/?query=isakmpd&sektion=8">isakmpd(8)</a>.

<a href="https://man.openbsd.org/?query=isakmpd&sektion=8">isakmpd(8)</a>.

<li>Support for dynamic IP address assignment from a pool in configuration mode; enabled with "config address net/pool-prefix".

<li>Initial support for IPComp.

<li>Various improvements and a thorough audit of the network input path.

Line 289

<li>other processes now have an API to return more precise codes ...

<li>... which will be improved further with each version.

</ul>

<li>Improved <a href="http://man.openbsd.org/?query=smtpctl&sektion=8">smtpctl(8)</a>:

<li>Improved <a href="https://man.openbsd.org/?query=smtpctl&sektion=8">smtpctl(8)</a>:

<ul>

<li>sendmail mode now supports DSN parameters

<li>Can now pause/resume a source address -> destination domain route.

Line 341

</ul>

<li>Documentation:

<ul>

<li><a href="http://man.openbsd.org/?query=table&sektion=5">table(5)</a> describes format for static, file and db backends.

<li><a href="https://man.openbsd.org/?query=table&sektion=5">table(5)</a> describes format for static, file and db backends.

<li>sendmail(8) describes our "sendmail" interface.

</ul>

<li>Reduced memory usage in both general and stressed cases.

<li>OpenSMTPD now automagically upgrades queue if the format changes!

<li>Support Qmail-like "sticky home".

<li>Support for authenticating users from a credentials table.

<li>Introduce <a href="http://man.openbsd.org/?query=passwd&sektion=5">passwd(5)</a> table backend for user and credentials lookup.

<li>Introduce <a href="https://man.openbsd.org/?query=passwd&sektion=5">passwd(5)</a> table backend for user and credentials lookup.

<li>Expansion variables in ~/.forward now support modifiers.

<li>Much more efficient scheduler!

<li>Many documentation fixes and improvements.

Line 359

<li>Security improvements:

<ul>

<li>Position-independent executables (PIE) are now used by default on i386.

<li>The <a href="http://man.openbsd.org/?query=arc4random&sektion=3">arc4random(3)</a>

<li>The <a href="https://man.openbsd.org/?query=arc4random&sektion=3">arc4random(3)</a>

functions now use the ChaCha20 cipher.

<li>The kernel random number system is initially seeded by the bootloader,

providing better random very early.

<li>Kernel stack protector is also seeded via the same mechanism, providing

protection earlier.

<li>-Wbounded is now enabled in GCC by default.

<li>Added <a href="http://man.openbsd.org/?query=explicit_bzero&sektion=3">explicit_bzero(3)</a>.

<li>Added <a href="https://man.openbsd.org/?query=explicit_bzero&sektion=3">explicit_bzero(3)</a>.

</ul>

Line 378

<li>Threading improvements:

<ul>

<li>Interprocess semaphores via <a href="http://man.openbsd.org/?query=sem_open&sektion=3">sem_open(3)</a>.

<li>Interprocess semaphores via <a href="https://man.openbsd.org/?query=sem_open&sektion=3">sem_open(3)</a>.

<li>Running threaded processes under a debugger no longer causes panics.

<li>SIGPROF and SIGVTALRM are now reliably delivered to the thread that was running when they were triggered.

<li>Thread stacks now have a random bias.

<li><a href="http://man.openbsd.org/?query=fork&sektion=2">fork(2)</a> no longer changes the pthread_t of the forking thread in the child.

<li><a href="https://man.openbsd.org/?query=fork&sektion=2">fork(2)</a> no longer changes the pthread_t of the forking thread in the child.

<li>Signaling races eliminated from <a href="http://man.openbsd.org/?query=pthread_kill&sektion=3">pthread_kill(3)</a> and <a href="http://man.openbsd.org/?query=pthread_cancel&sektion=3">pthread_cancel(3)</a>.

<li>Signaling races eliminated from <a href="https://man.openbsd.org/?query=pthread_kill&sektion=3">pthread_kill(3)</a> and <a href="https://man.openbsd.org/?query=pthread_cancel&sektion=3">pthread_cancel(3)</a>.

</ul>

<li>Assorted improvements:

<ul>

<li>New in-memory file system, <a href="http://man.openbsd.org/?query=mount_tmpfs&sektion=8">tmpfs</a>.

<li>New in-memory file system, <a href="https://man.openbsd.org/?query=mount_tmpfs&sektion=8">tmpfs</a>.

<li>Many <a href="http://man.openbsd.org/?query=fuse&sektion=4">fuse(4)</a> improvements and stability fixes.

<li>Many <a href="https://man.openbsd.org/?query=fuse&sektion=4">fuse(4)</a> improvements and stability fixes.

<li>Added POSIX-required <a href="http://man.openbsd.org/?query=nl&sektion=1">nl(1)</a> utility.

<li>Added POSIX-required <a href="https://man.openbsd.org/?query=nl&sektion=1">nl(1)</a> utility.

<li>OpenBSD/vax has switched to GCC 3.

<li>Replaced <a href="http://man.openbsd.org/?query=getdirentries&sektion=2&manpath=OpenBSD+5.4">getdirentries(2)</a> with <a href="http://man.openbsd.org/?query=getdents&sektion=2">getdents(2)</a>, vastly improving the performance and memory usage of <a href="http://man.openbsd.org/?query=telldir&sektion=3">telldir(3)</a>.

<li>Replaced <a href="https://man.openbsd.org/?query=getdirentries&sektion=2&manpath=OpenBSD+5.4">getdirentries(2)</a> with <a href="https://man.openbsd.org/?query=getdents&sektion=2">getdents(2)</a>, vastly improving the performance and memory usage of <a href="https://man.openbsd.org/?query=telldir&sektion=3">telldir(3)</a>.

<li>amd64 and i386 now use the MWAIT instruction for their idle loop where available to reduce latency.

<li>Added support for CLOCK_UPTIME.

<li>Added <a href="http://man.openbsd.org/?query=tcgetsid&sektion=3">tcgetsid(3)</a>.

<li>Added <a href="https://man.openbsd.org/?query=tcgetsid&sektion=3">tcgetsid(3)</a>.

<li>clock_t is now a 64 bit type, so it no longer wraps around in only 248 days.

<li>ino_t is now a 64 bit type, mostly to support large NFS filesystems.

<li>Corrected handling of UTIME_OMIT.

<li><a href="http://man.openbsd.org/?query=pax&sektion=1">pax(1)</a> now sets the mode and timestamps correctly on symlinks, and makes hardlinks to symlinks when requested.

<li><a href="https://man.openbsd.org/?query=pax&sektion=1">pax(1)</a> now sets the mode and timestamps correctly on symlinks, and makes hardlinks to symlinks when requested.

<li>Corrected handling of shared library destructors when libc is statically linked.

<li>Corrected various disk drivers to handle non-512-byte sectors and disk sizes greater than 32-bits.

<li>Corrected <a href="http://man.openbsd.org/?query=growfs&sektion=8">growfs(8)</a> to handle non-512-byte sectors and disk sizes greater than 32-bits.

<li>Corrected <a href="https://man.openbsd.org/?query=growfs&sektion=8">growfs(8)</a> to handle non-512-byte sectors and disk sizes greater than 32-bits.

<li>All CIRCLEQ uses replaced with TAILQ.

<li>Preserve and honour changes to the OpenBSD bounds in a disklabel.

<li><a href="http://man.openbsd.org/?query=fdisk&sektion=8">fdisk(8)</a> now always writes a good signature when the MBR is written to disk.

<li><a href="https://man.openbsd.org/?query=fdisk&sektion=8">fdisk(8)</a> now always writes a good signature when the MBR is written to disk.

<li><a href="http://man.openbsd.org/?query=disklabel&sektion=8">disklabel(8)</a> now writes the disklabel to the correct location on non-512-byte sector devices.

<li><a href="https://man.openbsd.org/?query=disklabel&sektion=8">disklabel(8)</a> now writes the disklabel to the correct location on non-512-byte sector devices.

<li>Fix <a href="http://man.openbsd.org/?query=athn&sektion=4">athn(4)</a> tick calculations to eliminate excessive timeouts.

<li>Fix <a href="https://man.openbsd.org/?query=athn&sektion=4">athn(4)</a> tick calculations to eliminate excessive timeouts.

<li>Allow <a href="http://man.openbsd.org/?query=disklabel&sektion=8">disklabel(8)</a> to set any partition, including 'C', to type UNUSED.

<li>Allow <a href="https://man.openbsd.org/?query=disklabel&sektion=8">disklabel(8)</a> to set any partition, including 'C', to type UNUSED.

<li>New <a href="http://man.openbsd.org/?query=sha512&sektion=1">sha512(1)</a> tool to calculate and verify the SHA-512 checksums of files.

<li>New <a href="https://man.openbsd.org/?query=sha512&sektion=1">sha512(1)</a> tool to calculate and verify the SHA-512 checksums of files.

<li><a href="http://man.openbsd.org/?query=sha256&sektion=1">sha256(1)</a> and related tools

<li><a href="https://man.openbsd.org/?query=sha256&sektion=1">sha256(1)</a> and related tools

(<a href="http://man.openbsd.org/?query=cksum&sektion=1">cksum(1)</a>,

(<a href="https://man.openbsd.org/?query=cksum&sektion=1">cksum(1)</a>,

<a href="http://man.openbsd.org/?query=md5&sektion=1">md5(1)</a>,

<a href="https://man.openbsd.org/?query=md5&sektion=1">md5(1)</a>,

<a href="http://man.openbsd.org/?query=sha1&sektion=1">sha1(1)</a>, and

<a href="https://man.openbsd.org/?query=sha1&sektion=1">sha1(1)</a>, and

<a href="http://man.openbsd.org/?query=sha512&sektion=1">sha512(1)</a>)

<a href="https://man.openbsd.org/?query=sha512&sektion=1">sha512(1)</a>)

now support a new -h flag to place the checksum into a specified hash file instead of stdout.

<li><a href="http://man.openbsd.org/?query=sha256&sektion=1">sha256(1)</a> and related tools now support a new -C flag that allows the verification of selected files in a checklist.

<li><a href="https://man.openbsd.org/?query=sha256&sektion=1">sha256(1)</a> and related tools now support a new -C flag that allows the verification of selected files in a checklist.

<li><a href="http://man.openbsd.org/?query=sha256&sektion=1">sha256(1)</a> and related tools will now print MISSING if they encounter non-existent files in a checklist.

<li><a href="https://man.openbsd.org/?query=sha256&sektion=1">sha256(1)</a> and related tools will now print MISSING if they encounter non-existent files in a checklist.

<li>i386 and amd64 platforms can now boot from keydisk-based <a href="http://man.openbsd.org/?query=softraid&sektion=4">softraid(4)</a> crypto volumes.

<li>i386 and amd64 platforms can now boot from keydisk-based <a href="https://man.openbsd.org/?query=softraid&sektion=4">softraid(4)</a> crypto volumes.

<li>Allow <a href="http://man.openbsd.org/?query=softraid&sektion=4">softraid(4)</a> to work with partitions larger than 2TB.

<li>Allow <a href="https://man.openbsd.org/?query=softraid&sektion=4">softraid(4)</a> to work with partitions larger than 2TB.

<li>Removed experimental RAID 4 support from <a href="http://man.openbsd.org/?query=softraid&sektion=4">softraid(4)</a>.

<li>Removed experimental RAID 4 support from <a href="https://man.openbsd.org/?query=softraid&sektion=4">softraid(4)</a>.

<li>Added experimental support for rebuilding RAID 5 <a href="http://man.openbsd.org/?query=softraid&sektion=4">softraid(4)</a> volumes. Lots of testing is still required and there is missing functionality, such as the ability to resume a partially completed rebuild. <a href="http://man.openbsd.org/?query=bioctl&sektion=8">bioctl(8)</a> refuses to create RAID 5 volumes unless recompiled with -DRAID5.

<li>Added experimental support for rebuilding RAID 5 <a href="https://man.openbsd.org/?query=softraid&sektion=4">softraid(4)</a> volumes. Lots of testing is still required and there is missing functionality, such as the ability to resume a partially completed rebuild. <a href="https://man.openbsd.org/?query=bioctl&sektion=8">bioctl(8)</a> refuses to create RAID 5 volumes unless recompiled with -DRAID5.

<li>The uhts(4) driver has been merged into

<a href="http://man.openbsd.org/?query=ums&sektion=4">ums(4)</a>.

<a href="https://man.openbsd.org/?query=ums&sektion=4">ums(4)</a>.

<li>Many new checks were added to portcheck(1)  utility; now it catches almost every popular mistake that observed in ports in last years.

</ul>

Line 433

<ul>

<li>Security:

<ul>

<li><a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

when using environment passing with a

<a href="http://man.openbsd.org/?query=sshd_config&sektion=5">sshd_config(5)</a>

<a href="https://man.openbsd.org/?query=sshd_config&sektion=5">sshd_config(5)</a>

<tt>AcceptEnv</tt> pattern with a wildcard. OpenSSH prior to 6.6 could

be tricked into accepting any enviornment variable that contains the

characters before the wildcard character.

</ul>

<li>New/changed features:

<ul>

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

Add support for key exchange using elliptic-curve Diffie Hellman

in Daniel Bernstein's Curve25519. This key exchange method is

the default when both the client and server support it.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

Add support for ED25519 as a public key type. ED25519 is

a elliptic curve signature scheme that offers better security than

ECDSA and DSA and good performance. It may be used for

Line 457

protect keys at rest. This format is used unconditionally for

ED25519 keys, but may be requested when generating or saving

existing keys of other types via the <tt>-o</tt>

<a href="http://man.openbsd.org/?query=ssh-keygen&sektion=1">ssh-keygen(1)</a>

<a href="https://man.openbsd.org/?query=ssh-keygen&sektion=1">ssh-keygen(1)</a>

option. We intend to make the new format the default in the near

future. Details of the new format are in the <tt>PROTOCOL.key</tt>

file.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

Add a new transport cipher "chacha20-poly1305@openssh.com" that

combines Daniel Bernstein's ChaCha20 stream cipher and

Poly1305 MAC to build an authenticated encryption mode. Details

are in the <tt>PROTOCOL.chacha20poly1305</tt> file.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

Refuse RSA keys from old proprietary clients and servers that

use the obsolete RSA+MD5 signature scheme. It will still be

possible to connect with these clients/servers but only DSA keys

will be accepted, and OpenSSH will refuse connection entirely in a

future release.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

Refuse old proprietary clients and servers that use a weaker key

exchange hash calculation.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

Increase the size of the Diffie-Hellman groups requested for

each symmetric key size. New values from NIST Special Publication

800-57 with the upper limit specified by RFC 4419.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<a href="http://man.openbsd.org/?query=ssh-agent&sektion=1">ssh-agent(1)</a>:

<a href="https://man.openbsd.org/?query=ssh-agent&sektion=1">ssh-agent(1)</a>:

Support PKCS#11 tokens that only provide X.509 certs

instead of raw public keys. (requested as bz#1908)

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

Add a

<a href="http://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

<a href="https://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

<tt>Match</tt> keyword that allows conditional configuration to be

applied by matching on hostname, user and result of

arbitrary commands.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

Add support for client-side hostname canonicalisation using a

set of DNS suffixes and rules in

<a href="http://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>.

<a href="https://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>.

This allows unqualified names to be canonicalised to fully-qualified

domain names to eliminate ambiguity when looking up keys in

<tt>known_hosts</tt> or checking host certificate names.

<li><a href="http://man.openbsd.org/?query=sftp-server&sektion=8">sftp-server(8)</a>:

<li><a href="https://man.openbsd.org/?query=sftp-server&sektion=8">sftp-server(8)</a>:

Add the ability to whitelist and/or blacklist sftp protocol requests by

name.

<li><a href="http://man.openbsd.org/?query=sftp-server&sektion=8">sftp-server(8)</a>:

<li><a href="https://man.openbsd.org/?query=sftp-server&sektion=8">sftp-server(8)</a>:

Add a sftp "fsync@openssh.com" to support calling

<a href="http://man.openbsd.org/?query=fsync&sektion=2">fsync(2)</a>

<a href="https://man.openbsd.org/?query=fsync&sektion=2">fsync(2)</a>

on an open file handle.

<li><a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

Add a

<a href="http://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

<a href="https://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

<tt>PermitTTY</tt> to disallow TTY allocation, mirroring the

longstanding <tt>no-pty</tt> <tt>authorized_keys</tt> option.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

Add a

<a href="http://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

<a href="https://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

<tt>ProxyUseFDPass</tt> option that supports the use of

<tt>ProxyCommands</tt> that establish a connection and then pass a

connected file descriptor back to

<a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>.

<a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>.

This allows the <tt>ProxyCommand</tt> to exit rather than staying

around to transfer data.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

this release removes the J-PAKE authentication code. This code

was experimental, never enabled and had been unmaintained for some

time.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

when processing <tt>Match</tt> blocks, skip '<tt>exec</tt>' clauses

other clauses predicates failed to match.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

if hostname canonicalisation is enabled and results in the destination

hostname being changed, then re-parse

<a href="http://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

<a href="https://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

files using the new destination hostname. This gives '<tt>Host</tt>'

and '<tt>Match</tt>' directives that use the expanded hostname a chance

to be applied.

</ul>

<li>The following significant bugs have been fixed in this release:

<ul>

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

Fix potential stack exhaustion caused by nested certificates.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

make <tt>BindAddress</tt> work with <tt>UsePrivilegedPort</tt>.

(bz#1211)

<li><a href="http://man.openbsd.org/?query=sftp&sektion=1">sftp(1)</a>:

<li><a href="https://man.openbsd.org/?query=sftp&sektion=1">sftp(1)</a>:

fix the progress meter for resumed transfer. (bz#2137)

<li><a href="http://man.openbsd.org/?query=ssh-add&sektion=1">ssh-add(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh-add&sektion=1">ssh-add(1)</a>:

do not request smartcard PIN when removing keys from

<a href="http://man.openbsd.org/?query=ssh-agent&sektion=1">ssh-agent(1)</a>.

<a href="https://man.openbsd.org/?query=ssh-agent&sektion=1">ssh-agent(1)</a>.

(bz#2187)

<li><a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

fix re-exec fallback when original

binary cannot be executed. (bz#2139)

<li><a href="http://man.openbsd.org/?query=ssh-keygen&sektion=1">ssh-keygen(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh-keygen&sektion=1">ssh-keygen(1)</a>:

Make relative-specified certificate expiry times relative to current

time and not the validity start time.

<li><a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

fix <tt>AuthorizedKeysCommand</tt> inside a <tt>Match</tt> block.

(bz#2161)

<li><a href="http://man.openbsd.org/?query=sftp&sektion=1">sftp(1)</a>:

<li><a href="https://man.openbsd.org/?query=sftp&sektion=1">sftp(1)</a>:

symlinking a file would incorrectly canonicalise the target path.

(bz#2129)

<li><a href="http://man.openbsd.org/?query=ssh-agent&sektion=1">ssh-agent(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh-agent&sektion=1">ssh-agent(1)</a>:

fix a use-after-free in the PKCS#11 agent helper executable.

(bz#2175)

<li><a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

Improve logging of sessions to include the user name, remote

host and port, the session type (shell, command,

etc.) and allocated TTY (if any).

<li><a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

tell the client (via a debug message) when their preferred listen

address has been overridden by the server's <tt>GatewayPorts</tt>

setting. (bz#1297)

<li><a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

include report port in bad protocol banner message. (bz#2162)

<li><a href="http://man.openbsd.org/?query=sftp&sektion=1">sftp(1)</a>:

<li><a href="https://man.openbsd.org/?query=sftp&sektion=1">sftp(1)</a>:

fix memory leak in error path in do_readdir(). (bz#2163)

<li><a href="http://man.openbsd.org/?query=sftp&sektion=1">sftp(1)</a>:

<li><a href="https://man.openbsd.org/?query=sftp&sektion=1">sftp(1)</a>:

don't leak file descriptor on error. (bz#2171)

<li><a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

include the local address and port in "<tt>Connection

from ...</tt>" message. (only shown at loglevel>=verbose)

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

avoid spurious "<tt>getsockname failed: Bad file descriptor</tt>" in

<tt>ssh -W</tt>. (bz#2200, debian#738692)

<li><a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

allow the

<a href="http://man.openbsd.org/?query=shutdown&sektion=2">shutdown(2)</a>

<a href="https://man.openbsd.org/?query=shutdown&sektion=2">shutdown(2)</a>

syscall in seccomp-bpf and systrace sandbox modes, as it is reachable

if the connection is terminated during the pre-auth phase.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

fix unsigned overflow that in SSH protocol 1 bignum parsing.

Minimum key length checks render this bug unexploitable to compromise

SSH 1 sessions.

<li><a href="http://man.openbsd.org/?query=sshd_config&sektion=5">sshd_config(5)</a>

<li><a href="https://man.openbsd.org/?query=sshd_config&sektion=5">sshd_config(5)</a>

clarify behaviour of a keyword that appears in multiple matching

<tt>Match</tt> blocks. (bz#2184)

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

avoid unnecessary hostname lookups when canonicalisation is disabled.

(bz#2205)

<li><a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

avoid sandbox violation crashes in GSSAPI code by caching the supported

list of GSSAPI mechanism OIDs before entering the sandbox. (bz#2107)

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

fix possible crashes in SOCKS4 parsing caused by assumption that the

SOCKS username is nul-terminated.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

fix regression for <tt>UsePrivilegedPort=yes</tt> when

<tt>BindAddress</tt> is not specified.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<a href="http://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

fix memory leak in ECDSA signature verification.

<li><a href="http://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

fix matching of '<tt>Host</tt>' directives in

<a href="http://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

<a href="https://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

files to be case-insensitive again. (regression in 6.5)

</ul>

Line 626

<ul>

<li>Over 8,700 ports.

<li>Major overhaul of the package tools, resulting in much better memory usage.

<li><a href="http://man.openbsd.org/?query=pkg_add&sektion=1">pkg_add(1)</a> now only trusts signed packages by default.

<li><a href="https://man.openbsd.org/?query=pkg_add&sektion=1">pkg_add(1)</a> now only trusts signed packages by default.

<li>The build process now allows some limited capability for building

conflicting packages, yielding KDE 4 packages as a result, along

with KDE 3 ones.

Line 814

To make a boot floppy under MS-DOS, use the "rawrite" utility located

at CD1:5.5/tools/rawrite.exe. To make the boot floppy under a Unix OS,

use the

utility. The following is an example usage of

<a href="http://man.openbsd.org/?query=dd&sektion=1">dd(1)</a>,

<a href="https://man.openbsd.org/?query=dd&sektion=1">dd(1)</a>,

where the device could be "floppy", "rfd0c", or

"rfd0a".

Line 1121

OpenBSD ports system.

The ports/ directory represents a CVS (see the manpage for

cvs(1)</a> if

you aren't familiar with CVS) checkout of our ports. As with our complete

source tree, our ports tree is available via