www/59.html - diff

Return to 59.html CVS log

Up to [local] / www

Diff for /www/59.html between version 1.66 and 1.67

version 1.66, 2016/03/09 10:01:23

version 1.67, 2016/03/09 16:57:19

Line 15

<p>

<h2><font color="#0000e0">OpenBSD 5.9</font></h2>

<p>

To be released May 1, 2016<br>

Line 51

are not included on the CDROM because of lack of space.

<p>

<hr>

<p>

<p>

This is a partial list of new features and systems included in OpenBSD 5.9.

For a comprehensive list, see the <a href="plus59.html">changelog</a> leading

to 5.9.

<p>

<ul>

<li>Processor support, including:

Line 143

Line 141

<li>14 ports now use pledge(2): some decompression tools, mutt,

some pdf tools, chromium/iridium, and the i3 window manager.

<li>Various bugs exposed by pledge(2) were corrected.

For example in

For example in <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/bgpd/bgpd.c?rev=1.181&content-type=text/x-cvsweb-markup">

bgpd(8)</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sbin/iked/config.c?rev=1.40&content-type=text/x-cvsweb-markup">

bgpd(8)</a>,

iked(8)</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ldapd/control.c?rev=1.13&content-type=text/x-cvsweb-markup">

ldapd(8)</a>, <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ntpd/constraint.c?rev=1.25&content-type=text/x-cvsweb-markup">

iked(8)</a>,

ntpd(8)</a>, and <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/syslogd/syslogd.c?rev=1.200&content-type=text/x-cvsweb-markup">

syslogd(8)</a>.

ldapd(8)</a>,

ntpd(8)</a>,

and <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/syslogd/syslogd.c?rev=1.200&content-type=text/x-cvsweb-markup">

syslogd(8)</a>.

<li>Several misfeatures were removed, such as:

<ul>

support for HOSTALIASES</a>

support for HOSTALIASES</a> in the

in the

resolver</a>.

support for <tt>lookup yp</tt></a>

resolv.conf(5)</a>.

setuid-preserving code</a>

in tools from binutils.

<li>handling of

ed-style diffs</a> via proc/exec in

patch(1)</a>.

</ul>

<li>Userland programs were audited so that they could be properly annotated

with pledge(2).

This resulted in design changes such as

<ul>

<li>

addition of

privilege separation</a> to

rdate(8)</a>,

<li>

addition of

privilege separation</a> to

sndiod(8)</a>,

<li>or the introduction of the <tt>SOCK_DNS</tt>

socket(2)</a>

socket(2)</a> flag that makes an <tt>SS_DNS</tt> tagged socket

flag that makes an <tt>SS_DNS</tt> tagged socket conceptually different

conceptually different from a plain socket.

from a plain socket.

</ul>

<li>pledge(2) is also used to constrain programs that handle untrusted data

to a very limited subset of POSIX.

For example,

strings(1)</a>

strings(1)</a> or

objdump(1)</a>

objdump(1)</a> from the <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/gnu/usr.bin/binutils-2.17/binutils/objdump.c?rev=1.2&content-type=text/x-cvsweb-markup">

from the

binutils</a> or the <a href="http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/smtpd/ca.c?rev=1.15&content-type=text/x-cvsweb-markup">

RSA-privsep process</a> in

binutils</a>

or the

RSA-privsep process</a> in

smtpd(8)</a>.

</ul>

<p>

Line 242

Line 228

<li>802.11n mode is used by default if supported by the OpenBSD wireless

driver and the access point.

Operation in 802.11a, 802.11b, and 802.11g modes can be forced with

the new <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ifconfig">ifconfig(8)</a>

<tt>mode</tt> subcommand.

</ul>

<p>

Line 275

Line 261

<li>When initializing a GPT the required EFI System partition is automatically created.

<li>When installing to a GPT disk

installboot(8)</a>

now formats the EFI System partition, creates the appropriate directory

structure and copies the required UEFI boot files into place.

<li>...

Line 328

Line 314

<li>Support for looking up hosts via YP has been removed from libc.

The 'yp' lookup method in

resolv.conf</a>

is no longer available.

<li>Support for the HOSTALIASES environment variable has been removed from libc.

</ul>

Line 378

Line 364

The associated fields in the disklabel were also removed.

These functions are now all performed by

installboot(8)</a>.

<li>PowerPC converted to secure-PLT ABI variant.

<li>Perform lazy binding updates in

Line 396

Line 382

system call to tighten pledge(2) restrictions and improve pthread_kill(3)

and pthread_cancel(3) compliance.

<li>Added <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=getpwnam_shadow">

getpwnam_shadow(3)</a>

and <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=getpwuid_shadow">

getpwuid_shadow(3)</a>

to permit tighter pledge(2) restrictions.

<li>Added support to

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=ktrace">ktrace(1)</a>

Line 693

Line 679

<li>Removed support for <tt>DTLS_BAD_VER</tt>. Pre-DTLSv1 implementations

are no longer supported.

<li>The engine command and parameters are removed from

openssl(1)</a>.

Previous releases removed dynamic and built-in engine support already.

<li>SHA-0 is removed, which was withdrawn shortly after publication

twenty years ago.

Line 702

Line 688

<tt>cert.pem</tt> file.

<li>Fixed a leak in

SSL_new(3)</a>

in the error path.

<li>Fixed a memory leak and out-of-bounds access in

OBJ_obj2txt(3)</a>.

<li>Fixed an up-to 7 byte overflow in RC4 when len is not a multiple of

<tt>sizeof(RC4_CHUNK)</tt>.

<li>Added

EVP_aead_chacha20_poly1305_ietf(3)</a>

which matches the

<tt>AEAD</tt> construction introduced in RFC 7539, which is different

than that already used in TLS with

EVP_aead_chacha20_poly1305(3)</a>.

<li>More man pages converted from pod to

format.

Line 753

Line 739

<ul>

<li>The

tls_read(3)</a>

and

tls_write(3)</a>

functions now work better with external event libraries.

<li>Client-side verification is now supported, with the client

supplying the certificate to the server.

<li>Also, when using

tls_connect_fds(3)</a>,

tls_connect_socket(3)</a>

tls_connect_socket(3)</a> or

tls_accept_fds(3)</a>,

<tt>libtls</tt> no longer implicitly closes the passed in sockets.

The caller is responsible for closing them in this case.

</ul>

Line 793

Line 778

<li>Added ability to check certificate validity times with

<tt>libtls</tt>,

tls_peer_cert_notbefore(3)</a>

and

tls_peer_cert_notafter(3)</a>.

<li>Changed

tls_connect_servername(3)</a>

to use the first address that resolves with

getaddrinfo(3)</a>.

taddrinfo(3)</a>.

<li>Remove broken conditional <tt>EVP_CHECK_DES_KEY</tt> code

(non-functional since initial commit in 2004).

<li>Reject too small bits value in

BN_generate_prime_ex(3)</a>,

te_prime_ex(3)</a>,

so that it does not risk becoming negative in

<tt>probable_prime_dh_safe()</tt>.

<li>Changed format of <tt>LIBRESSL_VERSION_NUMBER</tt> to match that of

Line 909

Line 894

</ul>

<hr>

<p>

<h3><font color="#0000e0">How to install</font></h3>

<h3 id="install"><font color="#0000e0">How to install</font></h3>

<p>

Following this are the instructions which you would have on a piece of

paper if you had purchased a CDROM set instead of doing an alternate

form of install. The instructions for doing an HTTP (or other style

Line 923

Line 907

<p>

<hr>

<p>

Please refer to the following files on the three CDROMs or mirror site for

extensive details on how to install OpenBSD 5.9 on your machine:

<p>

<ul>

.../OpenBSD/5.9/alpha/INSTALL.alpha (on CD1)</a>

Line 965

Line 950

.../OpenBSD/5.9/zaurus/INSTALL.zaurus</a>

</ul>

<hr>

<p>

Line 995

Line 982

</ul>

<h3><font color="#e00000">OpenBSD/amd64:</font></h3>

<li>

The OpenBSD/amd64 release is on CD2.

Line 1147

Line 1135

for a few important details.

</ul>

<hr>

<h3><font color="#0000e0">How to upgrade</font></h3>

<h3 id="upgrade"><font color="#0000e0">How to upgrade</font></h3>

If you already have an OpenBSD 5.8 system, and do not want to reinstall,

upgrade instructions and advice can be found in the

<a href="faq/upgrade59.html">Upgrade Guide</a>.

<p>

<hr>

<p>

<h3><font color="#0000e0">Notes about the source code</font></h3>

<h3 id="sourcecode"><font color="#0000e0">Notes about the source code</font></h3>

<p>

src.tar.gz contains a source archive starting at /usr/src. This file

contains everything you need except for the kernel sources, which are

in a separate archive. To extract:

<p>

# <b>mkdir -p /usr/src</b>

# <b>cd /usr/src</b>

# <b>tar xvfz /tmp/src.tar.gz</b>

</pre></blockquote>

<p>

sys.tar.gz contains a source archive starting at /usr/src/sys.

This file contains all the kernel sources you need to rebuild kernels.

To extract:

<p>

# <b>mkdir -p /usr/src/sys</b>

# <b>cd /usr/src</b>

# <b>tar xvfz /tmp/sys.tar.gz</b>

</pre></blockquote>

<p>

Both of these trees are a regular CVS checkout. Using these trees it

is possible to get a head-start on using the anoncvs servers as

described <a href="anoncvs.html">here</a>.

Line 1189

Line 1176

a fresh checkout of the full OpenBSD source tree.

<p>

<hr>

<p>

<h3><font color="#0000e0">Ports Tree</font></h3>

<h3 id="ports"><font color="#0000e0">Ports Tree</font></h3>

<p>

A ports tree archive is also provided. To extract:

<p>

# <b>cd /usr</b>

# <b>tar xvfz /tmp/ports.tar.gz</b>

</pre></blockquote>

<p>

Go read the <a href="faq/ports/index.html">ports</a> page

if you know nothing about ports

at this point. This text is not a manual of how to use ports.

Line 1216

Line 1202

So, in order to keep up to date with the <i>-stable</i> branch, you must make

the <i>ports/</i> tree available on a read-write medium and update the tree

with a command like:

<p>

# <b>cd /usr/ports</b>

# <b>cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_5_9</b>

</pre></blockquote>

<p>

[Of course, you must replace the server name here with a nearby anoncvs

server.]

<p>