Annotation of www/68.html, Revision 1.81
1.1 benno 1: <!doctype html>
2: <html lang=en id=release>
3: <meta charset=utf-8>
4:
5: <title>OpenBSD 6.8</title>
6: <meta name="description" content="OpenBSD 6.8">
7: <meta name="viewport" content="width=device-width, initial-scale=1">
8: <link rel="stylesheet" type="text/css" href="openbsd.css">
9: <link rel="canonical" href="https://www.openbsd.org/68.html">
10:
11: <h2 id=OpenBSD>
12: <a href="index.html">
13: <i>Open</i><b>BSD</b></a>
14: 6.8
15: </h2>
16:
17: <table>
18: <tr>
19: <td>
1.75 job 20: <a href="images/PuffyOverride.png">
21: <img width="227" height="303" src="images/PuffyOverride-s.gif" alt="Fun & Friends"></a>
1.1 benno 22: <td>
1.75 job 23: Released Oct 18, 2020. (OpenBSD's 25th anniversary)<br>
1.1 benno 24: Copyright 1997-2020, Theo de Raadt.<br>
25: <br>
1.75 job 26: 6.8 Song:
27: <a href="lyrics.html#68">"Hacker People"</a>.
1.1 benno 28: <br>
1.75 job 29: Artwork by Siah Files.
1.1 benno 30: <br>
31: <ul>
32: <li>See the information on <a href="ftp.html">the FTP page</a> for
33: a list of mirror machines.
34: <li>Go to the <code class=reldir>pub/OpenBSD/6.8/</code> directory on
35: one of the mirror sites.
36: <li>Have a look at <a href="errata68.html">the 6.8 errata page</a> for a list
37: of bugs and workarounds.
38: <li>See a <a href="plus68.html">detailed log of changes</a> between the
39: 6.7 and 6.8 releases.
40: <p>
41: <li><a href="https://man.openbsd.org/signify.1">signify(1)</a>
42: pubkeys for this release:<p>
43:
44: <table class=signify>
45: <tr><td>
46: openbsd-68-base.pub:
47: <td>
48: <a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/openbsd-68-base.pub">
1.80 schwarze 49: RWQZj25CSG5R2oLo5735Hh6C48kkjFsj5rJDjW+fGZwyY+BkD5/zps8f</a>
1.1 benno 50: <tr><td>
51: openbsd-68-fw.pub:
52: <td>
53: RWSYx4htNi/zavF8ZToMBDFz2xymRfFnnR1MEKV9csYbvnrTBwdkXhdy
54: <tr><td>
55: openbsd-68-pkg.pub:
56: <td>
57: RWQlDXyHx5KlPoEiz4yWRK/Gt/rvPwI8KEAt3utge/dBS7R+EscdzA5K
58: <tr><td>
59: openbsd-68-syspatch.pub:
60: <td>
61: RWRWuHkSV0U8PUX24vGa3ywrvKNQY6llV3PLvKEzDTiTVPfIRaXPfvzR
62: </table>
63: </ul>
64: <p>
65: All applicable copyrights and credits are in the src.tar.gz,
66: sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the
67: files fetched via <code>ports.tar.gz</code>.
68: </table>
69:
70: <hr>
71:
72: <section id=new>
73: <h3>What's New</h3>
74: <p>
75: This is a partial list of new features and systems included in OpenBSD 6.8.
76: For a comprehensive list, see the <a href="plus68.html">changelog</a> leading
77: to 6.8.
78:
79: <ul>
80:
1.17 kettenis 81: <li>New/extended platforms:
82: <ul>
83: <li>New <a href="https://www.openbsd.org/powerpc64.html">powerpc64</a>
84: platform, supporting PowerNV (non-virtualized) systems with
85: POWER8 and POWER9 CPUs, such as Raptor Computing Systems Talos
86: II and Blackbird systems. POWER8 support has not been tested
87: on real hardware yet.
88: </ul>
89:
1.40 schwarze 90: <li>Improvements to time measurements, mostly in the kernel:
1.1 benno 91: <ul>
1.3 benno 92: <li>Added support in the kernel and libc for timecounting in
93: userland, eliminating the need for a context switch everytime a
94: process requests the current time, thereby improving speed and
95: responsiveness in programs which make many <a
96: href="https://man.openbsd.org/gettimeofday">gettimeofday(2)</a> calls,
97: especially browsers and office software.<br>The userland timecounters
98: are enabled on the amd64, arm64, macppc, octeon and sparc64
1.18 kettenis 99: architectures.
1.40 schwarze 100: <li>Added a <a href="https://man.openbsd.org/ktrace">ktrace(1)</a> -T option to make time-related system calls more prominent.
101: <li>Added tsc_delay(), a <a href="https://man.openbsd.org/delay">delay(9)</a> implementation based on the TSC, to amd64.
102: <li>Used an LFENCE instruction everywhere RDTSC is used for a time measurement, reducing the jitter in TSC skew measurements.
103: <li>Introduced <a href="https://man.openbsd.org/gettime">gettime(9)</a> and <a href="https://man.openbsd.org/getuptime">getuptime(9)</a> and substituted these for time_second(9) and time_uptime(9) throughout the kernel to prevent split-read problems on 32-bit platforms.
104: <li>Synchronized each core's CP0 cycle counter using the IO clock counter on mips64 and octeon, making the cycle counter usable as timecounter.
105: <li>Improved CPU frequency scaling in automatic performance mode by removing accounting for offline CPUs.
106: </ul>
1.3 benno 107:
1.40 schwarze 108: <li>Various kernel improvements:
109: <ul>
110: <li>Added <a href="https://man.openbsd.org/intrmap_create">intrmap</a>, an interrupt to CPU mapping API that is used by hardware drivers to use multiple CPUs for interrupt handling.
111: <li>Added an ioctl PCIOCGETVPD allowing userland to access read-only support information about pci devices via the vpd register.
1.1 benno 112: <li>Set <a href="https://man.openbsd.org/ddb">ddb(4)</a> "/t" to show a trace via TID on all architectures.
1.40 schwarze 113: <li>Introduced <a href="https://man.openbsd.org/kstat">kstat(1)</a>, a subsystem to allow the kernel to expose statistics to userland.
114: <li>Added kstat to <a href="https://man.openbsd.org/cnmac">cnmac(4)</a>.
115: <li>Added support for remote coverage to <a href="https://man.openbsd.org/kcov">kcov(4)</a>.
1.77 schwarze 116: <li>Moved <a href="https://man.openbsd.org/sysctl.2">sysctl(2)</a> CTL_DEBUG from DEBUG to the new DEBUG_SYSCTL.
1.40 schwarze 117: <li>Prevented creation of bogus <a href="https://man.openbsd.org/sd">sd(4)</a> devices for <a href="https://man.openbsd.org/nvme">nvme(4)</a> namespaces which are configured but have size 0.
1.72 krw 118: <li>Added READ(12)/WRITE(12) support to <a href="https://man.openbsd.org/cd">cd(4)</a>.
1.40 schwarze 119: <li>Used READ(16)/WRITE(16) commands for disks large enough to require them to access the last sectors, fixing large 512E devices plugged into USB to ATA/ATAPI bridges which mistakenly use 4K sector addresses/sizes.
1.1 benno 120: <li>Restored VGA fonts on VT switch, preventing an unusable screen when switching to a VT with a custom VGA font from X.
1.40 schwarze 121: <li>Ensured only pseudo-terminal devices use reprint delays.
122: <li>Prevented improper disabling of the backlight in <a href="https://man.openbsd.org/umstc">umstc(4)</a> when brightness is adjusted to 0.
123: <li>Provided an optimized implementation of <a href="https://man.openbsd.org/ffs">ffs(3)</a> in the kernel on arm64/powerpc/powerpc64.
1.1 benno 124: <li>Rewrote m88k mutex code as a slight variation of the MI mutex code, potentially improving stability and rendering mutex spinning time visible in <a href="https://man.openbsd.org/top">top(1)</a>.
1.70 kn 125: <li>Reworked kernel loading with octboot, the OpenBSD/octeon bootloader, which now does not rely on a mounted filesystem.
1.77 schwarze 126: <li>Ensured <a href="https://man.openbsd.org/scsi.4">scsi(4)</a> devices do not attempt to process bogus MODE SENSE data.
1.40 schwarze 127: </ul>
128:
129: <li>Various new userland features:
130: <ul>
131: <li>Imported <a href="https://man.openbsd.org/login_ldap">login_ldap(8)</a>, using <a href="https://man.openbsd.org/ldap">ldap(1)</a> rather than openldap.
132: <li>Added support for set -o pipefail to <a href="https://man.openbsd.org/ksh">ksh(1)</a>, potentially helping error checking.
1.65 kn 133: <li>Cleared the screen in <a href="https://man.openbsd.org/ksh">ksh(1)</a>'s vi mode before redrawing the line with ^L.
1.40 schwarze 134: <li>Implemented the gensub(), systime() and strftime() functions for <a href="https://man.openbsd.org/awk">awk(1)</a>.
135: <li>Allowed specification of supported TLS protocols in <a href="https://man.openbsd.org/ftp">ftp(1)</a> "-S protocols".
136: <li>Switched the default <a href="https://man.openbsd.org/man.1">man(1)</a> pager from "<a href="https://man.openbsd.org/more.1">more(1)</a> -s" to <a href="https://man.openbsd.org/less.1">less(1)</a>.
137: <li>Supported -T html -O tag in <a href="https://man.openbsd.org/man.1">man(1)</a> by passing a file:// URI to the pager.
138: <li>Added <a href="https://man.openbsd.org/fstat">fstat(1)</a> support for looking up unix domain sockets by file name.
139: <li>Added / as an alias for g (grep) in <a href="https://man.openbsd.org/top">top(1)</a>.
140: <li>Provided a naptime variable for userspace via <a href="https://man.openbsd.org/kvm_read">kvm_read(3)</a>, usable by <a href="https://man.openbsd.org/vmstat">vmstat(8)</a>.
1.1 benno 141: <li>Allowed switching between alternate devices (-F) with <a href="https://man.openbsd.org/sndioctl">sndioctl(1)</a>.
142: <li>Added the ability to set and display <a href="https://man.openbsd.org/video">video(1)</a> control values directly on the CLI.
143: <li>Allowed the combination of <a href="https://man.openbsd.org/video">video(1)</a> "-dc" options, reset and display control values.
1.40 schwarze 144: <li>Added <a href="https://man.openbsd.org/video">video(1)</a> white balance temperature control through w/W keys.
1.77 schwarze 145: <li>Added control for backlight compensation to <a href="https://man.openbsd.org/video.4">video(4)</a>.
1.40 schwarze 146: <li>Initialized v4l2_requestbuffers for libv4l compatibility, allowing view of video encodings not directly supported by <a href="https://man.openbsd.org/video">video(1)</a>.
147: <li>Added a new column to <a href="https://man.openbsd.org/wsfontload">wsfontload(8)</a> -l output to report the number of characters contained in a loaded font.
148: <li>Relaxed filename checks in <a href="https://man.openbsd.org/syspatch">syspatch(8)</a> to allow use of hyphens.
149: <li>Enabled <a href="https://man.openbsd.org/btrace">btrace(8)</a> (<a href="https://man.openbsd.org/dt">dt(4)</a> not yet enabled in GENERIC, though).
150: <li>Added <a href="https://man.openbsd.org/btrace">btrace(8)</a> -p flag to filter all actions by PID.
151: <li>Implemented linear and power-of-two histograms in bt(5).
152: <li>Added support for "&" and "|" operators in btrace scripts.
153: </ul>
154:
155: <li>Various bugfixes and tweaks in userland:
156: <ul>
157: <li>Fixed the <a href="https://man.openbsd.org/ksh">ksh(1)</a> exit code when evaluating a || compound list to prevent termination of the shell when running under -e.
158: <li>Fixed "$@" splitting with empty IFS in <a href="https://man.openbsd.org/ksh">ksh(1)</a>.
159: <li>Stopped incrementing openclass for a literal "[" in <a href="https://man.openbsd.org/awk">awk(1)</a>, allowing parsing of expressions such as "/[[/[]/".
160: <li>Fixed <a href="https://man.openbsd.org/make">make(1)</a> :S with anchors and replacement.
161: <li>Prevented <a href="https://man.openbsd.org/mg">mg(1)</a> from running out of memory or segfaulting with <code>query-replace-regex ^</code>.
162: <li>Fixed <a href="https://man.openbsd.org/ls">ls(1)</a> -R mode to not display subdirectories of a directory beginning with '.' and ensure directory names are always displayed.
1.1 benno 163: <li>Prevented a core dump in <a href="https://man.openbsd.org/ftp">ftp(1)</a> during fetch abort.
164: <li>Taught <a href="https://man.openbsd.org/su">su(1)</a> -l -f to start a regular shell for non-csh shells rather than a login shell.
165: <li>Used <a href="https://man.openbsd.org/su">su(1)</a> -fl to avoid sourcing the target user's .profile in <a href="https://man.openbsd.org/rc.d">rc.d(8)</a>/<a href="https://man.openbsd.org/rcctl">rcctl(8)</a>.
1.40 schwarze 166: <li>Fixed merging of files that lack newlines for <a href="https://man.openbsd.org/diff3">diff3(1)</a>, OpenRCS and OpenCVS.
167: <li>Prevented <a href="https://man.openbsd.org/rcs">rcs(1)</a> removal of locked revisions with rcs -orange, avoiding leaving behind a lock for a revision which no longer exists.
168: <li>Fixed <a href="https://man.openbsd.org/sndiod">sndiod(8)</a> crashes when USB devices are disconnected.
169: <li>Fixed the initial <a href="https://man.openbsd.org/sndiod">sndiod(8)</a> alternate device number, preventing device number 1 from being skipped on first use.
170: <li>Switched the default CDDB database for <a href="https://man.openbsd.org/cdio">cdio(1)</a> to gnudb.gnudb.org:8880.
1.7 jsg 171: <li>Stopped <a href="https://man.openbsd.org/syslogd">syslogd(8)</a> from closing UDP sockets for sending messages when DNS lookup of a UDP loghost fails, allowing them to be used to send if DNS is working during the next SIGHUP.
1.1 benno 172: <li>Prevented established TCP and TLS sockets of <a href="https://man.openbsd.org/syslogd">syslogd(8)</a> from staying open forever if a client aborted the connection silently.
1.40 schwarze 173: <li>Avoided reading one byte before the path buffer in <a href="https://man.openbsd.org/mountd">mountd(8)</a>.
1.1 benno 174: <li>Made <a href="https://man.openbsd.org/apmd">apmd(8)</a> always ask the kernel about current hw.perfpolicy rather than maintaining state.
1.40 schwarze 175: <li>Prevented an <a href="https://man.openbsd.org/unveil">unveil(2)</a> failure with chdir / on <a href="https://man.openbsd.org/sensorsd">sensorsd(8)</a>.
1.62 tb 176: <li>Fixed a segmentation fault in <a href="https://man.openbsd.org/pstat">pstat(8)</a>'s printing of active vnodes.
1.40 schwarze 177: <li>Corrected <a href="https://man.openbsd.org/getopt_long">getopt_long(3)</a> parsing of a trailing dash in an option group, which was being incorrectly returned as an argument.
178: <li>Prevented callers inspecting unrelated fields in the libc resolver function asr_run().
179: <li>Introduced a darker <a href="https://man.openbsd.org/xenodm">xenodm(1)</a> login widget and a lower contrast default background.
180: <li>Fixed an <a href="https://man.openbsd.org/xconsole">xconsole(1)</a> crash by starting it after setting the background.
1.1 benno 181: </ul>
182:
183: <li>Improved hardware support and driver bugfixes, including:
184: <ul>
185: <li>Enabled scrollback in <a href="https://man.openbsd.org/simplefb">simplefb(4)</a>.
186: <li>Fixed display glitches on smaller screens or with larger fonts in <a href="https://man.openbsd.org/efifb">efifb(4)</a> associated with remapping and attaching.
187: <li>Improved reporting of remaining power with batteries of different capacities in <a href="https://man.openbsd.org/acpi">acpi(4)</a>.
188: <li>Fixed bogus frame sizes being returned by <a href="https://man.openbsd.org/xhci">xhci(4)</a>.
189: <li>Added <a href="https://man.openbsd.org/wsmoused">wsmoused(8)</a> support to <a href="https://man.openbsd.org/efifb">efifb(4)</a>.
190: <li>Added <a href="https://man.openbsd.org/umstc">umstc(4)</a>, a driver for Microsoft Surface Type Cover keyboards.
191: <li>Introduced <a href="https://man.openbsd.org/acpihid">acpihid(4)</a> for ACPI HID event and 5-button array devices.
192: <li>Moved Powerbook5,4 audio from <a href="https://man.openbsd.org/aoa">aoa(4)</a> to <a href="https://man.openbsd.org/snapper">snapper(4)</a>, adding the missing TAS3004 volume control.
193: <li>Fixed broken HID descriptors of Elecom trackballs with 6 or 8 buttons.
194: <li>Added RK3328 PWM, also found in the RK3308, to <a href="https://man.openbsd.org/rkpwm">rkpwm(4)</a>.
195: <li>Added RK3308 temperature sensors to <a href="https://man.openbsd.org/rktemp">rktemp(4)</a>.
1.32 patrick 196: <li>Added <a href="https://man.openbsd.org/pcamux">pcamux(4)</a>, a driver for the PCA9548 I2C switch.
1.6 jsg 197: <li>Introduced a framework for digital audio interfaces, and added <a href="https://man.openbsd.org/simpleaudio">simpleaudio(4)</a>, a driver for "simple audio cards." This is a wrapper connecting the I2S controller, the codec and some aux devices, and <a href="https://man.openbsd.org/simpleamp">simpleamp(4)</a>, a driver for "simple audio amplifier," one of the aux devices for <a href="https://man.openbsd.org/simpleaudio">simpleaudio(4)</a>.
1.1 benno 198: <li>Enabled <a href="https://man.openbsd.org/nvme">nvme(4)</a> on i386.
199: <li>Added support for the Ericsson F5521gw Mobile Broadband Modem.
200: <li>Ensured the STOP command sent by <a href="https://man.openbsd.org/sd">sd(4)</a> on powerdown will not result in hanging the machine if commands to the USB mass storage fail.
201: <li>Fixed intermittent failing <a href="https://man.openbsd.org/pms">pms(4)</a> device initialization seen on some Synaptics devices.
202: <li>Corrected trackstick/button attachment of Windows Precision Touchpad <a href="https://man.openbsd.org/imt">imt(4)</a> devices, fixing behavior on certain Dell Latitude laptops.
203: <li>Improved speed of scrolling by optimizing <a href="https://man.openbsd.org/rasops">rasops(9)</a> write-only framebuffer console.
204: <li>Modified <a href="https://man.openbsd.org/uvideo">uvideo(4)</a> to fix webcam detection in Firefox 78.
205: <li>Added a SENSOR_ENERGY sensor type to the <a href="https://man.openbsd.org/sensor_attach">sensors framework API</a> which uses microjoules.
206: <li>Added support for the AMDI0010 touchpad on the Inspiron 5505.
207: <li>Avoided nvram lock timeout on sparc64 systems with onboard BCM5704 <a href="https://man.openbsd.org/bge">bge(4)</a> instances that come without a fitted EEPROM/NVRAM.
208: <li>Added <a href="https://man.openbsd.org/pms">pms(4)</a> support for the Elantech v1 touchpad with firmware version 0x20022.
209: <li>Added <a href="https://man.openbsd.org/sdmmc">sdmmc(4)</a> support for eMMC HS200 mode.
210: <li>Added Exar XR17V35x serial port support.
211: <li>Properly implemented <a href="https://man.openbsd.org/amlmmc">amlmmc(4)</a> setting of signal voltage.
212: <li>Implemented UHS-I support in the <a href="https://man.openbsd.org/sdmmc">sdmmc(4)</a> midlayer and enabled it in <a href="https://man.openbsd.org/amlmmc">amlmmc(4)</a>.
213: <li>Introduced <a href="https://man.openbsd.org/abl">abl(4)</a>, a new driver to control the backlight brightness on Intel-based Apple machines, and allowed it to be controlled through <a href="https://man.openbsd.org/wsconsctl">wsconsctl(8)</a>.
214: <li>Disabled <a href="https://man.openbsd.org/acpivout">acpivout(4)</a> brightness control on machines aware of Windows 8, enabling inteldrm to handle brightness ioctls.
215: <li>Fixed <a href="https://man.openbsd.org/eeprom">eeprom(8)</a> error when setting variables on macppc.
1.77 schwarze 216: <li>Updated <a href="https://man.openbsd.org/drm.4">drm(4)</a> to Linux 5.7.19.
1.1 benno 217: </ul>
218: <li>New or improved network hardware support:
219: <ul>
1.34 jmatthew 220: <li>Enabled multiple tx/rx queues with Toeplitz RSS hashing in <a href="https://man.openbsd.org/vmx">vmx(4)</a>, <a href="https://man.openbsd.org/ix">ix(4)</a> and <a href="https://man.openbsd.org/ixl">ixl(4)</a>.
1.48 jmatthew 221: <li>Added support for hardware VLAN tagging and checksumming to <a href="https://man.openbsd.org/mcx">mcx(4)</a> and <a href="https://man.openbsd.org/bnxt">bnxt(4)</a>.
1.1 benno 222: <li>Fixed a crash in <a href="https://man.openbsd.org/re">re(4)</a>.
1.7 jsg 223: <li>Added <a href="https://man.openbsd.org/bge">bge(4)</a> support for the BCM5719 A1 Ethernet controller.
1.1 benno 224: <li>Handled AGL interfaces on octeon, making management network ports usable on some machines.
225: <li>Added support for the <a href="https://man.openbsd.org/mcx">mcx(4)</a> ConnectX-6 Dx.
226: <li>Fixed a potential crash when bringing down an <a href="https://man.openbsd.org/mcx">mcx(4)</a> interface.
227: <li>Increased the <a href="https://man.openbsd.org/mcx">mcx(4)</a> event queue size, preventing a potential interrupt storm on the ConnectX-4.
228: <li>Fixed outbound <a href="https://man.openbsd.org/bpf">bpf(4)</a> tap on <a href="https://man.openbsd.org/ogx">ogx(4)</a> interfaces.
1.29 jsg 229: <li>Improved <a href="https://man.openbsd.org/ure">ure(4)</a> performance by combining multiple sent packets into one transfer.
230: <li>Added support for RK3308 Ethernet to <a href="https://man.openbsd.org/dwge">dwge(4)</a>.
1.31 kevlo 231: <li>Added <a href="https://man.openbsd.org/rge">rge(4)</a> support for newer RTL8125 chipset (RTL8125B).
1.1 benno 232: </ul>
233: <li>Added or improved wireless network drivers:
234: <ul>
235: <li>Added support to <a href="https://man.openbsd.org/urtwn">urtwn(4)</a> for TP-Link TL-WN822N-EU v5 (and v4).
1.33 benno 236: <li>Added WPA2 (CCMP) crypto offload support to <a href="https://man.openbsd.org/iwm">iwm(4)</a> and
237: <a href="https://man.openbsd.org/iwx">iwx(4)</a>,
238: reducing CPU load during traffic bursts.
239: <li>Fixed causes of several fatal firmware errors on <a href="https://man.openbsd.org/iwx">iwx(4)</a> devices.
1.1 benno 240: <li>Added <a href="https://man.openbsd.org/bwfm">bwfm(4)</a> support for BCM4359 SDIO variants such as the AP6359SA module found on the RockPro64 WiFi module.
241: <li>Enabled critical temperature detection in <a href="https://man.openbsd.org/iwx">iwx(4)</a> firmware.
242: <li>Fixed mbuf leak in <a href="https://man.openbsd.org/urtwn">urtwn(4)</a> with frames CCMP-encrypted by hardware.
243: <li>Added support for the D-Link DWA-121 rev B1 <a href="https://man.openbsd.org/urtwn">urtwn(4)</a> device.
244: <li>Repaired <a href="https://man.openbsd.org/athn">athn(4)</a> in client mode against WPA2 access points.
1.33 benno 245: <li>Prevented a panic where <a href="https://man.openbsd.org/athn">athn(4)</a> attempted to transmit old, unencryptable frames after switching to a new group key in hostap mode.
1.1 benno 246: <li>Switched <a href="https://man.openbsd.org/iwx">iwx(4)</a> from -46 to -48 firmware.
247: <li>Enabled background scanning on <a href="https://man.openbsd.org/iwx">iwx(4)</a> devices.
248: <li>Fixed gain calibration for some <a href="https://man.openbsd.org/iwn">iwn(4)</a> devices (5000 and up).
249: <li>Added support for AX201 devices to <a href="https://man.openbsd.org/iwx">iwx(4)</a>.
250: </ul>
251:
252: <li>New <a href="https://www.openbsd.org/arm64.html">arm64</a> and <a
253: href="https://www.openbsd.org/armv7.html">armv7</a> hardware support
254: and bugfixes, including:
255: <ul>
256: <li>Added <a href="https://man.openbsd.org/amlpwrc">amlpwrc(4)</a>, a driver for the power domain controller found on Amlogic SoCs.
1.7 jsg 257: <li>Made OpenBSD boot on the ODROID-C4 with power domain in <a href="https://man.openbsd.org/amldwusb">amldwusb(4)</a>.
1.1 benno 258: <li>Added support for the SD card detect pins on the Turris Mox.
1.29 jsg 259: <li>Added support for the Marvell Xenon SDHC, used as storage on the Armada 3700 and 8040 SoCs.
1.7 jsg 260: <li>Opened up a 4GB memory bus window for <a href="https://man.openbsd.org/mvneta">mvneta(4)</a> on the Marvell Armada 3700, making the second Ethernet controller/port work on the Turris Mox.
1.1 benno 261: <li>Added <a href="https://man.openbsd.org/mvkpcie">mkvpcie(4)</a>, a driver for the Aardvark PCIe controller found on the Armada 3700 SoC.
262: <li>Adjusted <a href="https://man.openbsd.org/dwpcie">dwpcie(4)</a> timing to improve likelihood of a successful PCIe link on the i.MX8MM. Avoids a failure to detect <a href="https://man.openbsd.org/em">em(4)</a> on the HummingBoard Pulse.
263: <li>Added <a href="https://man.openbsd.org/cwfg">cwfg(4)</a>, a driver for the Cellwise CW201x fuel gauge on the Pinebook Pro.
264: <li>Populated a list of 256 brightness levels as a fallback when the device tree does not specify a list, making the Pinebook Pro display work with the dtb from Linux 5.7.
265: <li>Added <a href="https://man.openbsd.org/escodec">escodec(4)</a>, a driver for the Everest ES8316 audio codec used on the Pinebook Pro.
1.6 jsg 266: <li>Added <a href="https://man.openbsd.org/rkiis">rkiis(4)</a>, a driver for the I2S controller found on the Rockchip RK3399.
1.1 benno 267: <li>Added <a href="https://man.openbsd.org/bcmtmon">bcmtmon(4)</a>, a driver for the temperature sensor on the Raspberry Pi 4.
268: <li>Introduced <a href="https://man.openbsd.org/mvpp">mvpp(4)</a>, a driver for the Marvell Packet Processor v2 as used on the Armada 7K and 8K SoCs.
269: <li>Improved PLL1(CPU_PLL) stability for the Allwinner H3/H2+.
1.40 schwarze 270: <li>Ported NetBSD's arm64 disassembler for <a href="https://man.openbsd.org/ddb">ddb(4)</a>.
271: <li>Enabled spleen16x32 and spleen32x64 fonts on armv7 for GENERIC kernels.
272: <li>Enabled building <a href="https://man.openbsd.org/wsmoused">wsmoused(8)</a> and <a href="https://man.openbsd.org/wsfontload">wsfontload(8)</a> on arm64 and armv7.
1.1 benno 273: </ul>
274:
275: <li>IEEE 802.11 wireless stack improvements and bugfixes:
276: <ul>
277: <li>Fixed CCMP replay checks with 11n Rx aggregation and CCMP hardware offloading.
1.33 benno 278: <li>In hostap mode, complete WPA group key renewals immediately if no station is associated.
1.1 benno 279: <li>Improved processing of lost frames during 802.11 Rx aggregation.
280: <li>Allowed passage of unencrypted 802.11 frames during hardware decryption post-processing, fixing failure of some <a href="https://man.openbsd.org/ral">ral(4)</a> devices to receive packets on encrypted networks.
281: <li>Prevented a use-after-free when a wireless device is detached.
282: </ul>
283:
284: <li>Generic network stack improvements and bugfixes:
285: <ul>
286: <!-- carp and pf -->
287: <li>Implemented a <a href="https://man.openbsd.org/carp">carp(4)</a> transmit bypassing the ifq on output, enqueuing the packet directly on the parent interface.
288: <li>Fixed <a href="https://man.openbsd.org/pf.conf">pf.conf(5)</a> "route-to TABLE least-states" in an anchor.
289: <li>Allowed <a href="https://man.openbsd.org/pf">pf(4)</a> to divert packets from <a href="https://man.openbsd.org/bridge">bridge(4)</a> to local socket.
290: <li>Rehashed main <a href="https://man.openbsd.org/pf">pf(4)</a> rulesets after rule expiration.
291: <li>Added a check for <a href="https://man.openbsd.org/pfctl">pfctl(8)</a> that an rtable exists when parsing the config.
1.24 kn 292: <li>Corrected ruleset checksum calculation to allow <a href="https://man.openbsd.org/pfsync">pfsync(4)</a> to verify rulesets are identical on all nodes.
1.1 benno 293: <!-- wg -->
1.7 jsg 294: <li>Added <a href="https://man.openbsd.org/wg">wg(4)</a>, an in-kernel driver for WireGuard VPN communication.
1.1 benno 295: <!-- network pseudo drivers and other kernel network internals -->
296: <li>Protected the whole <a href="https://man.openbsd.org/pipex">pipex(4)</a> layer by NET_LOCK().
297: <li>Stopped creation of non-existent <a href="https://man.openbsd.org/bridge">bridge(4)</a> interfaces.
298: <li>Added a symmetric toeplitz implementation with integration for nics, usable through the <a href="https://man.openbsd.org/stoeplitz_to_key">stoeplitz_to_key(9)</a> hash algorithm API.
299: <li>Changed <a href="https://man.openbsd.org/tpmr">tpmr(4)</a> from ifconfig [-]trunkport to add|del synopsis.
300: <li>Filtered vlan and svlan packets by default for <a href="https://man.openbsd.org/tpmr">tpmr(4)</a>.
301: <li>Implemented IPv6 source address selection as outlined in RFC 6724 section 5.
302: <li>Set IPv6 source address selection to prefer the address with the highest preferred lifetime in case of a tie.
303: <li>Stopped preventing TCP connections to IPv6 anycast addresses.
304: <li>Added the <a href="https://man.openbsd.org/pcap-filter">pcap-filter(5)</a> "sample NUM" primitive to allow capture of 1/NUM packets.
305: <li>Added a <a href="https://man.openbsd.org/man4/route.4">ROUTE_FLAGFILTER</a> socket option for routing sockets, allowing routing daemons to opt out of receiving messages for L2 and broadcast route entries.
306: <li>Allowed SIOCSWGDPID and SIOCSWGMAXFLOW ioctls for non-root, preventing <a href="https://man.openbsd.org/switch">switch(4)</a> interfaces from appearing partially as <a href="https://man.openbsd.org/bridge">bridge(4)</a> devices for unprivileged users running <a href="https://man.openbsd.org/ifconfig">ifconfig(8)</a>.
307: <li>Modified <a href="https://man.openbsd.org/trunk">trunk(4)</a> to keep port interfaces UP on removal, matching <a href="https://man.openbsd.org/aggr">aggr(4)</a> behavior.
1.25 kn 308: <li>Fixed <a href="https://man.openbsd.org/rdomain">rdomain(4)</a> handling for IPv6.
309: <li>Fixed <a href="https://man.openbsd.org/rtable">rtable(4)</a> separation of raw sockets for IPv6.
310: <li>Documented <a href="https://man.openbsd.org/rtable">rtable(4)</a> removal semantics.
1.1 benno 311: </ul>
312:
313: <li>Installer improvements:
314: <ul>
1.36 florian 315: <li>On systems with multiple root disks, the installer will upgrade the disk with auto_upgrade.conf present when the upgrade was initiated by <a href="https://man.openbsd.org/sysupgrade">sysupgrade(8)</a>.
1.1 benno 316: <li>Changed install images called *.fs to *.img to accommodate some UEFI bootloaders.
1.40 schwarze 317: <li>Forced long-names on msdos filenames for installboot on most 32-bit architectures.
318: <li>Converted macppc, octeon and loongson to use machine-independent installboot.
1.64 otto 319: </ul>
320:
321: <li>Improvements in the FFS2 filesystem:
322: <ul>
323: <li>Made FFS2 the default for <a href="https://man.openbsd.org/newfs">newfs(8)</a>, except for mfs.
324: <li>Improved reliability of very large FFS2 filesystems.
325: <li>Improved speed of checking FFS2 filesystems.
326: <li>Enabled the FFS2 option on the luna88k ramdisk.
327: <li>Made FFS2 the default non-root filesystems on landisk, sgi and luna88k.
1.1 benno 328: </ul>
329:
330: <li>Security improvements:
331: <ul>
332: <li>Added RB_GOODRANDOM passed from bootloader to kernel in boothowto, indicating confidence a "great seed" was loaded.
333: <li>Passed boothowto from the sparc64 bootloader to the kernel using .openbsd.bootdata.
334: <li>Introduced detection of /etc/random.seed reuse.
335: <li>Rewrote the entropy enqueue ring to collect damage asynchronously and adapted the dequeue to mix a selection of "best" ring entries, exponentially backing off the dequeue timeout, to compensate rapidly for weak seeding in unidentifiable conditions and ensure quality to arc4random() calls early in boot.
336: <li>Enabled PAN (Privileged Access Never) on arm64 CPUs supporting it.
337: <li>Skipped scanning file systems which are both nodev and nosuid for SUID, SGID and device files with <a href="https://man.openbsd.org/security">security(8)</a>.
1.41 deraadt 338: <li>Fixed two out-of-bounds array accesses in ioctl code pathways in
339: <a href="https://man.openbsd.org/wscons">wscons(4)</a>.
340: <li>Fixed information leak in semctl SEM_GET.
341: <li>Prevented root from freezing the UTC clock with <a href="https://man.openbsd.org/settimeofday">settimeofday(2)</a> at securelevel 2.
342: <li>Fixed performance problems relating to tty subsystem abuse.<!-- tty.c,v 1.158 2020/07/14 14:33:03 deraadt -->
343: <li>Fixed heap corruption in the X input method client in libX11.
344: <li>Fixed potential information leak via X server pixel data uninitialized memory.
345: <li>Fixed a race condition for isoc devices during device close.
346: <li>Fixed an integer overflow in libX11 which could lead to a double free.
347: <li>Corrected multiple input validation deficits in X server extensions.
1.1 benno 348: </ul>
349:
350: <li>Routing daemons and other userland network improvements:
351: <ul>
352: <!-- bgpd -->
353: <li>In <a href="https://man.openbsd.org/bgpctl">bgpctl(8)</a>, the
354: "reload" command now takes a 'reason' argument to use as
1.7 jsg 355: Administrative Shutdown Communication to its neighbors.
1.1 benno 356: <li>Added <a href="https://man.openbsd.org/bgpctl">bgpctl(8)</a>
357: support for VPNv6 in the family option of the "show rib" command.
1.50 job 358: <li>Added <a href="https://man.openbsd.org/bgpctl">bgpctl(8)</a>
359: support for JSON formatted output in various "show" commands.
1.1 benno 360: <!-- OSPF -->
361: <li>Improve performance of <a href="https://man.openbsd.org/ospfd">ospfd(8)</a>, <a href="https://man.openbsd.org/ospf6d">ospf6d(8)</a> by using the ROUTE_FLAGFILTER setsockopt to filter out routing socket messages
362: for L2 and broadcast routes.
363: <!-- ldap -->
364: <li>Modified <a href="https://man.openbsd.org/ldapd">ldapd(8)</a> use of "ldaps" and "tls" keywords to enable only the libtls defaults for protocols and ciphers. The new "legacy" keyword can be used before these keywords in <a href="https://man.openbsd.org/ldapd.conf">ldapd.conf(5)</a> to enable them all.
365: <li>Added a bsd.schema to <a href="https://man.openbsd.org/ldapd">ldapd(8)</a> including a shadowPassword and an sshPublicKey attribute which can be used to extend existing LDAP users with the additional bsdAccount objectclass.
366: <!-- snmpd -->
367: <li>Removed support for the socket keyword in <a href="https://man.openbsd.org/snmpd.conf">snmpd.conf(5)</a>.
1.73 martijn 368: <li>Allowed <a href="https://man.openbsd.org/snmpd">snmpd(8)</a> to define the port we listen on.
1.1 benno 369: <li>Allowed <a href="https://man.openbsd.org/snmp">snmp(1)</a> mibtree to take one or more arguments to be converted to a chosen output format.
1.73 martijn 370: <li>Replaced <a href="https://man.openbsd.org/relayd">relayd(8)</a>'s agentx backend and reworked the object structure to be in line with what is defined in the MIB.
1.1 benno 371: <!-- httpd and relayd -->
372: <li>Introduced a "dark mode" for directory listings and error pages in <a href="https://man.openbsd.org/httpd">httpd(8)</a>.
373: <li>Allowed specifying -d multiple times in <a href="https://man.openbsd.org/slowcgi">slowcgi(8)</a>.
374: <li>Added <a href="https://man.openbsd.org/unveil">unveil(2)</a> to the main process of <a href="https://man.openbsd.org/relayd">relayd(8)</a>.
375: <li>Added support for non-localhost fastcgi sockets to <a href="https://man.openbsd.org/httpd.conf">httpd.conf(5)</a>.
376: <!-- rpki-client -->
377: <li>Fixed a hang in <a href="https://man.openbsd.org/rpki-client">rpki-client(8)</a> by properly waiting for exiting <a href="https://man.openbsd.org/openrsync">openrsync(1)</a> processes.
378: <li>Removed the -f (force) option in <a href="https://man.openbsd.org/rpki-client">rpki-client(8)</a>.
1.53 tb 379: <li><a href="https://man.openbsd.org/rpki-client">rpki-client(8)</a> no longer uses <a href="https://man.openbsd.org/openrsync">openrsync(1)</a>'s "--delete" to clean up stale files, but instead relies on cryptographically signed RPKI manifest listings.
1.7 jsg 380: <li>Fixed <a href="https://man.openbsd.org/rpki-client">rpki-client(8)</a> return value check for OpenSSL API used during pubkey validation.
1.1 benno 381: <li>Released <a href="https://man.openbsd.org/rpki-client">rpki-client(8)</a> 6.7p1 including OpenBSD 6.7 Errata 015.
382: <li>Changed <a href="https://man.openbsd.org/rpki-client">rpki-client(8)</a> -n behavior to automatically validate the repo.
383: <li>Added a "-s timeout" feature to <a href="https://man.openbsd.org/rpki-client">rpki-client(8)</a> with a one hour default, allowing fresh attempts with <a href="https://man.openbsd.org/cron">cron(8)</a> if rpki-client gets stuck.
384: <!-- other userland -->
1.37 florian 385: <li>Added an optional "domain name" <a href="https://man.openbsd.org/acme-client.conf">acme-client.conf(5)</a> option allowing use of multiple domain sections with the same name and creation of an rsa and an ecdsa key for the same domain name.
386: <li>Added an optional "contact" <a href="https://man.openbsd.org/acme-client.conf">acme-client.conf(5)</a> option to the account section allowing issuance of certificates from authorities that require a contact email address.
1.1 benno 387: <li>Added <a href="https://man.openbsd.org/netstat">netstat(1)</a> -R to show a summary of rdomains with associated interfaces and tables.
388: <li>Defaulted to showing full IPv6 address entries in the routing tables displayed by <a href="https://man.openbsd.org/route">route(8)</a> show and <a href="https://man.openbsd.org/netstat">netstat(1)</a> -r.
1.27 kn 389: <li>Fixed <a href="https://man.openbsd.org/pcap-filters">pcap-filters(5)</a> on DLT_LOOP links, e.g. <a href="https://man.openbsd.org/lo">lo(4)</a>, <a href="https://man.openbsd.org/gre">gre(4)</a>, <a href="https://man.openbsd.org/wg">wg(4)</a>, etc.
1.1 benno 390: <li>Fixed <a href="https://man.openbsd.org/dhclient">dhclient(8)</a> domain-search option processing.
1.71 krw 391: <li>Corrected <a href="https://man.openbsd.org/dhclient">dhclient(8)</a> DECLINE message generation to always include the OFFER'd address.
392: <li>Enabled append/prepend for the domain-search option in <a href="https://man.openbsd.org/dhclient.conf">dhclient.conf(5)</a>.
393: <li>Removed 128-byte limit on <a href="https://man.openbsd.org/dhclient">dhclient(8)</a> search domains and static routes.
1.1 benno 394: <li>Corrected <a href="https://man.openbsd.org/route">route(8)</a> handling of ::/0 and "route add -inet 0.0.0.0 -prefixlen 0 (gateway)".
1.27 kn 395: <li>Fixed integer underflow in <a href="https://man.openbsd.org/tcpdump">tcpdump(8)</a> due to tiny snaplen causing bogus hexdumps.
1.1 benno 396: <li>Added initial <a href="https://man.openbsd.org/tcpdump">tcpdump(8)</a> support for handling geneve packets.
397: <li>Added <a href="https://man.openbsd.org/top">top(1)</a> "t" to toggle the display of routing tables.
398: <li>Added filtering by routing table to <a href="https://man.openbsd.org/top">top(1)</a>.
399: <li>Moved <a href="https://man.openbsd.org/ntpd">ntpd(8)</a> to unsynced mode if no replies are received for awhile due to connectivity issues.
400: <li>Made <a href="https://man.openbsd.org/slaacd">slaacd(8)</a> handle IPv6 address configuration in all rdomains in a single daemon, instead of running one daemon per rdomain.
401: </ul>
402:
403: <li><a href="https://man.openbsd.org/ipsec">ipsec(4)</a> (and related userland programs) improvements and
404: bugfixes:
405: <ul>
406: <li>Added AES-GCM mode ciphers for IKEv2, configurable in <a href="https://man.openbsd.org/iked.conf">iked.conf(5)</a> with the new "ikesa enc" options aes-128-gcm, aes-256-gcm, aes-128-gcm-12 and aes-256-gcm-12.
1.52 tobhe 407: <li>Enabled AES-GCM ciphers by default for IKE and Child SAs resulting in considerable performance improvements with hardware acceleration support.
408: <li>Enabled SHA2_384 and SHA2_512 by default for improved compatibilty.
409: <li>Added the new <a href="https://man.openbsd.org/iked">iked(8)</a> configuration option "set enforcesingleikesa" to limit the number of connections for each peer.
1.1 benno 410: <li>Added optional <a href="https://man.openbsd.org/iked">iked(8)</a> time-stamp validation for OCSP.
1.52 tobhe 411: <li>Added a 30 second timeout for OCSP requests in <a href="https://man.openbsd.org/iked">iked(8)</a>.
412: <li>Added a new "set cert_partial_chain" config option to <a href="https://man.openbsd.org/iked.conf">iked.conf(5)</a> to allow verification of partial certificate chains if a trusted intermediate CA is found in /etc/iked/ca.
1.1 benno 413: <li>Added a dpd_check_interval configuration option to <a href="https://man.openbsd.org/iked.conf">iked.conf(5)</a>.
414: <li>Allowed disabling of <a href="https://man.openbsd.org/iked">iked(8)</a> DPD liveness checks by setting dpd_check_interval to 0 in <a href="https://man.openbsd.org/iked.conf">iked.conf(5)</a>.
1.52 tobhe 415: <li>Made <a href="https://man.openbsd.org/iked">iked(8)</a> use the CA certificate for the OCSP issuer and respect the OCSP url from the issuer certificate.
416: <li>Fixed <a href="https://man.openbsd.org/iked">iked(8)</a> public key authentication interoperability with *swan and other IKEv2 implementations by making CERT and CERTREQ payloads optional.
417: <li>Fixed an <a href="https://man.openbsd.org/iked">iked(8)</a> policy lookup edge case for simultaneous transport and tunnel mode SAs.
1.24 kn 418: <li>Fixed a dst/src <a href="https://man.openbsd.org/iked">iked(8)</a> port configuration bug with multiple flows.
1.52 tobhe 419: <li>Prioritized incoming certificate requests by the order of CERTEQ payloads in the received message in <a href="https://man.openbsd.org/iked">iked(8)</a>.
420: <li>Prevented concurrent CREATE_CHILD_SA and INFORMATION exchanges in <a href="https://man.openbsd.org/iked">iked(8)</a>.
1.24 kn 421: <li>Handled <a href="https://man.openbsd.org/iked">iked(8)</a> TEMPORARY_FAILURE notification on IKESA rekeying.
1.52 tobhe 422: <li>Fixed multiple bugs with pfkey acquire messages.
1.1 benno 423: </ul>
424:
425: <li><a href="https://man.openbsd.org/tmux">tmux(1)</a> improvements and bug fixes:
426: <ul>
1.43 nicm 427: <li>How data is sent to control mode clients has been completely revamped to both be more fair with multiple panes and to prevent huge amounts of data being backed up.
428: <li>Configuration file parsing has changed slightly: the contents of the {} syntax must now be valid <a href="https://man.openbsd.org/tmux">tmux(1)</a> command syntax; and to allow formats to be annotated, strings given with quotes may now contain newlines (leading spaces and comments are stripped).
429: <li>A new customize mode available with C-b C (C-b S-c) which allows options and key bindings to be browsed and changed interactively.
430: <li>Support for extended keys offered by some terminals (xterm, mintty, iTerm2).
431: <li>A pane-border-lines option to change the characters used to draw the pane border separators.
432: <li>How UTF-8 data is stored has been rewritten to reduce memory use for characters in the BMP.
433: <li>The message log (C-b ~) has been changed to be per server instead of per client and to have some useful content.
434: <li>A new active-pane client flag that if given allows a client to have its own active pane for each window rather than being tied to the server's active pane.
435: <li>Improved command-prompt completion including showing a menu of completions.
436: <li>All style options can now be formats, for example the default pane-active-border-style now changes colour depending on pane_in_mode and synchronize-panes.
437: <li>Performance improvements in copy mode and additional styles for marking of search terms.
438: <li>Window and pane hooks such as window-layout-changed and pane-exited are now window or pane options instead of session options.
1.1 benno 439: <li>Added the 'e' key in buffer mode to open the buffer in an editor.
440: <li>Added M-+ and M-- to expand and collapse all items in tree mode.
441: <li>Added a -D flag to run in non-daemonized mode.
442: <li>Added <a href="https://man.openbsd.org/tmux">tmux(1)</a> -b flags to insert a window before (like the existing -a for after) to break-pane, move-window and new-window.
443: <li>Changed <a href="https://man.openbsd.org/tmux">tmux(1)</a> searching to behave more like emacs and prevented regex searching from overlapping when searching forward.
444: <li>Allowed a-z keys for <a href="https://man.openbsd.org/tmux">tmux(1)</a> display-panes to jump to higher-numbered panes.
445: <li>Allowed use of -N without a command to change or add a note to an existing key in <a href="https://man.openbsd.org/tmux">tmux(1)</a>.
446: </ul>
447:
448: <li>VMM/VMD and ldom/sparc64 virtualization improvements
449: <ul>
1.24 kn 450: <li>Fixed <a href="https://man.openbsd.org/ldomctl">ldomctl(8)</a> "init-system" with multiple PCIe root complexes (Oracle SPARC T4-2 machines).
451: <li>Made <a href="https://man.openbsd.org/ldomctl">ldomctl(8)</a> reject vdisk, vnet and iodevice parameters for primary domain.
1.1 benno 452: <li>Made <a href="https://man.openbsd.org/ldomctl">ldomctl(8)</a> "init-system -n" check vcpu and memory constraints.
453: <li>Increased the default number of ldom and ttyV devices for sparc64 from eight to sixteen.
454: <li>Fixed <a href="https://man.openbsd.org/vmd">vmd(8)</a> ns8250 lockup due to a race condition, helping to prevent linux vm crashes when the return key is held on boot.
455: <li>Prevented possible libevent state corruption in <a href="https://man.openbsd.org/vmd">vmd(8)</a>.
456: </ul>
457:
458: <li>OpenSMTPD 6.8.0
459: <ul>
460: <li>Fixed an uninitialized variable and potential stack overflow with IPv6 connections in <a href="https://man.openbsd.org/smtpd">smtpd(8)</a>.
461: <li>Fixed <a href="https://man.openbsd.org/smtpd">smtpd(8)</a> handling of user names containing "@" symbols.
462: <li>Allowed handling of long lines in an <a href="https://man.openbsd.org/smtpd">smtpd(8)</a> aliases table.
463: <li>Removed <a href="https://man.openbsd.org/mail.local">mail.local(8)</a> support for world-writable mail spools.
464: </ul>
465:
1.54 tb 466: <li>LibreSSL 3.2.2
1.1 benno 467: <ul>
468: <li>New Features
469: <ul>
1.55 beck 470: <li>This is the first stable release with the new TLSv1.3
1.58 tb 471: implementation enabled by default for both client and server. The
1.55 beck 472: OpenSSL 1.1 TLSv1.3 API is not yet available and will be provided
1.54 tb 473: in an upcoming release.
474:
1.55 beck 475: <li>New X509 certificate chain validator that correctly handles
476: multiple paths through intermediate certificates. Loosely based on
477: Go's X509 validator.
478:
479: <li>New name constraints verification implementation which passes the
1.78 schwarze 480: <a href="https://nameconstraints.bettertls.com/">BetterTLS</a>
481: certificate validation check suite.
1.1 benno 482: </ul>
483:
484: <li>API and Documentation Enhancements
485: <ul>
1.57 tb 486: <li>New <a href="https://man.openbsd.org/CMAC_Init">CMAC_Init(3)</a> and <a href="https://man.openbsd.org/ChaCha">ChaCha(3)</a> manual pages.
487: <li>Document <a href="https://man.openbsd.org/SSL_set1_host">SSL_set1_host(3)</a>, <a href="https://man.openbsd.org/SSL_set_SSL_CTX">SSL_set_SSL_CTX(3)</a>.
1.54 tb 488: <li>Document PKCS7 attribute functions.
1.57 tb 489: <li>Document <a href="https://man.openbsd.org/PKCS7_final">PKCS7_final(3)</a>, <a href="https://man.openbsd.org/PKCS7_add_attribute">PKCS7_add_attribute(3)</a>.
490: <li>Document <a href="https://man.openbsd.org/PKCS7_get_signer_info">PKCS7_get_signer_info(3)</a>.
491: <li>Document <a href="https://man.openbsd.org/PEM_ASN1_read">PEM_ASN1_read(3)</a> and <a href="https://man.openbsd.org/PEM_ASN1_read_bio">PEM_ASN1_read_bio(3)</a>.
492: <li>Document <a href="https://man.openbsd.org/PEM_X509_INFO_read">PEM_X509_INFO_read(3)</a> and <a href="https://man.openbsd.org/PEM_X509_INFO_read_bio">PEM_X509_INFO_read_bio(3)</a>.
493: <li>Document <a href="https://man.openbsd.org/PEM_def_callback">PEM_def_callback(3)</a>.
494: <li>Document <a href="https://man.openbsd.org/EVP_read_pw_string_min">EVP_read_pw_string_min(3)</a>.
495: <li>Merge documentation of <a href="https://man.openbsd.org/X509_get0_serialNumber">X509_get0_serialNumber(3)</a> from OpenSSL 1.1.1.
496: <li>Document error handling of <a href="https://man.openbsd.org/X509_PUBKEY_get0">X509_PUBKEY_get0(3)</a> and <a href="https://man.openbsd.org/X509_PUBKEY_get">X509_PUBKEY_get(3)</a>.
497: <li>Document <a href="https://man.openbsd.org/X509_get0_pubkey_bitstr">X509_get0_pubkey_bitstr(3)</a>
498: <li>Document <a href="https://man.openbsd.org/openssl">openssl(1)</a> certhash.
1.1 benno 499: </ul>
500:
501: <li>Compatibility Changes
502: <ul>
1.61 tb 503: <li>Modify I/O behavior so that <a href="https://man.openbsd.org/SSL_CTX_set_mode#SSL_MODE_AUTO_RETRY">SSL_MODE_AUTO_RETRY</a> is the default similar to new OpenSSL releases.
1.54 tb 504: <li>Add the P-521 curve to the list of curves supported by default in the client.
505: <li>Define OPENSSL_NO_SSL_TRACE in opensslfeatures.h.
506: <li>Make SSL_CTX_get_ciphers(NULL) return NULL rather than crash.
507: <li>Improve TLSv1.3 client certificate selection to allow EC certificates instead of only RSA certificates.
508: <li>Add minimal info callback support for TLSv1.3.
1.57 tb 509: <li>Support TLSv1.3 options in the <a href="https://man.openbsd.org/openssl">openssl(1)</a> command.
1.54 tb 510: <li>Add support for additional GOST curves from RFC 7836 and draft-deremin-rfc4491-bis.
511: <li>Add OIDs for HMAC using the Streebog hash function.
512: <li>Allow GOST R 34.11-2012 in PBE/PBKDF2/PKCS#5.
513: <li>Enable GOST_SIG_FORMAT_RS_LE when verifying certificate signatures.
514: <li>Handle GOST in ssl_cert_dup().
515: <li>Stop sending GOST R 34.10-94 as a CertificateType.
516: <li>Use IANA allocated GOST ClientCertificateTypes.
1.1 benno 517: </ul>
518:
519: <li>Testing and Proactive Security
520: <ul>
1.54 tb 521: <li>Greatly expanded test coverage via the tlsfuzzer test scripts.
1.78 schwarze 522: <li>Expanded test coverage via the <a href="https://nameconstraints.bettertls.com/">BetterTLS</a> certificate test suite.
1.54 tb 523: <li>Test interoperability with the Botan TLS client.
1.1 benno 524: </ul>
525:
526: <li>Internal Improvements
527: <ul>
1.54 tb 528: <li>Collapse x509v3 directory into x509.
529: <li>Add initial support for openbsd/powerpc64.
1.56 tb 530: <li>Improve length checks in the TLSv1.3 record layer and provide appropriate alerts for violations of record layer limits.
1.54 tb 531: <li>Enforce that SNI hostnames received by the TLS server are correctly formed as per RFC 5890 and RFC 6066, responding with illegal parameter for a nonconformant host name.
1.60 tb 532: <li>Support <a href="https://man.openbsd.org/SSL_CTX_set_mode#SSL_MODE_AUTO_RETRY">SSL_MODE_AUTO_RETRY</a> in TLSv1.3 to allow the automatic retry of handshake messages.
1.57 tb 533: <li>Improve the handling of <a href="https://man.openbsd.org/BIO_read">BIO_read(3)</a>/<a href="https://man.openbsd.org/BIO_write">BIO_write(3)</a> failures in the TLSv1.3 stack.
1.54 tb 534: <li>Start replacing the existing TLSv1.2 record layer.
535: <li>Simplify SSL method lookups.
1.57 tb 536: <li>Clean up and simplify <a href="https://man.openbsd.org/SSL_get_ciphers">SSL_get_ciphers(3)</a>, <a href="https://man.openbsd.org/SSL_set_session">SSL_set_session(3)</a>, <a href="https://man.openbsd.org/SSL_set_ssl_method">SSL_set_ssl_method(3)</a> and several internal functions.
1.54 tb 537: <li>Refactor dtls1_new(), dtls1_hm_fragment_new(), dtls1_drain_fragments(), dtls1_clear_queues().
538: <li>Make the message type available in the internal TLS extensions API functions.
1.57 tb 539: <li>Numerous <a href="https://man.openbsd.org/openssl">openssl(1)</a> subcommands were converted to the new option handling.
1.54 tb 540: <li>Copy the session ID directly in ssl_get_prev_session() instead of handing it through several functions for copying.
1.63 tb 541: <li>Clean up and refactor ssl_get_prev_session(); simplify tls_decrypt_ticket() and tls1_process_ticket() exit paths.
1.1 benno 542: </ul>
543:
544: <li>Portable Improvements
545: <ul>
1.54 tb 546: <li>Make pthread_mutex static initialisation work on Windows.
547: <li>Get __STRICT_ALIGNMENT from machine/endian.h with portable build.
1.1 benno 548: </ul>
549:
550: <li>Bug Fixes
551: <ul>
1.54 tb 552: <li>Fix an off-by-one in the CBC padding removal.
553: <li>Enforce in the TLSv1.3 server that that ClientHello messages after a HelloRetryRequest match the original ClientHello as per RFC 8446 section 4.1.2
554: <li>Avoid calling freezero with a negative size if a server sends a malformed plaintext of all zeroes.
555: <li>Correct use of sockaddr_storage instead of sockaddr in openssl(1) s_client, which could lead to using 14 bytes of stack garbage instead of an IPv6 address in DTLS mode.
1.57 tb 556: <li>Fix a longstanding bug in <a href="https://man.openbsd.org/PEM_X509_INFO_read_bio">PEM_X509_INFO_read_bio(3)</a> that could cause use-after-free and double-free issues in calling programs.
1.54 tb 557: <li>Zero out variable on the stack to avoid leaving garbage in the tail of short session IDs.
558: <li>Ensure that appropriate alerts are sent on various error conditions.
1.57 tb 559: <li>Move state initialization from <a href="https://man.openbsd.org/SSL_clear">SSL_clear(3)</a> to ssl3_clear() to ensure that it gets correctly reinitialized across a <a href="https://man.openbsd.org/SSL_set_ssl_method">SSL_set_ssl_method(3)</a> call.
1.54 tb 560: <li>Add a custom copy handler for AES keywrap to fix a use-after-free.
1.57 tb 561: <li>Avoid an out-of-bounds write in <a href="https://man.openbsd.org/BN_rand">BN_rand(3)</a>.
1.59 tb 562: <li>Fix numerous leaks in the <a href="https://man.openbsd.org/UI_new">UI_dup_*(3)</a> functions. Simplify and tidy up the code in ui_lib.c.
1.57 tb 563: <li>Correctly track selected ALPN length to avoid a potential segmentation fault with <a href="https://man.openbsd.org/SSL_get0_alpn_selected">SSL_get0_alpn_selected(3)</a> when alpn_selected is NULL.
1.54 tb 564: <li>Include machine/endian.h gost2814789.c in order to pick up the __STRICT_ALIGNMENT define.
1.57 tb 565: <li>Correctly handle ssl_cert_dup() failure in <a href="https://man.openbsd.org/SSL_set_SSL_CTX">SSL_set_SSL_CTX(3)</a>.
566: <li>Fail on receiving an invalid NID in <a href="https://man.openbsd.org/X509_ATTRIBUTE_create">X509_ATTRIBUTE_create(3)</a> instead of constructing a broken objects that may cause NULL pointer accesses.
567: <li>Fix <a href="https://man.openbsd.org/SSL_shutdown">SSL_shutdown(3)</a> behavior in TLSv1.3 to match the legacy stack. The previous behavior could cause a hang.
568: <li>Modify "openssl x509" to display invalid certificate times as invalid, and correctly deal with the failing return case from <a href="https://man.openbsd.org/X509_cmp_time ">X509_cmp_time(3)</a> so that a certificate with an invalid NotAfter does not appear valid.
1.1 benno 569: </ul>
570: </ul>
571:
1.14 benno 572: <li>OpenSSH 8.4
1.1 benno 573: <ul>
574: <li>Potentially incompatible changes.
1.14 benno 575: <ul>
576: <li>For FIDO/U2F support, OpenSSH recommends the use of libfido2
577: 1.5.0 or greater. Older libraries have limited support at the expense
578: of disabling particular features. These include resident keys, PIN-
579: required keys and multiple attached tokens.
580: <li><a href="https://man.openbsd.org/ssh-keygen">ssh-keygen(1)</a>:
581: the format of the attestation information optionally recorded when a
582: FIDO key is generated has changed. It now includes the authenticator
583: data needed to validate attestation signatures.
584: <li>The API between OpenSSH and the FIDO token middleware has
585: changed and the SSH_SK_VERSION_MAJOR version has been incremented as a
586: result. Third-party middleware libraries must support the current API
587: version (7) to work with OpenSSH 8.4.
588: <li>The portable OpenSSH distribution now requires automake to
589: rebuild the configure script and supporting files. This is not
590: required when simply building portable OpenSSH from a release tar
591: file.
592: </ul>
1.1 benno 593: <li>New Features
1.14 benno 594: <ul>
1.66 kn 595: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>,
596: <a href="https://man.openbsd.org/ssh-keygen">ssh-keygen(1)</a>:
1.14 benno 597: support for FIDO keys that require a PIN for each use. These keys may
598: be generated using ssh-keygen using a new "verify-required" option.
599: When a PIN-required key is used, the user will be prompted for a PIN
600: to complete the signature operation.
601: <li><a href="https://man.openbsd.org/sshd">sshd(8)</a>:
602: authorized_keys now supports a new "verify-required" option to require
603: FIDO signatures assert that the token verified that the user was
604: present before making the signature. The FIDO protocol supports
605: multiple methods for user-verification, but currently OpenSSH only
606: supports PIN verification.
607: <li><a href="https://man.openbsd.org/sshd">sshd(8)</a>, <a
608: href="https://man.openbsd.org/ssh-keygen">ssh-keygen(1)</a>: add
609: support for verifying FIDO webauthn signatures. Webauthn is a standard
610: for using FIDO keys in web browsers. These signatures are a slightly
611: different format to plain FIDO signatures and thus require explicit
612: support.
613: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>: allow some
614: keywords to expand shell-style ${ENV} environment variables. The
615: supported keywords are CertificateFile, ControlPath, IdentityAgent and
616: IdentityFile, plus LocalForward and RemoteForward when used for Unix
617: domain socket paths.
618: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>, <a
619: href="https://man.openbsd.org/ssh-agent">ssh-agent(1)</a>: allow some
620: additional control over the use of ssh-askpass via a new
621: $SSH_ASKPASS_REQUIRE environment variable, including forcibly enabling
622: and disabling its use.
623: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>: allow <a
624: href="https://man.openbsd.org/ssh_config">ssh_config(5)</a>'s
625: AddKeysToAgent keyword accept a time limit for keys in addition to its
626: current flag options. Time- limited keys will automatically be removed
627: from ssh-agent after their expiry time has passed.
628: <li><a href="https://man.openbsd.org/scp">scp(1)</a>, <a
629: href="https://man.openbsd.org/sftp">sftp(1)</a>: allow the -A flag to
630: explicitly enable agent forwarding in scp and sftp. The default
631: remains to not forward an agent, even when ssh_config enables it.
632: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>: add a '%k'
633: TOKEN that expands to the effective HostKey of the destination. This
634: allows, e.g., keeping host keys in individual files using
635: "UserKnownHostsFile ~/.ssh/known_hosts.d/%k".
1.53 tb 636: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>: add %-TOKEN,
1.14 benno 637: environment variable and tilde expansion to the UserKnownHostsFile
638: directive, allowing the path to be completed by the configuration.
639: <li><a href="https://man.openbsd.org/ssh-keygen">ssh-keygen(1)</a>:
640: allow "ssh-add -d -" to read keys to be deleted from stdin.
641: <li><a href="https://man.openbsd.org/sshd">sshd(8)</a>: improve
642: logging for MaxStartups connection throttling. sshd will now log when
643: it starts and stops throttling and periodically while in this state.
644: </ul>
1.1 benno 645: <li>Bugfixes
1.14 benno 646: <ul>
647: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>, <a
648: href="https://man.openbsd.org/ssh-keygen">ssh-keygen(1)</a>: better
649: support for multiple attached FIDO tokens. In cases where OpenSSH
650: cannot unambiguously determine which token to direct a request to, the
651: user is now required to select a token by touching it. In cases of
652: operations that require a PIN to be verified, this avoids sending the
653: wrong PIN to the wrong token and incrementing the token's PIN failure
654: counter (tokens effectively erase their keys after too many PIN
655: failures).
656: <li><a href="https://man.openbsd.org/sshd">sshd(8)</a>: fix Include
657: before Match in <a
658: href="https://man.openbsd.org/sshd_config">sshd_config(5)</a>.
659: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>: close
660: stdin/out/error when forking after authentication completes ("ssh -f
661: ...").
662: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>, <a
663: href="https://man.openbsd.org/sshd">sshd(8)</a>: limit the amount of
664: channel input data buffered, avoiding peers that advertise large
665: windows but are slow to read from causing high memory consumption.
666: <li><a href="https://man.openbsd.org/ssh-agent">ssh-agent(1)</a>:
667: handle multiple requests sent in a single write() to the agent.
668: <li><a href="https://man.openbsd.org/sshd">sshd(8)</a>: allow <a
669: href="https://man.openbsd.org/sshd_config">sshd_config(5)</a> longer than 256k
670: <li><a href="https://man.openbsd.org/sshd">sshd(8)</a>: avoid
671: spurious "Unable to load host key" message when sshd load a private
672: key but no public counterpart
673: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>: prefer the
674: default hostkey algorithm list whenever we have a hostkey that matches
675: its best-preference algorithm.
1.81 ! schwarze 676: <li><a href="https://man.openbsd.org/sshd">ssh(1)</a>: when
1.14 benno 677: ordering the hostkey algorithms to request from a server, prefer
678: certificate types if the known_hosts files contain a key marked as a
679: @cert-authority;
680: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>: perform host
681: key fingerprint comparisons for the "Are you sure you want to continue
682: connecting (yes/no/[fingerprint])?" prompt with case sensitivity.
683: <li><a href="https://man.openbsd.org/sshd">sshd(8)</a>: ensure that
684: address/masklen mismatches in sshd_config yield fatal errors at daemon
685: start time rather than later when they are evaluated.
686: <li><a href="https://man.openbsd.org/ssh-keygen">ssh-keygen(1)</a>:
687: ensure that certificate extensions are lexically sorted. Previously if
688: the user specified a custom extension then the everything would be in
689: order except the custom ones.
690: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>: also compare
691: username when checking for JumpHost loops.
692: <li><a href="https://man.openbsd.org/ssh-keygen">ssh-keygen(1)</a>:
693: preserve group/world read permission on known_hosts files across runs
694: of "ssh-keygen -Rf /path". The old behaviour was to remove all rights
695: for group/other.
1.42 deraadt 696: <li><a href="https://man.openbsd.org/ssh-keygen">ssh-keygen(1)</a>:
1.14 benno 697: Mention the [-a rounds] flag in the ssh-keygen manual page and
698: usage().
699: <li><a href="https://man.openbsd.org/sshd">sshd(8)</a>: explicitly construct path to ~/.ssh/rc rather than
700: relying on it being relative to the current directory, so that it
701: can still be found if the shell startup changes its directory.
702: <li><a href="https://man.openbsd.org/sshd">sshd(8)</a>: when
703: redirecting sshd's log output to a file, undo this redirection after
704: the session child process is forked(). Fixes missing log messages when
705: using this feature under some circumstances.
706: <li><a href="https://man.openbsd.org/sshd">sshd(8)</a>: start
707: ClientAliveInterval bookkeeping before first pass through select()
708: loop; fixed theoretical case where busy sshd may ignore timeouts from
709: client.
710: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>: only reset the
711: ServerAliveInterval check when we receive traffic from the server and
712: ignore traffic from a port forwarding client, preventing a client from
713: keeping a connection alive when it should be terminated.
714: <li><a href="https://man.openbsd.org/ssh-keygen">ssh-keygen(1)</a>:
715: avoid spurious error message when ssh-keygen creates files outside
716: ~/.ssh
717: <li><a
1.79 schwarze 718: href="https://man.openbsd.org/sftp.1">sftp(1)</a>: fix
1.14 benno 719: off-by-one error that caused sftp downloads to make one more
1.79 schwarze 720: concurrent request than desired. This prevented using <a
1.14 benno 721: href="https://man.openbsd.org/sftp">sftp(1)</a> in unpipelined
722: request/response mode, which is useful when debugging.
723: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>, <a
724: href="https://man.openbsd.org/sshd">sshd(8)</a>: handle EINTR in
725: waitfd() and timeout_connect() helpers.
726: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>, <a
727: href="https://man.openbsd.org/ssh-keygen">ssh-keygen(1)</a>: defer
728: creation of ~/.ssh until we attempt to write to it so we don't leave
729: an empty .ssh directory when it's not needed.
730: <li><a href="https://man.openbsd.org/ssh">ssh(1)</a>, <a
731: href="https://man.openbsd.org/sshd">sshd(8)</a>: fix multiplier when
732: parsing time specifications when handling seconds after other units.
733: </ul>
1.1 benno 734: </ul>
735:
736: <li>Ports and packages:
737: <p>Many pre-built packages for each architecture:
738: <!-- number of FTP packages minus SHA256, SHA256.sig, index.txt -->
739: <ul style="column-count: 3">
1.39 naddy 740: <li>aarch64: 10768
1.11 sthen 741: <li>amd64: 11234
1.1 benno 742: <li>arm: XXX
1.11 sthen 743: <li>i386: 10548
1.45 visa 744: <li>mips64: 8540
1.1 benno 745: <li>mips64el: XXX
1.76 cwen 746: <li>powerpc: 9783
1.74 naddy 747: <li>powerpc64: 6221
1.39 naddy 748: <li>sparc64: 9688
1.1 benno 749: </ul>
750:
751: <li>As usual, steady improvements in manual pages and other documentation.
752:
1.47 benno 753: <li>The system includes the following major components from outside suppliers:
1.46 benno 754: <ul>
1.68 benno 755: <li>Xenocara (based on X.Org 7.7 with xserver 1.20.8 + patches,
1.4 jsg 756: freetype 2.10.2, fontconfig 2.12.4, Mesa 20.0.8, xterm 351,
1.1 benno 757: xkeyboard-config 2.20 and more)
758: <li>LLVM/Clang 10.0.1 (+ patches)
759: <li>GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
760: <li>Perl 5.30.3 (+ patches)
761: <li>NSD 4.3.2
762: <li>Unbound 1.11.0
763: <li>Ncurses 5.7
764: <li>Binutils 2.17 (+ patches)
765: <li>Gdb 6.3 (+ patches)
766: <li>Awk August 7, 2020 version
767: <li>Expat 2.2.8
768: </ul>
769:
770: </ul>
771: </section>
772:
773: <hr>
774:
775: <section id=install>
776: <h3>How to install</h3>
777: <p>
778: Please refer to the following files on the mirror site for
779: extensive details on how to install OpenBSD 6.8 on your machine:
780:
781: <ul>
782: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/alpha/INSTALL.alpha">
783: .../OpenBSD/6.8/alpha/INSTALL.alpha</a>
784: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/amd64/INSTALL.amd64">
785: .../OpenBSD/6.8/amd64/INSTALL.amd64</a>
786: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/arm64/INSTALL.arm64">
787: .../OpenBSD/6.8/arm64/INSTALL.arm64</a>
788: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/armv7/INSTALL.armv7">
789: .../OpenBSD/6.8/armv7/INSTALL.armv7</a>
790: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/hppa/INSTALL.hppa">
791: .../OpenBSD/6.8/hppa/INSTALL.hppa</a>
792: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/i386/INSTALL.i386">
793: .../OpenBSD/6.8/i386/INSTALL.i386</a>
794: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/landisk/INSTALL.landisk">
795: .../OpenBSD/6.8/landisk/INSTALL.landisk</a>
796: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/loongson/INSTALL.loongson">
797: .../OpenBSD/6.8/loongson/INSTALL.loongson</a>
798: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/luna88k/INSTALL.luna88k">
799: .../OpenBSD/6.8/luna88k/INSTALL.luna88k</a>
800: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/macppc/INSTALL.macppc">
801: .../OpenBSD/6.8/macppc/INSTALL.macppc</a>
802: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/octeon/INSTALL.octeon">
803: .../OpenBSD/6.8/octeon/INSTALL.octeon</a>
804: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/powerpc64/INSTALL.powerpc64">
805: .../OpenBSD/6.8/octeon/INSTALL.powerpc64</a>
806: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/sgi/INSTALL.sgi">
807: .../OpenBSD/6.8/sgi/INSTALL.sgi</a>
808: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.8/sparc64/INSTALL.sparc64">
809: .../OpenBSD/6.8/sparc64/INSTALL.sparc64</a>
810: </ul>
811: </section>
812:
813: <hr>
814:
815: <section id=quickinstall>
816: <p>
817: Quick installer information for people familiar with OpenBSD, and the use of
818: the "<a href="https://man.openbsd.org/disklabel.8">disklabel</a> -E" command.
819: If you are at all confused when installing OpenBSD, read the relevant
820: INSTALL.* file as listed above!
821:
822: <h3>OpenBSD/alpha:</h3>
823:
824: <p>
825: If your machine can boot from CD, you can write <i>install68.iso</i> or
826: <i>cd68.iso</i> to a CD and boot from it.
827: Refer to INSTALL.alpha for more details.
828:
829: <h3>OpenBSD/amd64:</h3>
830:
831: <p>
832: If your machine can boot from CD, you can write <i>install68.iso</i> or
833: <i>cd68.iso</i> to a CD and boot from it.
834: You may need to adjust your BIOS options first.
835:
836: <p>
1.23 kettenis 837: If your machine can boot from USB, you can write <i>install68.img</i> or
838: <i>miniroot68.img</i> to a USB stick and boot from it.
1.1 benno 839:
840: <p>
841: If you can't boot from a CD, floppy disk, or USB,
842: you can install across the network using PXE as described in the included
843: INSTALL.amd64 document.
844:
845: <p>
846: If you are planning to dual boot OpenBSD with another OS, you will need to
847: read INSTALL.amd64.
848:
849: <h3>OpenBSD/arm64:</h3>
850:
851: <p>
1.23 kettenis 852: Write <i>miniroot68.img</i> to a disk and boot from it after connecting
1.1 benno 853: to the serial console. Refer to INSTALL.arm64 for more details.
854:
855: <h3>OpenBSD/armv7:</h3>
856:
857: <p>
858: Write a system specific miniroot to an SD card and boot from it after connecting
859: to the serial console. Refer to INSTALL.armv7 for more details.
860:
861: <h3>OpenBSD/hppa:</h3>
862:
863: <p>
864: Boot over the network by following the instructions in INSTALL.hppa or the
865: <a href="hppa.html#install">hppa platform page</a>.
866:
867: <h3>OpenBSD/i386:</h3>
868:
869: <p>
870: If your machine can boot from CD, you can write <i>install68.iso</i> or
871: <i>cd68.iso</i> to a CD and boot from it.
872: You may need to adjust your BIOS options first.
873:
874: <p>
1.23 kettenis 875: If your machine can boot from USB, you can write <i>install68.img</i> or
876: <i>miniroot68.img</i> to a USB stick and boot from it.
1.1 benno 877:
878: <p>
879: If you can't boot from a CD, floppy disk, or USB,
880: you can install across the network using PXE as described in
881: the included INSTALL.i386 document.
882:
883: <p>
884: If you are planning on dual booting OpenBSD with another OS, you will need to
885: read INSTALL.i386.
886:
887: <h3>OpenBSD/landisk:</h3>
888:
889: <p>
1.23 kettenis 890: Write <i>miniroot68.img</i> to the start of the CF
1.1 benno 891: or disk, and boot normally.
892:
893: <h3>OpenBSD/loongson:</h3>
894:
895: <p>
1.23 kettenis 896: Write <i>miniroot68.img</i> to a USB stick and boot bsd.rd from it
1.1 benno 897: or boot bsd.rd via tftp.
898: Refer to the instructions in INSTALL.loongson for more details.
899:
900: <h3>OpenBSD/luna88k:</h3>
901:
902: <p>
903: Copy 'boot' and 'bsd.rd' to a Mach or UniOS partition, and boot the bootloader
904: from the PROM, and then bsd.rd from the bootloader.
905: Refer to the instructions in INSTALL.luna88k for more details.
906:
907: <h3>OpenBSD/macppc:</h3>
908:
909: <p>
910: Burn the image from a mirror site to a CDROM, and power on your machine
911: while holding down the <i>C</i> key until the display turns on and
912: shows <i>OpenBSD/macppc boot</i>.
913:
914: <p>
915: Alternatively, at the Open Firmware prompt, enter <i>boot cd:,ofwboot
916: /6.8/macppc/bsd.rd</i>
917:
918: <h3>OpenBSD/octeon:</h3>
919:
920: <p>
921: After connecting a serial port, boot bsd.rd over the network via DHCP/tftp.
922: Refer to the instructions in INSTALL.octeon for more details.
923:
924: <h3>OpenBSD/powerpc64:</h3>
925:
926: <p>
1.23 kettenis 927: To install, write <i>install68.img</i> or <i>miniroot68.img</i> to a
928: USB stick, plug it into the machine and coose the <i>OpenBSD
929: install</i> menu item in Petitboot.
1.1 benno 930: Refer to the instructions in INSTALL.powerpc64 for more details.
931:
932: <h3>OpenBSD/sgi:</h3>
933:
934: <p>
935: To install, burn cd68.iso on a CD-R, put it in the CD drive of your
936: machine and select <i>Install System Software</i> from the System Maintenance
937: menu. Indigo/Indy/Indigo2 (R4000) systems will not boot automatically from
938: CD-ROM, and need a proper invocation from the PROM prompt.
939: Refer to the instructions in INSTALL.sgi for more details.
940:
941: <p>
942: If your machine doesn't have a CD drive, you can setup a DHCP/tftp network
943: server, and boot using "bootp()/bsd.rd.IP##" using the kernel matching your
944: system type. Refer to the instructions in INSTALL.sgi for more details.
945:
946: <h3>OpenBSD/sparc64:</h3>
947:
948: <p>
949: Burn the image from a mirror site to a CDROM, boot from it, and type
950: <i>boot cdrom</i>.
951:
952: <p>
953: If this doesn't work, or if you don't have a CDROM drive, you can write
1.23 kettenis 954: <i>floppy68.img</i> or <i>floppyB68.img</i>
1.1 benno 955: (depending on your machine) to a floppy and boot it with <i>boot
956: floppy</i>. Refer to INSTALL.sparc64 for details.
957:
958: <p>
959: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install
960: will most likely fail.
961:
962: <p>
1.23 kettenis 963: You can also write <i>miniroot68.img</i> to the swap partition on
1.1 benno 964: the disk and boot with <i>boot disk:b</i>.
965:
966: <p>
967: If nothing works, you can boot over the network as described in INSTALL.sparc64.
968: </section>
969:
970: <hr>
971:
972: <section id=upgrade>
973: <h3>How to upgrade</h3>
974: <p>
1.2 benno 975: If you already have an OpenBSD 6.7 system, and do not want to reinstall,
1.1 benno 976: upgrade instructions and advice can be found in the
977: <a href="faq/upgrade68.html">Upgrade Guide</a>.
978: </section>
979:
980: <hr>
981:
982: <section id=sourcecode>
983: <h3>Notes about the source code</h3>
984: <p>
985: <code>src.tar.gz</code> contains a source archive starting at <code>/usr/src</code>.
986: This file contains everything you need except for the kernel sources,
987: which are in a separate archive.
988: To extract:
989: <blockquote><pre>
990: # <kbd>mkdir -p /usr/src</kbd>
991: # <kbd>cd /usr/src</kbd>
992: # <kbd>tar xvfz /tmp/src.tar.gz</kbd>
993: </pre></blockquote>
994: <p>
995: <code>sys.tar.gz</code> contains a source archive starting at <code>/usr/src/sys</code>.
996: This file contains all the kernel sources you need to rebuild kernels.
997: To extract:
998: <blockquote><pre>
999: # <kbd>mkdir -p /usr/src/sys</kbd>
1000: # <kbd>cd /usr/src</kbd>
1001: # <kbd>tar xvfz /tmp/sys.tar.gz</kbd>
1002: </pre></blockquote>
1003: <p>
1004: Both of these trees are a regular CVS checkout. Using these trees it
1005: is possible to get a head-start on using the anoncvs servers as
1006: described <a href="anoncvs.html">here</a>.
1007: Using these files
1008: results in a much faster initial CVS update than you could expect from
1009: a fresh checkout of the full OpenBSD source tree.
1010: </section>
1011:
1012: <hr>
1013:
1014: <section id=ports>
1015: <h3>Ports Tree</h3>
1016: <p>
1017: A ports tree archive is also provided. To extract:
1018: <blockquote><pre>
1019: # <kbd>cd /usr</kbd>
1020: # <kbd>tar xvfz /tmp/ports.tar.gz</kbd>
1021: </pre></blockquote>
1022: <p>
1023: Go read the <a href="faq/ports/index.html">ports</a> page
1024: if you know nothing about ports
1025: at this point. This text is not a manual of how to use ports.
1026: Rather, it is a set of notes meant to kickstart the user on the
1027: OpenBSD ports system.
1028: <p>
1029: The <i>ports/</i> directory represents a CVS checkout of our ports.
1030: As with our complete source tree, our ports tree is available via
1031: <a href="anoncvs.html">AnonCVS</a>.
1032: So, in order to keep up to date with the -stable branch, you must make
1033: the <i>ports/</i> tree available on a read-write medium and update the tree
1034: with a command like:
1035: <blockquote><pre>
1036: # <kbd>cd /usr/ports</kbd>
1037: # <kbd>cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_6_8</kbd>
1038: </pre></blockquote>
1039: <p>
1040: [Of course, you must replace the server name here with a nearby anoncvs
1041: server.]
1042: <p>
1043: Note that most ports are available as packages on our mirrors. Updated
1044: ports for the 6.8 release will be made available if problems arise.
1045: <p>
1046: If you're interested in seeing a port added, would like to help out, or just
1047: would like to know more, the mailing list
1048: <a href="mail.html">ports@openbsd.org</a> is a good place to know.
1049: </section>
![[BACK]](/icons/back.gif){kind=icon}
Return to 68.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www