Annotation of www/69.html, Revision 1.70
1.1 deraadt 1: <!doctype html>
2: <html lang=en id=release>
3: <meta charset=utf-8>
4:
5: <title>OpenBSD 6.9</title>
6: <meta name="description" content="OpenBSD 6.9">
7: <meta name="viewport" content="width=device-width, initial-scale=1">
8: <link rel="stylesheet" type="text/css" href="openbsd.css">
9: <link rel="canonical" href="https://www.openbsd.org/69.html">
10:
11: <h2 id=OpenBSD>
12: <a href="index.html">
13: <i>Open</i><b>BSD</b></a>
14: 6.9
15: </h2>
16:
17: <table>
18: <tr>
19: <td>
20: <a href="images/XXX.png">
21: <img width="227" height="303" src="images/XXX-s.gif" alt="XXX"></a>
22: <td>
1.2 kn 23: Released May 1, 2021.<br>
24: Copyright 1997-2021, Theo de Raadt.<br>
1.1 deraadt 25: <br>
1.26 benno 26: This is the 50th OpenBSD release.<br>
27: <br>
1.1 deraadt 28: 6.9 Song:
1.70 ! deraadt 29: <a href="lyrics.html#69">"Vetera Novis"</a>.
1.1 deraadt 30: <br>
1.7 job 31: Artwork by Joy San.
1.1 deraadt 32: <br>
33: <ul>
34: <li>See the information on <a href="ftp.html">the FTP page</a> for
35: a list of mirror machines.
36: <li>Go to the <code class=reldir>pub/OpenBSD/6.9/</code> directory on
37: one of the mirror sites.
38: <li>Have a look at <a href="errata69.html">the 6.9 errata page</a> for a list
39: of bugs and workarounds.
40: <li>See a <a href="plus69.html">detailed log of changes</a> between the
41: 6.8 and 6.9 releases.
42: <p>
43: <li><a href="https://man.openbsd.org/signify.1">signify(1)</a>
44: pubkeys for this release:<p>
45:
46: <table class=signify>
47: <tr><td>
48: openbsd-69-base.pub:
49: <td>
50: <a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/openbsd-69-base.pub">
51: RWQZj25CSG5R2oLo5735Hh6C48kkjFsj5rJDjW+fGZwyY+BkD5/zps8f</a>
52: <tr><td>
53: openbsd-69-fw.pub:
54: <td>
55: RWSYx4htNi/zavF8ZToMBDFz2xymRfFnnR1MEKV9csYbvnrTBwdkXhdy
56: <tr><td>
57: openbsd-69-pkg.pub:
58: <td>
59: RWQlDXyHx5KlPoEiz4yWRK/Gt/rvPwI8KEAt3utge/dBS7R+EscdzA5K
60: <tr><td>
61: openbsd-69-syspatch.pub:
62: <td>
63: RWRWuHkSV0U8PUX24vGa3ywrvKNQY6llV3PLvKEzDTiTVPfIRaXPfvzR
64: </table>
65: </ul>
66: <p>
67: All applicable copyrights and credits are in the src.tar.gz,
68: sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the
69: files fetched via <code>ports.tar.gz</code>.
70: </table>
71:
72: <hr>
73:
74: <section id=new>
75: <h3>What's New</h3>
76: <p>
77: This is a partial list of new features and systems included in OpenBSD 6.9.
78: For a comprehensive list, see the <a href="plus69.html">changelog</a> leading
79: to 6.9.
80:
81: <ul>
82:
83: <li>New/extended platforms:
84: <ul>
1.15 benno 85: <li>Support for the <a href="powerpc64.html">powerpc64</a> platform was improved:
86: <ul>
1.3 benno 87: <li>Added <a href="https://man.openbsd.org/astfb.4">astfb(4)</a>, a
88: driver for the framebuffer of the Aspeed BMC found on many POWER8 and
89: POWER9 systems.
90: <li>Added bsd.mp to powerpc64's installXX.{img,iso}.
91: <li>Added RETGUARD implementation for powerpc and powerpc64.
92: <li>Added a workaround for PCIO devices that cannot address the full
93: 64-bit PCI address space to powerpc64. Needed for <a
94: href="https://man.openbsd.org/radeondrm.4">radeondrm(4)</a> and <a
95: href="https://man.openbsd.org/amdgpu.4">amdgpu(4)</a> since Radeon
96: GPUs only implement 36, 40, or 44 bits of address space.
97: <li>Added limited emulation of unaligned access in the powerpc64 kernel.
1.41 kettenis 98: <li>Added support for netbooting to the powerpc64 RAMDISK kernel.
1.5 benno 99: <li>Fixed booting on powerpc64 machines with memory banks higher in
100: physical address space, needing a larger TCE table.
1.41 kettenis 101: <li>Introduced power-saving mode on POWER9 CPUs.
1.9 benno 102: <li>Enabled floating-point exceptions on powerpc64.
1.10 benno 103: <li>Added support for <a
104: href="https://man.openbsd.org/ipmi.4">ipmi(4)</a> on PowerNV systems.
1.15 benno 105: </ul>
1.41 kettenis 106: <li>Preliminary support was added for devices using the Apple M1 SoC:
1.15 benno 107: <ul>
1.41 kettenis 108: <li>Recognized Apple Icestorm/Firestorm cores on arm64.
109: <li>Added support for BCM4378 chips, as found on the Apple M1 SoCs, to
1.10 benno 110: <a href="https://man.openbsd.org/bwfm.4">bwfm(4)</a>.
111: <li>Added <a href="https://man.openbsd.org/exuart.4">exuart(4)</a>
1.28 fcambus 112: support for the UART found on the Apple M1 SoC.
1.10 benno 113: <li>Added <a href="https://man.openbsd.org/apldog.4">apldog(4)</a>, a
114: driver for the watchdog on Apple M1 SoCs, allowing reboot of the
115: machine.
116: <li>Added <a href="https://man.openbsd.org/aplintc.4">aplintc(4)</a>,
117: a driver for the interrupt controller found on Apple M1 SoCs.
118: <li>Added <a href="https://man.openbsd.org/aplpcie.4">aplpcie(4)</a>,
119: a driver for the PCIe host bridge on Apple M1 SoCs.
120: <li>Added <a href="https://man.openbsd.org/apldart.4">apldart(4)</a>,
121: a driver for the IOMMU on Apple M1 SoCs.
1.41 kettenis 122: <li>Added support for CPUs with 8-bit ASIDs such as those on
1.15 benno 123: Apple's M1 SoC.
124: </ul>
125: <li>The arm64 platform support was improved with the following changes:
126: <ul>
127: <li>Optimized arm64 <a
128: href="https://man.openbsd.org/copyin.9">copyin(9)</a>, <a
129: href="https://man.openbsd.org/copyout.9">copyout(9)</a> and <a
130: href="https://man.openbsd.org/kcopy.9">kcopy(9)</a> by doing 16-byte
131: copies if possible.
132: <li>Added recognition of Cortex-A78AE, Cortex-X1 and Neoverse V1 arm64 CPUs.
1.41 kettenis 133: <li>Added clock support for i.MX8MP SoCs.
1.15 benno 134: <li>Added support for the VF610 I2C controller to <a
135: href="https://man.openbsd.org/imxiic.4">imxiic(4)</a>.
136: <li>Added <a href="https://man.openbsd.org/dwgpio.4">dwgpio(4)</a>, a
137: driver for the Synopsys DesignWare GPIO controller.
138: <li>Added <a
139: href="https://man.openbsd.org/amlpinctrl.4">amlpinctrl(4)</a> support
140: for the "Always On" GPIOs.
141: <li>Made large read and write transactions work in <a
142: href="https://man.openbsd.org/amliic.4">amliic(4)</a>.
1.41 kettenis 143: <li>Added support for the PCIe controller found on Amlogic
144: G12A/G12B/SM1 SoCs to <a
145: href="https://man.openbsd.org/dwpcie.4">dwpcie(4)</a>.
146: <li>Implemented legacy interrupt support to <a
1.15 benno 147: href="https://man.openbsd.org/mvkpcie.4">mvkpcie(4)</a>.
148: <li>Added <a href="https://man.openbsd.org/cryptox.4">cryptox(4)</a>,
149: a driver for armv8 cryptographic extensions.
150: <li>Added support for PCIe on the NanoPi R4S to <a
151: href="https://man.openbsd.org/rkpcie.4">rkpcie(4)</a>.
1.34 patrick 152: <li>Added <a href="https://man.openbsd.org/smmu.4">smmu(4)</a>, a
153: driver for the ARM System MMU.
154: <li>Introduced an IOVA early-allocation scheme in <a
155: href="https://man.openbsd.org/smmu.4">smmu(4)</a>, mitigating the
156: performance penalty of typical IOVA allocation designs.
157: <li>Introduced Guard Pages in <a
158: href="https://man.openbsd.org/smmu.4">smmu(4)</a>, to spot misuse
159: and misconfiguration of I/O devices more easily.
1.41 kettenis 160: <li>Added support for RK809 to <a
1.15 benno 161: href="https://man.openbsd.org/rkpmic.4">rkpmic(4)</a>, as seen on the
162: Rock Pi N10 with the rk3399pro.
163: <li>Added support for <a
164: href="https://man.openbsd.org/sdhc.4">sdhc(4)</a> on the Raspberry Pi
165: in ACPI mode.
166: <li>Enabled <a href="https://man.openbsd.org/ixl.4">ixl(4)</a> on arm64.
167: <li>Updated device-tree bindings for <a
168: href="https://man.openbsd.org/cwfg.4">cwfg(4)</a> battery capacity
169: driver to correct attaching and account for monitoring interval
170: change, making cwfg(4) export values under hw.sensors as expected when
171: using a Pinebook Pro.
172: <li>Added ARMv8-5 instruction set related CPU features to arm64.
173: </ul>
174: </ul>
1.3 benno 175:
1.15 benno 176: <li>Various kernel improvements:
1.1 deraadt 177: <ul>
1.15 benno 178: <li>Added the RAID1C (encrypted raid1) <a
179: href="https://man.openbsd.org/softraid.4">softraid(4)</a> discipline,
180: encrypting data like the CRYPTO discipline and accepting multiple
181: chunks during creation and assembly like the RAID1 discipline.
182: <li>Corrected raidlevel verification specified by the -c option in <a
183: href="https://man.openbsd.org/bioctl.8">bioctl(8)</a>.
184:
185: <li>Introduced kern.video.record for <a
186: href="https://man.openbsd.org/video.4">video(4)</a> devices, a privacy feature analog
187: to the kern.audio.record <a
188: href="https://man.openbsd.org/sysctl.8">sysctl(8)</a> parameter for <a
189: href="https://man.openbsd.org/audio.4">audio(4)</a> devices. By
190: default, kern.video.record will be set to zero and blank all data
191: delivered by drivers attaching to <a
192: href="https://man.openbsd.org/video.4">video(4)</a>.
193: <li>Allowed a process to open a <a
194: href="https://man.openbsd.org/video.4">video(4)</a> device multiple
195: times. Fixes webcam usage with Firefox and BigBlueButton.
196: <li>Enabled multiple opens of a <a
197: href="https://man.openbsd.org/video.4">video(4)</a> device as
198: described in the V4L2 specification.
1.9 benno 199:
1.15 benno 200: <li>Added basic support for kclock timeouts to <a
201: href="https://man.openbsd.org/timeout.9">timeout(9)</a>.
202: <li>Changed the <a href="https://man.openbsd.org/pool.9">pool(9)</a>
203: timeouts to use the system uptime instead of ticks.
1.9 benno 204: <li>Ensured <a href="https://man.openbsd.org/sleep.3">sleep(3)</a>
205: calls <a href="https://man.openbsd.org/nanosleep.2">nanosleep(2)</a>
206: if seconds is zero, now delegating all decisions about whether or not
207: to yield the CPU.
1.5 benno 208: <li>Added a top-level 'reboot' command to <a
209: href="https://man.openbsd.org/ddb.4">ddb(4)</a>.
210: <li>Added <a href="https://man.openbsd.org/witness.4">witness(4)</a>
211: check for uninitialized (or zeroed) lock usage.
212: <li>Added fd close notification for kqueue-based <a
213: href="https://man.openbsd.org/poll.2">poll(2)</a> and <a
214: href="https://man.openbsd.org/select.2">select(2)</a>.
215: <li>Added a global "nowake" channel for threads avoiding <a
216: href="https://man.openbsd.org/wakeup.9">wakeup(9)</a> to <a
217: href="https://man.openbsd.org/tsleep.9">tsleep(9)</a>.
1.15 benno 218:
1.5 benno 219: <li>Added trace points for <a
220: href="https://man.openbsd.org/malloc.9">malloc(9)</a> and <a
221: href="https://man.openbsd.org/free.9">free(9)</a>, making them
222: traceabe via <a href="https://man.openbsd.org/dt.4">dt(4)</a> and <a
223: href="https://man.openbsd.org/btrace.8">btrace(8)</a>.
1.15 benno 224: <li>Added <a href="https://man.openbsd.org/btrace.8">btrace(8)</a> -n
225: (no action) mode, which parses the program and then exits.
1.9 benno 226: <li>Fixed a boot-time crash on sparc64 due to mutex use during the
227: message buffer initialization.
1.15 benno 228: <li>Prevented a panic in some ACPI firmware that provided invalid
1.9 benno 229: memory regions in their reserved memory region reporting table.
230:
1.10 benno 231:
232: <li>Added a barrier between reading the cqe flags and the command ID
233: to prevent completion of the wrong scsi io for <a
234: href="https://man.openbsd.org/nvme.4">nvme(4)</a> drives.
1.52 krw 235: <li>Prevented attachment of <a href="https://man.openbsd.org/nvme.4">nvme(4)</a>
236: devices of zero size.
1.9 benno 237: <li>Introduced new function <a
238: href="https://man.openbsd.org/if_unit.9">if_unit(9)</a>, returning a
239: pointer to the interface descriptor corresponding to the unique name.
1.10 benno 240: <li>Clear interrupts on luna88k processors more efficiently at boot
241: time.
242: <li>Added <a
243: href="https://man.openbsd.org/acpiiort.4">acpiiort(4)</a>, a driver
244: for the ACPI I/O Remapping Table.
1.15 benno 245: <li>Updated clock interrupt count atomically on mips64.
246: <li>Prevented an amd64 kernel crash with protection fault due to an
247: invalid offset when reading /dev/kmem.
248: <li>Permitted access to kern.somaxconn sysctl information when the
249: unix <a href="https://man.openbsd.org/pledge.2">pledge(2)</a> is used,
250: allowing Go programs to use "unix" without also including "inet".
251: <li>Excluded the first page and added a guard page between I/O
252: virtual address space allocations on arm64.
1.52 krw 253:
254: <li>Prevented attachment of SCSI devices that fail to provide
255: adequate INQUIRY data.
1.20 benno 256: </ul>
1.22 benno 257:
1.20 benno 258: <li>SMP Improvements
259: <ul>
1.23 benno 260: <li>Introduced "if_cloners_lock" rwlock and used it to serialize
261: if_clone_{create,destroy}(), avoiding multiple race conditions.
1.20 benno 262: <li>Introduced a system-wide mutex that serializes msgbuf operations.
1.23 benno 263: <li>Made <a
264: href="https://man.openbsd.org/uvm_pagealloc.9">uvm_pagealloc(9)</a> of
265: the physical memory allocator mp-safe.
1.20 benno 266: <li>Unlocked <a href="https://man.openbsd.org/getppid.2">getppid(2)</a>.
267: <li>Introduced locking for amaps and anons, improving build performance.
1.23 benno 268: <li>Moved UNIX domain sockets out of the kernel lock, using the new
269: "unp_lock" <a href="https://man.openbsd.org/rwlock.9">rwlock(9)</a> as
270: solock()'s backend to protect the whole layer.
1.20 benno 271: <li>Unlocked <a href="https://man.openbsd.org/sendsyslog.2">sendsyslog(2)</a>.
272: <li>Used per-CPU counter for fault and stats counters reached in uvm_fault().
273: </ul>
1.22 benno 274:
1.20 benno 275: <li>Direct Rendering Manager
276: <ul>
1.23 benno 277: <li>Fixed <a
1.55 jsg 278: href="https://man.openbsd.org/wsconsctl.8">wsconsctl(8)</a>
279: backlight commands when using
280: <a href="https://man.openbsd.org/drm.4">drm(4)</a> drivers on
281: macppc.
282: <li>Fixed a <a
283: href="https://man.openbsd.org/radeondrm.4">radeondrm(4)</a>
284: panic on macppc with Powerbook5,6 and RV350.
1.23 benno 285: <li>Fixed DRI3 support on <a
286: href="https://man.openbsd.org/amdgpu.4">amdgpu(4)</a> and <a
287: href="https://man.openbsd.org/ati.4">ati(4)</a>.
1.55 jsg 288: <li>/dev/dri/ device nodes are created to be more compatible with Linux.
1.20 benno 289: </ul>
1.22 benno 290:
1.20 benno 291: <li>VMM/VMD improvements
292: <ul>
1.10 benno 293: <li>Prevented memory corruption or improper page access in <a
294: href="https://man.openbsd.org/vmm.4">vmm(4)</a> due to improper TLB
295: flushing for now by wiring the pages used by virtual machines.
1.15 benno 296: <li>Removed the ability of <a
297: href="https://man.openbsd.org/vmd.8">vmd(8)</a> to boot from kernels
298: in raw/qcow2 images.
299: <li>Made <a href="https://man.openbsd.org/vmctl.8">vmctl(8)</a>
1.27 dv 300: properly indicate VMs are stopping instead of "running" with "vmctl
1.15 benno 301: status".
1.56 jsg 302: <li>Simplify argument parsing of
303: <code><a href="https://man.openbsd.org/vmctl.8">vmctl(8)</a> stop</code>
304: thereby avoiding a
305: <a href="https://man.openbsd.org/printf.3">printf(3)</a> "%s" NULL,
306: a use of uninitialized and a dead else branch.
1.15 benno 307: <li>Cleaned up events on <a
308: href="https://man.openbsd.org/vmd.8">vmd(8)</a> pause or resume and
309: fixed an issue leading to broken serial console by cleanly tearing
310: down and restoring emulated device state on vm send/receive.
311: <li>Propagated host-side <a
312: href="https://man.openbsd.org/tap.4">tap(4)</a> lladdr to guest vm
313: process to allow unicast dhcp and bootp renewals with <a
314: href="https://man.openbsd.org/vmd.8">vmd(8)</a>'s built-in dhcp
315: server.
1.27 dv 316: <li>Added <a href="https://man.openbsd.org/veb.4">veb(4)</a> to the
317: list of supported bridges for <a
318: href="https://man.openbsd.org/vmd.8">vmd(8)</a>.
319: <li>Improved MSR exit handling in <a
320: href="https://man.openbsd.org/vmm.4">vmm(4)</a> on SVM and VMX
321: hosts preventing invalid reads and fixing support for 9front.
322: <li>Added ability to boot compressed ramdisks to <a
323: href="https://man.openbsd.org/vmd.8">vmd(8)</a>.
1.1 deraadt 324: </ul>
325:
326: <li>Various new userland features:
327: <ul>
1.3 benno 328: <li>Added <a
329: href="https://man.openbsd.org/doas.conf.5">doas.conf(5)</a> "nolog"
330: option to avoid <a
331: href="https://man.openbsd.org/syslog.3">syslog(3)</a>.
332: <li>Allowed specific <a
333: href="https://man.openbsd.org/sndio.7">sndio(7)</a> devices to be used
334: for play-only and rec-only modes.
1.9 benno 335: <li>Use an 8th order FIR low-pass filter for resampling in <a
336: href="https://man.openbsd.org/sndiod.8">sndiod(8)</a> and for <a
337: href="https://man.openbsd.org/aucat.1">aucat(1)</a>, removing most of
338: the aliasing noise during resampling.
1.10 benno 339: <li>Disabled <a href="https://man.openbsd.org/sndiod.8">sndiod(8)</a>
340: autovolume by default and set the default volume to 127. Setting "-w
341: on" will replicate the previous behavior of automatically decreasing
342: playback volume when new programs start playing.
343: <li>Allowed mixing of alternative devices (-F) with different
344: capabilities in <a
345: href="https://man.openbsd.org/sndiod.8">sndiod(8)</a> by treating any
346: device as full-duplex.
1.15 benno 347: <li>Fixed visibility of <a
348: href="https://man.openbsd.org/sndioctl.1">sndioctl(1)</a> output when
349: used through a pipe.
350:
1.10 benno 351: <li>Enabled build and install of <a href="https://man.openbsd.org/lldb.1">lldb(1)</a>.
352: <li>Added <a href="https://man.openbsd.org/logger.1">logger(1)</a>
353: support to <a href="https://man.openbsd.org/rcctl.8">rcctl(8)</a>, <a
354: href="https://man.openbsd.org/rc.subr.8">rc.subr(8)</a> and <a
355: href="https://man.openbsd.org/rc.d.8">rc.d(8)</a> for daemons logging
356: to stdout/stderr.
357:
1.15 benno 358: <li>Added a configurable button mapping for tap gestures on touchpads
359: to <a href="https://man.openbsd.org/wsconsctl.8">wsconsctl(8)</a>.
360: <li>Made <a href="https://man.openbsd.org/wscons.4">wscons(4)</a>
361: touchpad tap detection less restrictive for multi-finger taps and
362: improved tap detection.
363: <li>Enable <a
364: href="https://man.openbsd.org/man4/arm64/apm.4">apm(4)</a> on arm64 to
365: display meaningful information about battery use and capacity.
1.1 deraadt 366: </ul>
367:
368: <li>Various bugfixes and tweaks in userland:
369: <ul>
1.3 benno 370: <li>Fixed a pledge violation in <a
371: href="https://man.openbsd.org/csh.1">csh(1)</a> where redirecting
372: input from a file containing ^T would cause csh(1) to perform a tty
373: ioctl operation against a non-tty.
1.14 tb 374: <li>Made <a href="https://man.openbsd.org/syspatch.8">syspatch(8)</a> work
375: again when fewer than 3 patches are available.
1.3 benno 376: <li>Stopped exempting file systems from <a
377: href="https://man.openbsd.org/security.8">security(8)</a> on the basis
378: of nodev and nosuid options, which may not be used for file systems
379: mounted beneath.
380: <li>Modified <a href="https://man.openbsd.org/daily.8">daily(8)</a>
381: to stop reporting disk status and networking statistics.
382: <li>Made <a
383: href="https://man.openbsd.org/sysupgrade.8">sysupgrade(8)</a> specify
384: a version when it uses <a
385: href="https://man.openbsd.org/fw_update.1">fw_update(1)</a> to avoid
386: the situation where upgrading a pre-6.8 snapshot to 6.8 release with
387: "-r" would install firmware packages from snapshots.
388: <li>Increased speed of the dependency check pass for <a
389: href="https://man.openbsd.org/pkg_add.1">pkg_add(1)</a>.
390:
391: <li>Prevented process exit in multithreaded programs from reporting
392: the wrong error code.
393:
1.52 krw 394: <li>Allowed booting of amd64/i386 from GPT formatted disks larger than 4TB.
1.5 benno 395:
396: <li>When using the <a href="https://man.openbsd.org/cat.1">cat(1)</a>
397: -n flag, correctly enumerate files with more than INT_MAX lines.
398: <li>Fixed a memory leak in ld.so's malloc.
1.15 benno 399:
1.9 benno 400: <li>Added a "xenodm" login class for <a
401: href="https://man.openbsd.org/xenodm.1">xenodm(1)</a> and increased
402: openfiles to 512 to avoid running out of file descriptors with a busy
403: desktop.
1.15 benno 404: <li>Stopped <a href="https://man.openbsd.org/xenodm.1">xenodm(1)</a>
405: from adding authorizations for TCP connections by default and added
406: "listenTCP" to explicitly add authorizations for existing IP addresses
407: on startup.
408: <li>Skip <a href="https://man.openbsd.org/xenodm.1">xenodm(1)</a>
409: from adding the IPv6 link local addresses for TCP listener
410: authorizations, matching what is done by <a
411: href="https://man.openbsd.org/startx.1">startx(1)</a>.
412:
1.9 benno 413: <li>Fixed -s option for <a href="https://man.openbsd.org/cmp.1">cmp(1)</a>.
414: <li>Improve pledge in <a
415: href="https://man.openbsd.org/doas.1">doas(1)</a>, specifically added
416: pledge to the "-C" code path.
1.6 otto 417: <li>Inproved performance of <a
418: href="https://man.openbsd.org/malloc.3">malloc(3)</a>'s cache.
1.10 benno 419: <li>Made editing GPT in <a
420: href="https://man.openbsd.org/fdisk.8">fdisk(8)</a> safer by
421: defaulting offset to the beginning of the largest free space and
422: preventing the creation of overlapping partitions.
423: <li>Fixed a crash that could occur in <a
1.58 jsg 424: href="https://man.openbsd.org/sndiod.8">sndiod(8)</a> when a USB
1.10 benno 425: device is unplugged.
426: <li>Append .html suffixes to temporary files in <a
427: href="https://man.openbsd.org/mandoc.1">mandoc(1)</a> to allow
428: recognition by browsers.
429: <li>Allow specification of a path to the <a
430: href="https://man.openbsd.org/mg.1">mg(1)</a> startup file on the
431: command line.
1.15 benno 432: <li>Added a "batch" mode to <a
433: href="https://man.openbsd.org/mg.1">mg(1)</a> via the "-b" command
434: line option which will initialize a pty, run the specified file of mg
435: commands and then exit.
436: <li>Inverted the <a href="https://man.openbsd.org/mg.1">mg(1)</a> "R"
437: indicator to mean that a "*" next to a file's name indicates that it
438: is read-only. Made the active buffer indicator more visible by
439: changing it to ">".
440:
441: <li>Fixed <a href="https://man.openbsd.org/ksh.1">ksh(1)</a>
442: redrawing of a multiline PS1 prompt in vi mode and added support for
443: ^R (redraw) in insert mode.
444: <li>Used <a href="https://man.openbsd.org/unveil.2">unveil(2)</a> to
445: restrict filesystem access in <a
446: href="https://man.openbsd.org/apmd.8">apmd(8)</a>.
447: <li>Removed the 30s minimum delay for <a
448: href="https://man.openbsd.org/xlock.1">xlock(1)</a> timeouts.
449: <li>Stopped deleting the control socket on exit in <a
1.59 jsg 450: href="https://man.openbsd.org/apmd.8">apmd(8)</a>, as deleting
451: the socket after calling <a
452: href="https://man.openbsd.org/unveil.2">unveil(2)</a> would cause an
453: unveil violation.
1.1 deraadt 454: </ul>
455:
456: <li>Improved hardware support and driver bugfixes, including:
457: <ul>
1.15 benno 458: <li>Corrected accounting of zero length Transfer Descriptors in <a
459: href="https://man.openbsd.org/xhci.4">xhci(4)</a>, preventing running
460: out of free Transfer Ring Blocks.
1.3 benno 461: <li>Moved mfokclock(4) from loongson to make it available for other
462: platforms and renamed it to <a
463: href="https://man.openbsd.org/mfokrtc.4">mfokrtc(4)</a>.
464: <li>Fixed brightness setting on MacBooks.
465: <li>Added AMD Vi and Intel VTD IOMMU support. This creates separate
466: domains for each PCI device and can provide protection against invalid
467: memory access.
468: <li>Enabled brightness keys on powerbooks where the keyboard attaches
469: as <a href="https://man.openbsd.org/ukbd.4">ukbd(4)</a>.
470: <li>Set initial default display brightness on macppc via
471: of_setbrightness() to ensure <a
472: href="https://man.openbsd.org/wscons.4">wscons(4)</a> and ofw are in
473: sync.
474: <li>Added support for the PL2303HXN series chips to <a
475: href="https://man.openbsd.org/uplcom.4">uplcom(4)</a>.
476: <li>Added support for the PCA9547 I2C mux to <a
477: href="https://man.openbsd.org/pcamux.4">pcamux(4)</a>.
478: <li>Extended <a href="https://man.openbsd.org/pcamux.4">pcamux(4)</a>
479: with ACPI support.
480: <li>Added <a href="https://man.openbsd.org/acpige.4">acpige(4)</a>, a
1.41 kettenis 481: driver for ACPI generic event devices, used on various
1.54 jsg 482: systems to implement power button handling.
1.3 benno 483: <li>Added <a href="https://man.openbsd.org/pchgpio.4">pchgpio(4)</a>,
484: a driver for the GPIO controllers found on modern Intel PCHs.
485: <li>Added ACPI support to <a
486: href="https://man.openbsd.org/imxiic.4">imxiic(4)</a>.
487: <li>Fixed panics on the HoneyComb LX2K with <a
488: href="https://man.openbsd.org/amdgpu.4">amdgpu(4)</a>.
489: <li>Fixed very old <a
490: href="https://man.openbsd.org/umass.4">umass(4)</a> devices where the
491: INQUIRY command succeeds but with a residue equal to the requested
492: bytes.
1.5 benno 493: <li>Added Gemini Lake I2C id to <a
494: href="https://man.openbsd.org/dwiic.4">dwiic(4)</a>, making the
495: touchpad work on the Teclast F7 Plus laptop.
1.10 benno 496: <li>Introduced <a href="https://man.openbsd.org/ujoy.4">ujoy(4)</a>, a
497: restricted subset of <a
498: href="https://man.openbsd.org/uhid.4">uhid(4)</a> for game controllers
499: which uses /dev/ujoy/* device nodes.
500: <li>Set up <a href="https://man.openbsd.org/ims.4">ims(4)</a> devices
501: in X11 to behave like touchpads.
502: <li>Stopped relying on USB devices to correctly present their
503: indices, instead searching for the correct interfaces. This fixes E+
504: Corp. DAC Audio devices.
505: <li>Introduced <a
506: href="https://man.openbsd.org/uhidpp.4">uhidpp(4)</a>, a driver for
507: Logitech HID++ devices.
1.15 benno 508: <li>Separated reading of general and touchpad-specific <a
509: href="https://man.openbsd.org/wsmouse.4">wsmouse(4)</a> settings and
510: corrected identification of device type when reading touchpad
511: parameters fails.
512:
513: <li>Added support for 30-bit color modes to <a
1.41 kettenis 514: href="https://man.openbsd.org/simplefb.4">simplefb(4)</a>
515: and <a href="https://man.openbsd.org/wsfb.4">wsfb(4)</a>.
1.10 benno 516:
1.15 benno 517: <li>Made loongson kernels recognize Lynloong LM9002/9003 and LM9013 models.
518: <li>Use native display resolution 1368x768 for Lynloong all-in-one computers.
1.1 deraadt 519: </ul>
520:
521: <li>New or improved network hardware support:
522: <ul>
1.3 benno 523: <li>Fixed link state change behavior in 82598 <a
524: href="https://man.openbsd.org/ix.4">ix(4)</a> chips.
525: <li>Fixed issues with network stopping after the first down/up cycle
526: in <a href="https://man.openbsd.org/mvpp.4">mvpp(4)</a> Marvel Armada
527: Ethernet device.
528: <li>Added SFP+ support to ofw, including support for direct attach cables.
529: <li>Added 10G media support to <a
530: href="https://man.openbsd.org/mvpp.4">mvpp(4)</a>.
531: <li>Added support for 1000base-x and 2500base-x connections to <a
532: href="https://man.openbsd.org/mvneta.4">mvneta(4)</a>.
533: <li>Added <a href="https://man.openbsd.org/mvsw.4">mvsw(4)</a>, a
534: driver for Marvel "SOHO" switches.
1.5 benno 535: <li>Enabled auto-negotiation on the SerDes links, allowing
536: in-band-status to work between <a
537: href="https://man.openbsd.org/mvpp.4">mvpp(4)</a> and <a
538: href="https://man.openbsd.org/mvsw.4">mvsw(4)</a> on the ClearFog GT
539: 8K.
540: <li>Added support for the i.MX8MP PCIe clocks, USB clocks and second
541: ethernet.
542: <li>Added Wake on LAN support to <a
543: href="https://man.openbsd.org/rge.4">rge(4)</a>.
544: <li>Enabled IPv4 and TCP/UDP checksum offload on transmission in <a
545: href="https://man.openbsd.org/ogx.4">ogx(4)</a>.
1.10 benno 546: <li>Raised the maximum number of queues/interrupts from 1 to 16 on <a
547: href="https://man.openbsd.org/mcx.4">mcx(4)</a> devices.
548: <li>Added support for the Netgear ProSecure UTM25 to octeon.
1.15 benno 549: <li>Added vid/pid table to <a
550: href="https://man.openbsd.org/umb.4">umb(4)</a> allowing matching to
551: alternate configurations.
1.1 deraadt 552: </ul>
553:
554: <li>Added or improved wireless network drivers:
555: <ul>
1.36 stsp 556: <li>Fixed the <a href="https://man.openbsd.org/athn.4">athn(4)</a> and
557: <a href="https://man.openbsd.org/urtwn.4">urtwn(4)</a> drivers
558: in client mode against access points which use WPA1/TKIP as
559: the group cipher.
1.3 benno 560: <li>Added multicast support to <a
561: href="https://man.openbsd.org/bwfm.4">bwfm(4)</a> to allow IPv6.
562: <li>Fixed <a href="https://man.openbsd.org/urtwn.4">urtwn(4)</a>
563: repeated DEAUTH and loss/restoration of link.
1.5 benno 564: <li>Introduced a delay to work around an issue in <a
565: href="https://man.openbsd.org/bwfm.4">bwfm(4)</a> on the BCM43602 that
566: was triggering "unexpected pairwise key update" errors.
1.9 benno 567: <li>Enabled <a href="https://man.openbsd.org/athn.4">athn(4)</a> for arm64.
1.36 stsp 568: <li>Implemented a new 802.11n Tx rate adaptation algorithm ("RA") for
1.42 stsp 569: <a href="https://man.openbsd.org/iwm.4">iwm(4)</a>,
570: <a href="https://man.openbsd.org/iwn.4">iwn(4)</a>, and
571: <a href="https://man.openbsd.org/athn.4">athn(4)</a>.
1.36 stsp 572: <li>Fixed association problems with the <a
1.42 stsp 573: href="https://man.openbsd.org/ipw.4">ipw(4)</a> and <a
574: href="https://man.openbsd.org/iwi.4">iwi(4)</a> drivers.
1.15 benno 575: <li>Made <a href="https://man.openbsd.org/iwx.4">iwx(4)</a> attach to
1.48 stsp 576: AX201 devices with PCI IDs 0x34f0 and 0x06f0. Needs <a
1.15 benno 577: href="https://man.openbsd.org/fw_update.1">fw_update(1)</a>.
578: <li>Fixed a problem where <a
579: href="https://man.openbsd.org/iwn.4">iwn(4)</a> firmware would
580: generate bogus block ack requests and stall traffic.
1.42 stsp 581: <li>Fixed automatic channel selection in the <a
582: href="https://man.openbsd.org/athn.4">athn(4)</a> driver
583: when running in hostap or monitor mode.
1.1 deraadt 584: </ul>
585:
586: <li>IEEE 802.11 wireless stack improvements and bugfixes:
587: <ul>
1.36 stsp 588: <li>Fixed length calculations in <a
1.5 benno 589: href="https://man.openbsd.org/iwm.4">iwm(4)</a> and <a
590: href="https://man.openbsd.org/iwx.4">iwx(4)</a> when there are
591: multiple MPDUs in one packet.
1.36 stsp 592: <li>Fixed 802.11n interoperability with access points that offer
593: management frame protection.
594: <li>Flush the A-MPDU reorder buffer after gap timeout to prevent
595: frames from remaining in the buffer until the next frame
596: is received.
597: <li>Avoid spurious "input packet decapsulations failed" errors in
1.5 benno 598: <a href="https://man.openbsd.org/netstat.1">netstat(1)</a> -W with
599: A-MSDU enabled.
1.42 stsp 600: <li>Fixed automatic selection of the 11a/b/g/n/ac operating mode when
1.53 stsp 601: the interface is running as an access point.
1.52 krw 602: <li>Ensured crypto keys are installed before the link is brought up.
1.1 deraadt 603: </ul>
604:
605: <li>Generic network stack improvements and bugfixes:
606: <ul>
1.10 benno 607: <li>Removed the maxburst feature from tcp_output().
1.51 bluhm 608: Sending out TCP segments was limited to 4 packets per burst.
1.54 jsg 609: This did not scale well on high bandwidth, high latency links.
1.51 bluhm 610: Especially when the receiving side delays ACK packets
611: aggressively, the maxburst limitation could seriously reduce
612: TCP throughput per connection.
1.10 benno 613: <li>Added a MONITOR feature to interfaces. Packets received on these
614: interfaces do not enter the network stack for further processing. This
615: can be used to watch traffic, for example with <a
616: href="https://man.openbsd.org/bpf.4">bpf(4)</a> without risk of the packets
617: interfering with the system.
618:
619: <li>Added etherbridge, the internals of a reusable learning bridge
620: interface providing common code reusable for other drivers needing a
621: mac learning bridge.
622: <li>Introduced <a href="https://man.openbsd.org/veb.4">veb(4)</a>, a
623: Virtual Ethernet Bridge driver.
1.3 benno 624:
1.15 benno 625: <li>Added the ability to force the selection of source IP address for
626: programs that do not specify a source IP, overriding the default
627: source IP selection algorithm. This is configurable via <a
628: href="https://man.openbsd.org/route.8">route(8)</a>
1.31 tb 629: <code>sourceaddr</code> command.
1.15 benno 630:
1.37 job 631: <li>Bring interfaces up when autoconfiguration for inet or inet6 is
1.15 benno 632: enabled (AUTOCONF4 or AUTOCONF6 flags).
633: <li>Adjust terminology in <a
634: href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a> to refer to
635: "temporary address extensions" rather than the former "privacy
636: extensions," including the addition of an AUTOCONF6TEMP flag (to
637: replace the negative flag "INET6_NOPRIVACY"). The autoconfprivacy
638: option if <a href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a>
639: has been deprecated.
640: <li>Made it possible to disable the "autoconf" flag but keep
641: "temporary" enabled in <a
642: href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a>.
643: <li>For IPv6 addresses, added tracking of address proposal creation
644: times to be able to establish total lifetime. This information is used
645: to renew pltime/vltime of privacy addresse per RFC 4941.
1.3 benno 646:
1.15 benno 647: <li>Prevented kernel reuse of mbuf memory when generating the ICMP6
648: response to an IPv6 packet.
649: <li>Use the toeplitz hash algorithm to a flowid for tcp packets,
650: which in turn is used to choose the tx ring on network cards with
651: multiple rings.
652: <li>Fixed <a href="https://man.openbsd.org/wg.4">wg(4)</a> on macppc
653: by keeping track of allowed ips pointer correctly.
654: <li>Fixed <a href="https://man.openbsd.org/wg.4">wg(4)</a> ioctl to
655: handle multiple wgpeers.
656: <li>Fixed a race between tx/rx handshakes in <a
657: href="https://man.openbsd.org/wg.4">wg(4)</a>.
658: <li>Prevented a potential hang when trying to remove a <a
659: href="https://man.openbsd.org/tun.4">tun(4)</a> interface.
660: <li>Used the correct rdomain when adding and deleting routes with <a
661: href="https://man.openbsd.org/mpip.4">mpip(4)</a> and <a
662: href="https://man.openbsd.org/mpw.4">mpw(4)</a>.
663: <li>Made <a href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a>
664: "-mplslabel" work with <a
665: href="https://man.openbsd.org/mpw.4">mpw(4)</a>.
1.1 deraadt 666: </ul>
667:
1.15 benno 668: <li>Installer and upgrade improvements:
1.1 deraadt 669: <ul>
1.5 benno 670: <li>Prevented a race in <a
671: href="https://man.openbsd.org/dhclient.8">dhclient(8)</a> privsep
672: which could cause autoinstall to fail by calling <a
673: href="https://man.openbsd.org/ftp.1">ftp(1)</a> without a local
674: address.
675: <li>Fixed hangs on amd64 bsd.rd due to misreported core clock
676: frequency on newer Intel Comet Lake models.
1.15 benno 677: <li>Began distributing the gzip'd version of bsd.rd on all platforms
678: with boot methods supporting it.
679: <li>Fixed a problem which prevented use of <a
680: href="https://man.openbsd.org/sysupgrade.8">sysupgrade(8)</a> when an
681: interface failed to come up and <a
682: href="https://man.openbsd.org/dhclient.8">dhclient(8)</a> didn't
683: notice link-timeout expiration.
684: <li>Prevented <a
685: href="https://man.openbsd.org/disklabel.8">disklabel(8)</a> from
686: adjusting the swap 'b' partition size if physmem is zero to keep the
687: auto-allocate code from putting a filesystem on that partition.
688: <li>Emulate "[inet] autoconf" <a
689: href="https://man.openbsd.org/hostname.if.5">hostname.if(5)</a> lines
690: with "dhcp" so users testing <a
691: href="https://man.openbsd.org/dhcpleased.8">dhcpleased(8)</a> will
692: still be able to upgrade manually while the installer uses only <a
693: href="https://man.openbsd.org/dhclient.8">dhclient(8)</a>.
1.52 krw 694: <li>Restored <a
695: href="https://man.openbsd.org/dhclient.conf.5">dhclient.conf(5)</a>
696: to the group of network configuration files used during upgrades.
1.5 benno 697:
1.1 deraadt 698: </ul>
699:
700: <li>Security improvements:
701: <ul>
1.25 benno 702: <li>Added notices to syslog whenever the "%n" format string component
703: of <a href="https://man.openbsd.org/printf.3">printf(3)</a> is used.
704: <li>Removed workaround permitting Go executables to do syscalls
705: directly, forcing them to use shared libc like all other dynamic
706: binaries.
1.1 deraadt 707: </ul>
708:
709: <li>Routing daemons and other userland network improvements:
710: <ul>
1.15 benno 711: <li>The <a href="https://man.openbsd.org/bgpd.8">bgpd(8)</a> daemon saw the following changes:
712: <ul>
1.66 claudio 713: <li>Introduced <a href="https://man.openbsd.org/bgpd.8">bgpd(8)</a>
714: <code>rde evaluate all</code> to reduce path hiding in IXP
715: route-server environments.
716: <li>Added RTR support to <a href="https://man.openbsd.org/bgpd.8">OpenBGPD</a>.
717: <li>Added <a href="https://man.openbsd.org/bgpctl.8">bgpctl(8)</a>
718: "show rtr" to display basic information about RTR sessions.
719: <li>Added <a href="https://man.openbsd.org/bgpctl.8">bgpctl(8)</a>
720: "show sets" to display information about the roa-set, as-sets and
721: prefix-sets loaded into <a
722: href="https://man.openbsd.org/bgpd.8">bgpd(8)</a>.
723: <li>Properly implemented "rde med compare strict" in <a
724: href="https://man.openbsd.org/bgpd.8">bgpd(8)</a> and ensured that the
725: order of prefixes is always correct.
1.5 benno 726: <li>Introduced a send hold timer in <a
727: href="https://man.openbsd.org/bgpd.8">bgpd(8)</a> to detect stalls on
728: the sending side of a TCP connection, acting as a last resort to
729: detect faulty peers.
1.10 benno 730: <li>Introduced the <a
731: href="https://man.openbsd.org/bgpd.conf.5">bgpd.conf(5)</a> per
732: neighbor and global config option "reject as-set yes/no" to allow
733: rejection of received UPDATES with AS_SET segments. These rejected
734: prefixes can be viewed with <a
735: href="https://man.openbsd.org/bgpctl.8">bgpctl(8)</a> "show rib in
736: error".
1.66 claudio 737: <li>No longer allow configuration of the same neighbor multiple
738: times in <a href="https://man.openbsd.org/bgpd.8">bgpd(8)</a>.
739: <li><a href="https://man.openbsd.org/pf.4">pf(4)</a> tables track now
740: prefixes correctly even when received by multiple sessions.
741: <li>Fixed a memory leak when parsing <a
742: href="https://man.openbsd.org/bgpd.8">bgpd(8)</a> roa-set lists.
1.15 benno 743: </ul>
1.10 benno 744:
1.15 benno 745: <li>The <a
746: href="https://man.openbsd.org/ospfd.8">ospfd(8)</a> and <a
747: href="https://man.openbsd.org/ospf6d.8">ospf6d(8)</a> routing
748: daemons saw various internal refactoring to keep the code similar to
749: changes in other routing daemons and improve maintainability.<br>
1.67 claudio 750: Additionally, support for point-to-point interfaces in <a
751: href="https://man.openbsd.org/ospf6d.8">ospf6d(8)</a>was fixed and <a
752: href="https://man.openbsd.org/ospfd.8">ospfd(8)</a> now works with
753: point-to-point interfaces which use a common IP address.
1.10 benno 754:
1.57 jsg 755: <li>The <a href="https://man.openbsd.org/pf.4">pf(4)</a> packet filter and its userland utility:
1.15 benno 756: <ul>
757: <li>Relaxed checks in <a
758: href="https://man.openbsd.org/pfctl.8">pfctl(8)</a> and <a
759: href="https://man.openbsd.org/pf.4">pf(4)</a> to accept any valid
760: routing domain, even if it does not yet exist.
761: <li>Made <a href="https://man.openbsd.org/pfctl.8">pfctl(8)</a>
762: detect and reject bogus ranges before loading the ruleset to prevent a
763: panic.
764: <li>Changed route-to in <a
765: href="https://man.openbsd.org/pf.conf.5">pf.conf(5)</a> to send
766: packets to IPs instead of interfaces.
767: <li>Changed pf_route so <a
768: href="https://man.openbsd.org/pf.4">pf(4)</a> only runs when packets
769: enter and leave the stack. Running the same packet through pf multiple
770: times creates confusion for the state table. By default, pf states are
771: floating, meaning that packets are matched to states regardless of
772: which interface they're going over. This diff avoids multiple pf(4)
773: traversals of one packet causing confusion in the state table.
774: <li>Prevented the kernel from being stuck in an endless recursion
775: during TCP path MTU discovery when <a
776: href="https://man.openbsd.org/pf.4">pf(4)</a> changes the routing
777: table when sending packets.
778: <li>When cutting off the head of an overlapping fragment during <a
779: href="https://man.openbsd.org/pf.4">pf(4)</a> reassembly, reinserted
780: the fragment into the lookup table with the correct index.
1.52 krw 781:
782: <li>Improved
783: <href="https://man.openbsd.org/tftpd.8">tftpd(8)</a> logging to report the reasons
784: a transfer failed.
785:
1.15 benno 786: </ul>
1.5 benno 787:
1.15 benno 788: <li>IPSEC support in the kernel and the <a href="https://man.openbsd.org/iked.8">iked(8)</a> userland daemon:
789: <ul>
1.3 benno 790: <li>Added support to request IP addresses as IKEv2 initiator to <a
791: href="https://man.openbsd.org/iked.8">iked(8)</a>. If 'request addr
792: 0.0.0.0' is configured, any address will be accepted.
793: <li>Make <a href="https://man.openbsd.org/iked.8">iked(8)</a> accept
794: ANY dynamic address with 'request addr 0.0.0.0'.
795: <li>Added 'dynamic' keyword to <a
796: href="https://man.openbsd.org/iked.conf.5">iked.conf(5)</a> to allow
797: configuration of flows to dynamically assigned addresses.
798: <li>Added the 'any' keyword to <a
799: href="https://man.openbsd.org/iked.conf.5">iked.conf(5)</a> for
800: requests to allow "request address any".
801: <li>Enabled <a href="https://man.openbsd.org/iked.8">iked(8)</a>
802: support for ASN1_DN ipsec identifiers.
803: <li>Implemented <a href="https://man.openbsd.org/iked.8">iked(8)</a>
804: "from dynamic," installing flows where "dynamic" is replaced by the
805: received dynamic IP address.
806: <li>Made sure not to replace 0.0.0.0 with a dynamic address in <a
807: href="https://man.openbsd.org/iked.8">iked(8)</a> if it is a network
808: address.
809: <li>Added <a href="https://man.openbsd.org/iked.8">iked(8)</a> -s
810: socket option to specify a control socket.
811: <li>Used a counter instead of random IV for AES-GCM in <a
812: href="https://man.openbsd.org/iked.8">iked(8)</a>, eliminating the
813: risk of random collisions.
814: <li>Added <a href="https://man.openbsd.org/iked.8">iked(8)</a>
815: support for multiple address pools.
816: <li>Added the <a href="https://man.openbsd.org/iked.8">iked(8)</a>
817: "set stickyaddress" option, which attempts to assign the same "config
818: address" when an IKESA is negotiated with the DSTID of an existing
819: IKESA.
820: <li>Ensured rekeying of every child SA in <a
821: href="https://man.openbsd.org/iked.8">iked(8)</a>.
1.5 benno 822: <li>Added <a href="https://man.openbsd.org/iked.8">iked(8)</a> support
823: for RSASSA-PSS signature verification (RFC 7427).
824: <li>Corrected the first packet of an <a
825: href="https://man.openbsd.org/ipsec.4">ipsec(4)</a> SA to have
826: sequence number 1.
827: <li>Accepted reject and blackhole routes for IPsec PMTU discovery.
828: <li>Prevented leaking of ipsec_hosts in <a
829: href="https://man.openbsd.org/iked.8">iked(8)</a> when building
830: hosts_list.
831: <li>Prevented initiation of new additional SAs for each policy upon
832: every <a href="https://man.openbsd.org/ikectl.8">ikectl(8)</a> config
833: reload.
834: <li>Fixed "any" and "dynamic" keywords for flows in <a
835: href="https://man.openbsd.org/iked.8">iked(8)</a> and added proper
836: IPv6 support.
1.9 benno 837: <li>Created a path MTU host route for <a
838: href="https://man.openbsd.org/ipsec.4">IPsec(4)</a> over IPv6.
1.10 benno 839: <li>Added support for INVALID_KE_PAYLOAD in <a
840: href="https://man.openbsd.org/iked.8">iked(8)</a> CREATE_CHILD_SA
841: exchange.
842: <li>Added support for RSA-PSS PKCS1 signatures to <a
843: href="https://man.openbsd.org/iked.8">iked(8)</a>.
844: <li>Fixed path MTU discovery for ESP tunnels in IPv6.
845: <li>Upgraded to OpenSSL 1.1 compatible crypto API in <a
846: href="https://man.openbsd.org/iked.8">iked(8)</a>.
847: <li>Added an optional "group none" transform for child SAs in <a
848: href="https://man.openbsd.org/iked.8">iked(8)</a> to ensure the
849: ability to negotiate optional PFS.
850: <li>Added <a href="https://man.openbsd.org/iked.8">iked(8)</a>
851: dynamic address configuration for roadwarrior clients, with a new
852: "iface" config option which can be used to specify an interface for
853: the virtual addresses received from the peer.
1.15 benno 854: <li>Fixed an <a href="https://man.openbsd.org/iked.8">iked(8)</a>
855: interop problem with strongswan if make-before-break is enabled.
856: </ul>
1.3 benno 857:
1.16 tb 858: <li>The <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> webserver saw numerous improvements:
1.15 benno 859: <ul>
860: <li>Prevented a crash due to
861: <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> listening on port
862: 443 with missing TLS certificates.
863: <li>Created a new "location (found|notfound)" option for
864: <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> to allow
865: testing for resource path existence.
866: <li>Fixed detection of duplicate locations in <a
867: href="https://man.openbsd.org/httpd.8">httpd(8)</a>.
868: <li>Fixed leak of access and error log filenames on config reload in
869: <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>.
870: <li>Avoid leaking the log message in
871: <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>'s
872: server_sendlog.
873: <li>Incorrect order of
874: <a href="https://man.openbsd.org/close.2">close(2)</a> and
875: <a href="https://man.openbsd.org/tls_close.3">tls_close(3)</a>
1.16 tb 876: together with a bug in libssl led to leaking memory in
1.15 benno 877: <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>
878: for each TLS connection.
879: <li>Fixed the <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>
880: example configuration not to generate errors when running without TLS
881: keys already in place.
1.30 tb 882: <li>Optimized disk reads of
1.15 benno 883: <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>
884: by using st_blocksize as high water mark instead of
885: the socket buffer size.
1.30 tb 886: <li>Do not compare TLS config params for non-TLS servers.
887: This allows using <code>listen on * port 80</code> and
888: <code>listen on * port 443</code> in the same server block in
889: <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a>.
1.15 benno 890: </ul>
1.3 benno 891:
1.24 benno 892: <li><a
893: href="https://man.openbsd.org/rpki-client.8">rpki-client(8)</a>
894: received the following new features and bugfixes:
1.15 benno 895: <ul>
1.47 benno 896: <li>Added RRDP (The RPKI Repository Delta Protocol, RFC 8182) support
897: as a 'technology preview'. To use it, the "-r" flag needs to be used.
1.43 benno 898: <li>Support the use of more than one URI in the TAL file,
1.15 benno 899: sorting with a preference for https.
1.43 benno 900: <li>Validation of ghostbuster records (RFC 6493).
901: <li>Fixed checks of the manifest validity interval.
902: <li>The rsync connection is now killed when the rsync server stalls.
903: <li>Limited the URL embedded in .cer files to
1.15 benno 904: alphanumeric characters and punctuation.
1.43 benno 905: <li>Added a "-V" option to show version.
1.15 benno 906: <li>Included the default cert.pem file path in tls_load_file error
1.43 benno 907: messages.
1.15 benno 908: </ul>
1.3 benno 909:
1.24 benno 910: <li>The <a href="https://man.openbsd.org/dig.1">dig(1)</a> DNS
911: utility received the following updates:
1.15 benno 912: <ul>
1.5 benno 913: <li>Implemented RFC 8914 Extended DNS Errors for <a
914: href="https://man.openbsd.org/dig.1">dig(1)</a>.
915: <li>Fixed <a href="https://man.openbsd.org/dig.1">dig(1)</a> EDNS
916: Client Subnet option (+subnet=).
917: <li>Fixed IPv6 link-local address handling for nameservers to talk to
918: and address to bind to in <a
919: href="https://man.openbsd.org/dig.1">dig(1)</a>.
1.15 benno 920: <li>Implemented ZONEMD (RFC 8976) in <a
921: href="https://man.openbsd.org/dig.1">dig(1)</a> to convey a message
922: digest of the content of a DNS zone.
923: </ul>
1.5 benno 924:
1.15 benno 925: <li>Changes to <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a>:
926: <ul>
1.5 benno 927: <li>Fixed incorrect behavior when using <a
928: href="https://man.openbsd.org/dhclient.conf.5">dhclient.conf(5)</a> to
929: change the lease renew/rebind/expiry timing.
930: <li>Allowed the provision of <a
931: href="https://man.openbsd.org/dhclient.8">dhclient(8)</a> options on
932: "dhcp" lines in <a
933: href="https://man.openbsd.org/hostname.if.5">hostname.if(5)</a> files.
1.52 krw 934: <li>Converted all timers from
935: <a
936: href="https://man.openbsd.org/time.3">time(3)</a> values
937: to <a
938: href="https://man.openbsd.org/clock_gettime.2">clock_gettime(2)</a>
939: CLOCK_MONOTONIC values.
940: <li>Removed -L command line option.
941: <li>Improved debug output.
942: <li>Improved re-acquisition of a previous address by immediately
943: accepting any OFFER for the address, rather than waiting for
944: 'select-timeout' to expire.
1.54 jsg 945: <li>Exit immediately if the -c option specifies a non-existent file.
1.52 krw 946: <li>Exit immediately if the -i option contains invalid information.
947: </ul>
1.5 benno 948:
1.15 benno 949: <li>Two new daemons, <a
950: href="https://man.openbsd.org/dhcpleased.8">dhcpleased(8)</a> and <a
951: href="https://man.openbsd.org/resolvd.8">resolvd(8)</a> were added.
952: These work alongside with <a
953: href="https://man.openbsd.org/slaacd.8">slaacd(8)</a> and <a
954: href="https://man.openbsd.org/unwind.8">unwind(8)</a> to provide a
1.28 fcambus 955: coherent and simple automatic configuration of network interfaces and
1.15 benno 956: DNS resolution.<br>
957: The two daemons are not enabled by default for now, but can be tested
1.28 fcambus 958: by enabling them with <a href="https://man.openbsd.org/rcctl.8">rcctl(8)</a>.
1.15 benno 959: <ul>
960: <li><a href="https://man.openbsd.org/dhcpleased.8">dhcpleased(8)</a>
961: implements the DHCP protocol to acquire IPv4 address leases from
962: servers.
963: <li><a href="https://man.openbsd.org/resolvd.8">resolvd(8)</a>
964: manages the content of <a
965: href="https://man.openbsd.org/resolv.conf.5">resolv.conf(5)</a> based
1.49 deraadt 966: on nameserver proposals from
967: <a href="https://man.openbsd.org/dhcpleased.8">dhcpleased(8)</a>,
968: <a href="https://man.openbsd.org/slaacd.8">slaacd(8)</a>, and
969: drivers like <a href="https://man.openbsd.org/umb.4">umb(4)</a>.
1.15 benno 970: </ul>
1.44 martijn 971:
972: <li>Changes to snmp related tools:
973: <ul>
974: <li><a href="https://man.openbsd.org/agentx.3">libagentx(3)</a> moved its
975: API prefix from subagentx_ to agentx_.
976: <li><a href="https://man.openbsd.org/agentx.3">agentx_varbind_integer(3)</a>
977: now accepts an int32_t as per SMI/RFC 2578.
978: <li><a href="https://man.openbsd.org/agentx.3">agentx_varbind_unsigned32(3)</a>
979: has been added as an alias for
980: <a href="https://man.openbsd.org/agentx.3">agentx_varbind_gauge32(3)</a>.
981: <li><a href="https://man.openbsd.org/snmpd.conf.5">snmpd.conf(5)</a> no
982: longer accepts the old <code>listen on address [tcp|udp]</code>
983: syntax. Only the new <code>listen on [tcp|udp] address</code>
984: sytanx is now supported.
985: <li><a href="https://man.openbsd.org/snmpd.8">snmpd(8)</a> now fully
986: implements RFC3584 Trapv1 to Trapv2 conversion for
987: "trap handle".
988: <li>sysUpTime and snmpTrapOID now respect
989: <a href="https://man.openbsd.org/snmpd.8">snmpd(8)</a>' -N flag,
990: similar to the other values send by <code>trap handle</code>.
991: <li><a href="https://man.openbsd.org/snmpd.conf.5">snmpd.conf(5)</a> now
992: accepts the <code>read</code>, <code>write</code>, and
993: <code>notify</code> keywords. Allowing for request type
994: filtering per <code>listen on</code> statement and custom
995: <code>trap handle </code> ports.
996: <li><a href="https://man.openbsd.org/snmp.1">snmp(1)</a> now has initial
997: support for SMI enums. For now only TruthValue is implemented
998: on ifPromiscuousMode and ifConnectorPresent.
999: <li><a href="https://man.openbsd.org/snmp.1">snmp(1)</a> now interprets
1000: the "u" data type as unsigned integer.
1001: </ul>
1002:
1.15 benno 1003: <li>Other userland network changes:
1004: <ul>
1005: <li>Fixed <a href="https://man.openbsd.org/ldapd.8">ldapd(8)</a> cert
1006: and key path inference for absolute paths.
1007: <li>Fixed incorrect cast in a
1008: <a href="https://man.openbsd.org/vsnprintf(3)">vsnprintf(3)</a>
1009: error check
1010: in <a href="https://man.openbsd.org/ldapd.8">ldapd(8)</a>.
1011: <li>Applied <a href="https://man.openbsd.org/unveil.2">unveil(2)</a>
1012: to <a href="https://man.openbsd.org/ldapd.8">ldapd(8)</a>.
1.5 benno 1013:
1.3 benno 1014: <li>Changed <a href="https://man.openbsd.org/ping.8">ping(8)</a> to
1015: drain the raw socket of packets received before we were fully setup to
1016: avoid reporting ICMP responses intended for other instances of ping(8)
1017: running in parallel.
1.10 benno 1018: <li>Added <a href="https://man.openbsd.org/ping.8">ping(8)</a> -g
1019: option to provide a visual display of packets received and lost.
1.3 benno 1020:
1021: <li>Changed <a href="https://man.openbsd.org/slaacd.8">slaacd(8)</a>
1022: Duplicate Address Detection (DAD) to only generate a new address if we
1023: are using Semantically Opaque Interface Identifiers.
1024: <li>Handled an autoconf interface changing its rdomain in <a
1025: href="https://man.openbsd.org/slaacd.8">slaacd(8)</a>.
1.15 benno 1026: <li>Completed <a
1027: href="https://man.openbsd.org/slaacd.8">slaacd(8)</a> implementation
1028: of RFC 8981 temporary address extensions.
1029:
1.14 tb 1030: <li>Do not leak the domains listed in
1031: <a href="https://man.openbsd.org/unwind.8">unwind(8)</a>'s
1032: blocklist file on each config reload.
1033: <li>Do not leak duplicate domain nodes when loading the
1034: <a href="https://man.openbsd.org/unwind.8">unwind(8)</a>
1035: config.
1.3 benno 1036: <li>Fixed rare crashes of <a
1037: href="https://man.openbsd.org/unwind.8">unwind(8)</a> when DNS answers
1038: are larger than the maximum imsg size.
1.9 benno 1039: <li>Implemented <a
1040: href="https://man.openbsd.org/unwind.8">unwind(8)</a> listening on
1041: TCP.
1.10 benno 1042: <li>Implemented DNS64 synthesis in <a
1043: href="https://man.openbsd.org/unwind.8">unwind(8)</a>.
1044: <li>Disabled logging to <a
1045: href="https://man.openbsd.org/syslog.3">syslog(3)</a> for libunbound
1046: with <a href="https://man.openbsd.org/unwind.8">unwind(8)</a>. Does
1047: not prevent logging to stderr with "unwind -d".
1048:
1.3 benno 1049: <li>Added a simple --timeout implementation to <a
1050: href="https://man.openbsd.org/openrsync.1">openrsync(1)</a>.
1.15 benno 1051: <li>Added the <a href="https://man.openbsd.org/rsync.1">rsync(1)</a>
1052: option --no-motd to suppress the information output by the client at
1053: the start of a daemon transfer.
1.3 benno 1054: <li>Added support for the use of !command to <a
1055: href="https://man.openbsd.org/mygate.5">mygate(5)</a>, so that
1056: netstart has a late opportunity to perform network configuration.
1.5 benno 1057: <li>Make <a href="https://man.openbsd.org/rad.8">rad(8)</a> to handle
1058: multiple rdomains in a single daemon (instead of running it in
1059: multiple rdomains).
1060: <li>Added a specific headline to <a
1061: href="https://man.openbsd.org/netstat.1">netstat(1)</a> for TCP state
1062: and IP protocol.
1.9 benno 1063: <li>Handle permanent redirects (RFC 7538) in <a
1.5 benno 1064: href="https://man.openbsd.org/ftp.1">ftp(1)</a> fetch.
1.10 benno 1065: <li>Introduced <a href="https://man.openbsd.org/ftp.1">ftp(1)</a>
1066: support for sending the If-Modified-Since header while fetching over
1067: http or https. Switched to using the timestamps from the remote
1068: server's Last-Modified header if available when saving local files and
1069: introduced the ftp "-u" flag to disable this behavior.
1.15 benno 1070: <li>Made <a href="https://man.openbsd.org/ftp.1">ftp(1)</a> set
1071: timestamps only on files.
1.10 benno 1072:
1.9 benno 1073: <li>Added requests for a new certificate without requiring -F when <a
1074: href="https://man.openbsd.org/acme-client.1">acme-client(1)</a>
1075: detects an added or removed SAN in the config file not reflected in
1076: the existing certificate on disk.
1077: <li>Print rewritten addresses in <a
1078: href="https://man.openbsd.org/tcpdump.8">tcpdump(8)</a> logged with <a
1079: href="https://man.openbsd.org/pflog.4">pflog(4)</a> for rdr-to, nat-to
1080: and af-to rules.
1.10 benno 1081: <li>When calling <a
1082: href="https://man.openbsd.org/getaddrinfo.3">getaddrinfo(3)</a> with
1083: AI_ADDRCONFIG, consider the routing domain when checking for available
1084: address families. This ensures that name resolution is only performed
1085: for the address families available in the rdomain.
1086: <li>Implemented the <a href="https://man.openbsd.org/nc.1">nc(1)</a>
1087: -D socket debug option in <a
1088: href="https://man.openbsd.org/tcpbench.1">tcpbench(1)</a>, allowing
1089: analysis of TCP connections.
1.14 tb 1090: <li>Avoid leaking the help text in
1091: <a href="https://man.openbsd.org/tcpbench.1">systat(8)</a>.
1.15 benno 1092: <li>Increased the maximum length for CHAP challenges to 96 octets to
1093: ensure <a href="https://man.openbsd.org/npppd.8">npppd(8)</a> can
1094: handle longer challenges, such as those sent by Juniper.
1095: </ul>
1.1 deraadt 1096: </ul>
1097:
1098: <li><a href="https://man.openbsd.org/tmux">tmux(1)</a> improvements and bug fixes:
1099: <ul>
1.5 benno 1100: <li>Made <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> synchronize-panes a pane option and added set-option -U flag to unset an option on all panes.
1.15 benno 1101: <li>Allowed use of ## and # in <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> styles and added a "w" format modifier for width.
1102: <li>Added a -C flag to <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> run-shell to use a tmux command rather than a shell command.
1103: <li>Added a <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> -N flag to never start the server even if the command would normally do so.
1104: <li>Added the new <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> -S flag to new-window to select the existing window if one with the given name already exists, rather than failing.
1105: <li>Added support for X11 color names and other variations for OSC 10/11 and added OSC 110 and 111 to <a href="https://man.openbsd.org/tmux.1">tmux(1)</a>.
1106: <li>Removed <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> support for popups where the content is provided directly to tmux.
1107: <li>Added a <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> "absolute-centre" alignment to use the center of the total space instead of the available space.
1108: <li>Added <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> split-window -Z to start the pane zoomed.
1109: <li>Added client-detached notification in <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> control mode.
1110: <li>Changed <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> search-again with vi keys to work like <a href="https://man.openbsd.org/vi.1">vi(1)</a>.
1.1 deraadt 1111: </ul>
1112:
1113: <li>OpenSMTPD 6.9.0
1114: <ul>
1.5 benno 1115: <li>Introduced <a href="https://man.openbsd.org/smtp.1">smtp(1)</a>
1116: -a to perform authentication before sending a message.
1117: <li>Fixed a memory leak in <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> resolver.
1118: <li>Prevented a crash due to premature release of resources by the <a
1119: href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> filter state
1120: machine.
1.12 eric 1121: <li>Switch to libtls internally.
1122: <li>Change the way SNI works in <a href="https://man.openbsd.org/smtpd.conf.5#pki~2">smtpd.conf(5)</a>.
1123: TLS listeners may be configured with multiple certificates,
1124: the matching is based on the names included in these certificates.
1125: <li>Allow to specify tls protocols and ciphers per listener and relay action.
1.1 deraadt 1126: </ul>
1127:
1.65 tb 1128: <li>LibreSSL 3.3.2
1.1 deraadt 1129: <ul>
1130: <li>New Features
1131: <ul>
1.38 tb 1132: <li>Support for DTLSv1.2.
1133: <li>Continued rewrite of the record layer for the legacy stack.
1134: <li>Numerous bugs and interoperability issues were fixed in the new verifier.
1.39 tb 1135: A few bugs and incompatibilities remain, so this release uses the old
1136: verifier by default.
1.38 tb 1137: <li>The OpenSSL 1.1 TLSv1.3 API is not yet available.
1138: </ul>
1.15 benno 1139:
1.38 tb 1140: <li>Portable Improvements
1141: <ul>
1142: <li>Added '--enable-libtls-only' build option, which builds and installs a
1143: statically-linked libtls, skipping libcrypto and libssl. This is useful
1144: for systems that ship with OpenSSL but wish to also package libtls.
1.3 benno 1145:
1.38 tb 1146: <li>Update getentropy on Windows to use Cryptography Next Generation
1147: (CNG). wincrypt is deprecated and no longer works with newer Windows
1148: environments, such as in Windows Store apps.
1.1 deraadt 1149: </ul>
1150:
1151: <li>API and Documentation Enhancements
1152: <ul>
1.38 tb 1153: <li>Add a number of RPKI OIDs from RFC 6482, 6484, 6493, 8182, 8360,
1154: draft-ietf-sidrops-rpki-rta, and draft-ietf-opsawg-finding-geofeeds.
1155:
1.39 tb 1156: <li>Add support for
1157: <a href="https://man.openbsd.org/SSL_get_shared_ciphers.3">SSL_get_shared_ciphers(3)</a>
1158: with TLSv1.3.
1.38 tb 1159:
1160: <li>Add DTLSv1.2 methods.
1161:
1.39 tb 1162: <li>Implement SSL_is_dtls(3) and use it internally in place of the
1.38 tb 1163: SSL_IS_DTLS macro.
1164:
1.39 tb 1165: <li>Provide
1166: <a href="https://man.openbsd.org/EVP_PKEY_new_CMAC_KEY.3">EVP_PKEY_new_CMAC_KEY(3)</a>.
1167: <li>Add missing prototype for
1168: <a href="https://man.openbsd.org/d2i_DSAPrivateKey_fp.3">d2i_DSAPrivateKey_fp(3)</a>
1169: to x509.h.
1170:
1171: <li>Add DTLSv1.2 to
1172: <a href="https://man.openbsd.org/openssl.1">openssl(1)</a>
1173: s_server and s_client protocol message logging.
1174:
1175: <li>Provide
1176: <a href="https://man.openbsd.org/SSL_use_certificate_chain_file.3">SSL_use_certificate_chain_file(3)</a>.
1177:
1178: <li>Provide
1179: <a href="https://man.openbsd.org/SSL_set_hostflags.3">SSL_set_hostflags(3)</a>
1180: and
1181: <a href="https://man.openbsd.org/SSL_get0_peername.3">SSL_get0_peername(3)</a>.
1.38 tb 1182:
1183: <li>Provide various DTLSv1.2 specific functions and defines.
1184:
1185: <li>Document meaning of '*' in the genrsa output.
1186:
1.39 tb 1187: <li>Updated documentation for
1188: <a href="https://man.openbsd.org/SSL_get_shared_ciphers.3">SSL_get_shared_ciphers(3)</a>.
1189:
1190: <li>Add documentation for
1191: <a href="https://man.openbsd.org/SSL_get_finished.3">SSL_get_finished(3)</a>.
1.38 tb 1192:
1.39 tb 1193: <li>Document
1194: <a href="https://man.openbsd.org/EVP_PKEY_new_CMAC_key.3">EVP_PKEY_new_CMAC_key(3)</a>.
1.38 tb 1195:
1196:
1.39 tb 1197: <li>Document
1198: <a href="https://man.openbsd.org/SSL_use_certificate_chain_file.3">SSL_use_certificate_chain_file(3)</a>.
1.38 tb 1199:
1.39 tb 1200: <li>Document
1201: <a href="https://man.openbsd.org/SSL_set_hostflags.3">SSL_set_hostflags(3)</a>
1202: and
1203: <a href="https://man.openbsd.org/SSL_get0_peername.3">SSL_get0_peername(3)</a>.
1.38 tb 1204:
1.39 tb 1205: <li>Update
1206: <a href="https://man.openbsd.org/SSL_get_version.3">SSL_get_version(3)</a>
1207: manual for DTLSv.1.2 support.
1.38 tb 1208:
1209: <li>Make supported protocols and options for DHE params more prominent
1.39 tb 1210: in <a href="https://man.openbsd.org/tls_config_set_protocols.3">tls_config_set_protocols(3)</a>.
1.38 tb 1211:
1212: <li>Various documentation improvements around TLS methods.
1.1 deraadt 1213: </ul>
1214:
1215: <li>Compatibility Changes
1216: <ul>
1.39 tb 1217: <li>Make <a href="https://man.openbsd.org/openssl.3">openssl(1)</a> s_server
1218: ignore -4 and -6 for compatibility with OpenSSL.
1.38 tb 1219:
1.39 tb 1220: <li>Set SO_REUSEADDR on the server socket in the
1221: <a href="https://man.openbsd.org/openssl.1">openssl(1)</a> ocsp command.
1.38 tb 1222:
1.39 tb 1223: <li>Send a host header with OCSP queries to make
1224: <a href="https://man.openbsd.org/openssl.1">openssl(1)</a> ocsp
1.38 tb 1225: work with some widely used OCSP responders.
1226:
1.39 tb 1227: <li>Add ability to
1228: <a href="https://man.openbsd.org/ocspcheck.8">ocspcheck(8)</a>
1229: to parse a port in the specified OCSP URL.
1.38 tb 1230:
1231: <li>Implement auto chain for the TLSv1.3 server since some software
1232: relies on this.
1233:
1234: <li>Implement key exporter for TLSv1.3.
1.39 tb 1235: <li>Align <a href="https://man.openbsd.org/SSL_get_shared_ciphers.3">SSL_get_shared_ciphers(3)</a>
1236: with OpenSSL. This takes into account that it never returned server
1237: ciphers, so now it will fail when called from the client side.
1.38 tb 1238:
1239: <li>Sync cert.pem with Mozilla NSS root CAs except "GeoTrust Global CA".
1240:
1.39 tb 1241: <li>Make
1242: <a href="https://man.openbsd.org/SSL_CTX_get_min_proto_version.3">SSL{_CTX,}_get_{min,max}_proto_version(3)</a>
1243: return a version of zero if the minimum or maximum has been set to
1244: zero to match OpenSSL's behavior.
1.38 tb 1245:
1.39 tb 1246: <li>Add DTLSv1.2 support to
1247: <a href="https://man.openbsd.org/openssl.1">openssl(1)</a> s_client/s_server.
1.1 deraadt 1248: </ul>
1249:
1250: <li>Testing and Proactive Security
1251: <ul>
1.38 tb 1252: <li>Malformed ASN.1 in a certificate revocation list or a timestamp
1253: response token can lead to a NULL pointer dereference.
1254:
1.39 tb 1255: <li>Pull in fix for
1256: <a href="https://man.openbsd.org/EVP_CipherUpdate.3">EVP_CipherUpdate(3)</a>
1257: overflow from OpenSSL.
1.38 tb 1258:
1259: <li>Use EXFLAG_INVALID to handle out of memory and parse errors in
1260: x509v3_cache_extensions().
1261:
1.39 tb 1262: <li>Refactor and clean up
1263: <a href="https://man.openbsd.org/ocspcheck.8">ocspcheck(8)</a>
1264: and add regression tests.
1.1 deraadt 1265: </ul>
1266:
1267: <li>Internal Improvements
1268: <ul>
1.38 tb 1269: <li>Further cleanup of the DTLS record handling.
1270:
1271: <li>Continue the replacement of the TLSv1.2 record layer by
1272: reimplementing the read side of the TLSv1.2 record handling.
1273:
1274: <li>Replace DTLSv1_enc_data() with TLSv1_1_enc_data().
1275:
1276: <li>Merge d1_{clnt,srvr}.c into ssl_{clnt,srvr}.c.
1277:
1278: <li>Add const to ssl_ciphers and tls1[23]_sigalgs* to push them into
1279: .data.rel.ro and .rodata, respectively.
1280:
1281: <li>Add a const qualifier to srtp_known_profiles.
1282:
1283: <li>Simplify TLS method by removing the client and server specific
1284: methods internally.
1285:
1286: <li>Avoid casting away const in ssl_ctx_make_profiles().
1287:
1288: <li>Avoid explicitly conditioning an assert on DTLS1_VERSION to make
1289: the assert work for newer DTLS versions.
1290:
1291: <li>Merge SSL_ENC_METHOD into SSL_METHOD_INTERNAL.
1292:
1293: <li>Add a flag to mark DTLS methods as DTLS to have an easy way to
1294: recognize DTLS methods that avoids inspecting the version number.
1295:
1296: <li>Mark a few more internal static tables const.
1297:
1298: <li>Switch finish{,_peer}_md_len from an int to a size_t.
1299:
1300: <li>Use EVP_MD_MAX_MD_SIZE instead of 2 * EVP_MD_MAX_MD_SIZE as size
1301: for cert_verify_md[], finish_md[] and peer_finish_md[]. The factor 2
1302: was a historical artefact.
1303:
1304: <li>Free struct members in tls13_record_layer_free() in their natural
1305: order for reviewability.
1306:
1307: <li>Use consistent names in tls13_{client,server}_finished_{recv,send}().
1308:
1309: <li>Add tls13_secret_{init,cleanup}() and use them throughout the
1310: TLSv1.3 code base.
1311:
1312: <li>Move the read MAC key into the TLSv1.2 record layer.
1313:
1314: <li>Make tls12_record_layer_free() NULL safe.
1315:
1316: <li>Split the record protection from the TLSv1.2 record layer.
1317:
1318: <li>Clean up sequence number handling in the new TLSv1.2 record layer.
1319:
1320: <li>Clean up sequence number handling in DTLS.
1321:
1322: <li>Clean up dtls1_reset_seq_numbers().
1323:
1324: <li>Factor out code for explicit IV length, block size and MAC length
1325: from tls12_record_layer_open_record_protected_cipher().
1326:
1327: <li>Provide record layer overhead for DTLS.
1328:
1329: <li>Provide functions to determine if TLSv1.2 record protection is
1330: engaged.
1331:
1332: <li>Add code to handle change of cipher state in the new TLSv1.2 record
1333: layer.
1334:
1335: <li>Mop up now unused dtls1_build_sequence_numbers() function.
1336:
1337: <li>Allow setting a keypair on a tls context without specifying the
1338: private key, and fake it internally in libtls. This removes the
1339: need for privsep engines like relayd to use bogus keys.
1340:
1341: <li>Skip the private key check for fake private keys.
1342:
1343: <li>Move the private key setup from tls_configure_ssl_keypair() to a
1344: helper function with proper error checking.
1345:
1346: <li>Change the internal tls_configure_ssl_keypair() function to
1347: return -1 instead of 1 on failure.
1348:
1349: <li>Move sequence numbers into the new TLSv1.2 record layer.
1350:
1351: <li>Move AEAD handling into the new TLSv1.2 record layer.
1352:
1353: <li>Factor out legacy stack version checks.
1354:
1355: <li>Correct handshake MAC/PRF for various TLSv1.2 cipher suites which
1356: were originally added with the default handshake MAC and PRF rather
1357: than the SHA256 handshake MAC and PRF.
1358:
1359: <li>Absorb ssl3_get_algorithm2() into ssl_get_handshake_evp_md().
1360:
1361: <li>Use dtls1_record_retrieve_buffered_record() to load buffered
1362: application data.
1363:
1364: <li>Enforce read ahead with DTLS.
1365:
1366: <li>Remove bogus DTLS checks that disabled ECC and OCSP.
1367:
1368: <li>Clean up and simplify dtls1_get_cipher().
1369:
1370: <li>Group HelloVerifyRequest decoding and add missing check for trailing
1371: data.
1372:
1373: <li>Revise HelloVerifyRequest handling for DTLSv1.2.
1374:
1375: <li>Handle DTLS1_2_VERSION in various places.
1376:
1377: <li>Rename the "truncated" label into "decode_err" and the "f_err"
1378: label into "fatal_err".
1379:
1380: <li>Factor out and change some of the legacy client version code.
1381:
1382: <li>Simplify version checks in the TLSv1.3 client. Ensure that the
1383: server announced TLSv1.3 and nothing higher and check that the
1384: legacy_version is set to TLSv1.2 as required by RFC 8446.
1385:
1386: <li>Only use TLS versions internally rather than both TLS and DTLS
1387: versions since the latter are the one's complement of the human
1388: readable version numbers, which means that newer versions decrease
1389: in value.
1390:
1391: <li>Identify DTLS based on the version major value.
1392:
1393: <li>Move handling of cipher/hash based cipher suites into the new record
1394: layer.
1395:
1396: <li>Add tls12_record_protection_unused() and call it from CCS functions.
1397:
1398: <li>Move key/IV length checks closer to usage sites. Also add explicit
1.39 tb 1399: checks against
1400: <a href="https://man.openbsd.org/EVP_CIPHER_iv_length.3">EVP_CIPHER_{iv,key}_length()</a>.
1.38 tb 1401:
1402: <li>Replace two handrolled tls12_record_protection_engaged().
1403:
1404: <li>Improve internal version handling: add handshake fields for our
1405: minimum version, our maximum version and the TLS version negotiated
1406: during the handshake. Convert most of the internal code to use these
1407: version fields.
1408:
1409: <li>Guard against future internal use of TLS1_get_{client,}_version()
1410: macros.
1411:
1412: <li>Remove the internal ssl_downgrade_max_version() function which is no
1413: longer needed.
1414:
1415: <li>Add support for DTLSv1.2 version handling.
1416:
1417: <li>Remove no longer needed read ahead workarounds in the s_client and
1418: s_server.
1419:
1420: <li>Split TLSv1.3 record protection from record layer.
1421:
1422: <li>Move the TLSv1.3 handshake struct inside the shared handshake
1423: struct.
1424:
1425: <li>Fully initialize rrec in tls12_record_layer_open_record_protected()
1426: to avoid confusing some static analyzers.
1427:
1428: <li>Use tls_set_errorx() on OCSP_basic_verify() failure since the latter
1429: does not set errno.
1430:
1431: <li>Convert openssl(1) x509 to new option handling and do the usual
1432: clean up that goes along with it.
1433:
1434: <li>Add SSL_HANDSHAKE_TLS12 for TLSv1.2 specific handshake data.
1435:
1436: <li>Rename new_cipher to cipher to align naming with keyblock or other
1437: parts of the handshake data.
1438:
1439: <li>Move the TLSv1.2 record number increment into the new record layer.
1440:
1441: <li>Move finished and peer finished into the handshake struct.
1442:
1443: <li>Remove pointless assignment in SSL_get0_alpn_selected().
1444:
1445: <li>Add some error checking to openssl(1) x509.
1.1 deraadt 1446: </ul>
1447:
1.38 tb 1448: <li>Bug Fixes
1.1 deraadt 1449: <ul>
1.38 tb 1450: <li>Move point-on-curve check to set_affine_coordinates to avoid
1451: verifying ECDSA signatures with unchecked public keys.
1452:
1.39 tb 1453: <li>Fix
1454: <a href="https://man.openbsd.org/SSL_is_server.3">SSL_is_server(3)</a>
1455: to behave as documented by re-introducing the client-specific
1456: methods.
1.38 tb 1457:
1458: <li>Avoid undefined behavior due to memcpy(NULL, NULL, 0).
1459:
1460: <li>Make SSL_get{,_peer}_finished() work when used with TLSv1.3.
1461:
1462: <li>Correct the return value type from ERR_peek_error() to a long.
1463:
1464: <li>Avoid use of uninitialized in ASN1_time_parse() which could happen
1.61 tb 1465: on parsing UTCTime if the caller did not initialize the passed
1.38 tb 1466: struct tm.
1467:
1468: <li>Destroy the mutex in a tls_config object on tls_config_free().
1469:
1470: <li>Free alert_data and phh_data in tls13_record_layer_free()
1.39 tb 1471: these could leak if
1472: <a href="https://man.openbsd.org/SSL_shutdown.3">SSL_shutdown(3)</a>
1473: or <a href="https://man.openbsd.org/tls_close.3">tls_close(3)</a>
1474: were called after closing the underlying socket().
1.38 tb 1475:
1476: <li>Gracefully handle root certificates being both trusted and
1477: untrusted.
1478:
1479: <li>Handle X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE in the new
1480: verifier.
1481:
1482: <li>Use the legacy verifier when building auto chains for TLS.
1483:
1484: <li>Search the intermediates only after searching the root certs in the
1485: new verifier to avoid problems with the legacy callback.
1486:
1487: <li>Bail out early after finding a single chain in the new verifier, if
1488: we have been called via the legacy verifier API.
1489:
1490: <li>Set (invalid and likely incomplete) chain on the xsc on chain build
1491: failure prior to calling the callback. This is required by various
1492: callers, including auto chain.
1493:
1494: <li>Remove direct assignment of aead_ctx to avoid a leak.
1495:
1496: <li>Fail early in legacy exporter if the master secret is not available
1497: to avoid a segfault if it is called when the handshake is not
1498: completed.
1499:
1500: <li>Only print the certificate file once on verification failure.
1501:
1502: <li>Fix an off-by-one in x509_verify_set_xsc_chain() to make sure that
1503: the new validator checks for EXFLAG_CRITICAL in
1504: x509_vfy_check_chain_extension() for all untrusted certs in the
1505: chain. Take into account that the root is not necessarily trusted.
1506:
1507: <li>Avoid passing last and depth to x509_verify_cert_error() on ENOMEM.
1508:
1509: <li>Fix two bugs in the legacy verifier that resulted from refactoring
1.39 tb 1510: of
1511: <a href="https://man.openbsd.org/X509_verify_cert.3">X509_verify_cert(3)</a>
1512: for the new verifier: a return value was incorrectly treated as
1513: boolean, making it insufficient to decide whether validation should
1514: carry on or not.
1.38 tb 1515:
1516: <li>Fix checks for memory caps of constraints names. There are internal
1517: caps on the number of name constraints and other names, that the new
1518: name constraints code allocates per cert chain. These limits were
1519: checked too late, making them only partially effective.
1520:
1521: <li>Fix a copy-paste error - skid was confused with an akid when
1522: checking for EXFLAG_INVALID. This broke OCSP validation with
1523: certain mirrors.
1524:
1525: <li>Avoid a use-after-scope in tls13_cert_add().
1526:
1527: <li>Avoid mangled output in BIO_debug_callback().
1528:
1529: <li>Fix client initiated renegotiation by replacing use of s->internal-type
1530: with s->server.
1531:
1532: <li>Avoid transcript initialization when sending a TLS HelloRequest,
1533: fixing server initiated renegotiation.
1534:
1535: <li>Avoid leaking param->name in x509_verify_param_zero().
1536:
1537: <li>Avoid a leak in an error path in openssl(1) x509.
1538:
1539: <li>When sending an alert in TLSv1.3, only set its error code when no
1540: other error was set previously. Certain clients rely on specific
1541: SSL_R_ error codes to identify that they are dealing with a self
1542: signed cert.
1543:
1544: <li>When switching from the TLSv1.3 stack to the legacy stack include
1545: a TLS record header. This is necessary if there is more than one
1546: handshake message in the TLS plaintext record.
1547:
1548: <li>Fix resource handling on error in OCSP_request_add0_id().
1549:
1550: <li>Make sure there is enough room for stashing the handshake message
1551: when switching to the legacy TLS stack.
1552:
1553: <li>Fix a memory leak in the openssl(1) s_client.
1554:
1555: <li>Unbreak DTLS retransmissions for flights that include a CCS.
1556:
1557: <li>If x509_verify() fails, ensure that the error is set on both
1558: the x509_verify_ctx() and its store context to make some failures
1559: visible from SSL_get_verify_result().
1560:
1561: <li>Use the X509_STORE_CTX get_issuer() callback from the new X.509
1562: verifier to fix hashed certificate directories.
1563:
1.39 tb 1564: <li>Only check
1565: <a href="https://man.openbsd.org/BIO_should_read.3">BIO_should_read(3)</a>
1566: on read and
1567: <a href="https://man.openbsd.org/BIO_should_write.3">BIO_should_write(3)</a>
1568: on write. Previously,
1569: <a href="https://man.openbsd.org/BIO_should_write.3">BIO_should_write(3)</a>
1570: was also checked after read and
1571: <a href="https://man.openbsd.org/BIO_should_read.3">BIO_should_read(3)</a>
1572: after write which could cause stalls in software that uses the same
1573: BIO for read and write.
1574:
1575: <li>In <a href="https://man.openbsd.org/openssl.1">openssl(1)</a>
1576: verify, also check for error on the store context since the return
1577: value of
1578: <a href="https://man.openbsd.org/X509_verify_cert.3">X509_verify_cert(3)</a>
1579: is unreliable in presence of a callback that returns 1 too often.
1.38 tb 1580:
1581: <li>Handle additional certificate error cases in the new X.509 verifier.
1582: Keep track of the errors encountered if a verify callback tells the
1583: verifier to continue and report them back via the error on the store
1584: context. This mimics the behavior of the old verifier that would
1585: persist the first error encountered while building the chain.
1586:
1587: <li>Report specific failures for "self signed certificates" in a way
1588: compatible with the old verifier since software relies on the
1589: error code.
1590:
1591: <li>Plug a large memory leak in the new verifier caused by calling
1.39 tb 1592: X509_policy_check(3) repeatedly.
1.1 deraadt 1593:
1.38 tb 1594: <li>Avoid leaking memory in x509_verify_chain_dup().
1.1 deraadt 1595: </ul>
1596: </ul>
1597:
1.15 benno 1598: <li>OpenSSH 8.5
1.1 deraadt 1599: <ul>
1.33 benno 1600: <li>Security fixes
1601: <ul>
1602: <li><a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>:
1603: fixed a double-free memory corruption that was introduced in OpenSSH
1604: 8.2 . We treat all such memory faults as potentially exploitable. This
1605: bug could be reached by an attacker with access to the agent socket.<br>
1.3 benno 1606:
1.33 benno 1607: On modern operating systems where the OS can provide information
1608: about the user identity connected to a socket, OpenSSH ssh-agent and
1609: sshd limit agent socket access only to the originating user and root.
1610: Additional mitigation may be afforded by the system's
1611: malloc(3)/free(3) implementation, if it detects double-free
1612: conditions.<br>
1.3 benno 1613:
1.33 benno 1614: The most likely scenario for exploitation is a user forwarding an
1615: agent either to an account shared with a malicious user or to a host
1616: with an attacker holding root access.
1617: </ul>
1.63 benno 1618: <li>Potentially incompatible changes
1.1 deraadt 1619: <ul>
1.33 benno 1620: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
1621: href="https://man.openbsd.org/sshd.8">sshd(8)</a>: this release
1622: changes the first-preference signature algorithm from ECDSA to
1623: ED25519.
1624:
1625: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
1626: href="https://man.openbsd.org/sshd.8">sshd(8)</a>: set the TOS/DSCP
1627: specified in the configuration for interactive use prior to TCP
1628: connect. The connection phase of the SSH session is time-sensitive and
1629: often explicitly interactive. The ultimate interactive/bulk TOS/DSCP
1630: will be set after authentication completes.
1631:
1632: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
1633: href="https://man.openbsd.org/sshd.8">sshd(8)</a>: remove the
1634: pre-standardization cipher rijndael-cbc@lysator.liu.se. It is an alias
1635: for aes256-cbc before it was standardized in RFC4253 (2006), has been
1636: deprecated and disabled by default since OpenSSH 7.2 (2016) and was
1637: only briefly documented in ssh.1 in 2001.
1638:
1639: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
1640: href="https://man.openbsd.org/sshd.8">sshd(8)</a>: update/replace the
1641: experimental post-quantum hybrid key exchange method based on
1642: Streamlined NTRU Prime coupled with X25519.<br>
1643:
1644: The previous sntrup4591761x25519-sha512@tinyssh.org method is
1645: replaced with sntrup761x25519-sha512@openssh.com. Per its designers,
1646: the sntrup4591761 algorithm was superseded almost two years ago by
1647: sntrup761.
1.63 benno 1648: (Note that both the updated method and the one that it replaced are
1649: disabled by default.)
1.33 benno 1650:
1651: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: disable
1652: CheckHostIP by default. It provides insignificant benefits while
1653: making key rotation significantly more difficult, especially for hosts
1654: behind IP-based load-balancers.
1.1 deraadt 1655: </ul>
1656: <li>New Features
1657: <ul>
1.33 benno 1658: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: this release
1659: enables UpdateHostkeys by default subject to some conservative
1660: preconditions:
1661: <ul>
1662: <li>The key was matched in the UserKnownHostsFile (and not in the
1663: GlobalKnownHostsFile).
1664: <li>The same key does not exist under another name.
1665: <li>A certificate host key is not in use.
1666: <li>known_hosts contains no matching wildcard hostname pattern.
1667: <li>VerifyHostKeyDNS is not enabled.
1668: <li>The default UserKnownHostsFile is in use.
1669: </ul>
1670: We expect some of these conditions will be modified or relaxed in
1671: future.
1672:
1673: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
1674: href="https://man.openbsd.org/sshd.8">sshd(8)</a>: add a new
1675: LogVerbose configuration directive for that allows forcing maximum
1676: debug logging by file/function/line pattern-lists.
1677:
1678: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: when
1679: prompting the user to accept a new hostkey, display any other host
1680: names/addresses already associated with the key.
1681:
1682: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: allow
1683: UserKnownHostsFile=none to indicate that no known_hosts file should be
1684: used to identify host keys.
1685:
1686: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: add a
1687: ssh_config KnownHostsCommand option that allows the client to obtain
1688: known_hosts data from a command in addition to the usual files.
1689:
1690: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: add a
1691: ssh_config PermitRemoteOpen option that allows the client to restrict
1692: the destination when RemoteForward is used with SOCKS.
1693:
1694: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: for FIDO
1695: keys, if a signature operation fails with a "incorrect PIN" reason and
1696: no PIN was initially requested from the user, then request a PIN and
1697: retry the operation. This supports some biometric devices that fall
1698: back to requiring PIN when reading of the biometric failed, and
1699: devices that require PINs for all hosted credentials.
1700:
1701: <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>: implement
1702: client address-based rate-limiting via new <a
1703: href="https://man.openbsd.org/sshd_config.5">sshd_config(5)</a>
1704: PerSourceMaxStartups and PerSourceNetBlockSize directives that provide
1705: more fine-grained control on a per-origin address basis than the
1706: global MaxStartups limit.
1.1 deraadt 1707: </ul>
1708: <li>Bugfixes
1709: <ul>
1.33 benno 1710: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: Prefix
1711: keyboard interactive prompts with "(user@host)" to make it easier to
1712: determine which connection they are associated with in cases like scp
1713: -3, ProxyJump, etc. bz#3224
1714:
1715: <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>: fix
1716: sshd_config SetEnv directives located inside Match blocks. GHPR#201
1717:
1718: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: when
1719: requesting a FIDO token touch on stderr, inform the user once the
1720: touch has been recorded.
1721:
1722: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: prevent
1723: integer overflow when ridiculously large ConnectTimeout values are
1724: specified, capping the effective value (for most platforms) at 24
1725: days. bz#3229
1726:
1727: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: consider the
1728: ECDSA key subtype when ordering host key algorithms in the client.
1729:
1730: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
1731: href="https://man.openbsd.org/sshd.8">sshd(8)</a>: rename the
1732: PubkeyAcceptedKeyTypes keyword to PubkeyAcceptedAlgorithms. The
1733: previous name incorrectly suggested that it control allowed key
1734: algorithms, when this option actually specifies the signature
1735: algorithms that are accepted. The previous name remains available as
1736: an alias. bz#3253
1737:
1738: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
1739: href="https://man.openbsd.org/sshd.8">sshd(8)</a>: similarly, rename
1740: HostbasedKeyTypes (ssh) and HostbasedAcceptedKeyTypes (sshd) to
1741: HostbasedAcceptedAlgorithms.
1742:
1743: <li><a
1744: href="https://man.openbsd.org/sftp-server.8">sftp-server(8)</a>: add
1745: missing lsetstat@openssh.com documentation and advertisement in the
1746: server's SSH2_FXP_VERSION hello packet.
1747:
1748: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
1749: href="https://man.openbsd.org/sshd.8">sshd(8)</a>: more strictly
1750: enforce KEX state-machine by banning packet types once they are
1751: received. Fixes memleak caused by duplicate
1752: SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).
1753:
1754: <li><a href="https://man.openbsd.org/sftp.1">sftp(1)</a>: allow the
1755: full range of UIDs/GIDs for chown/chgrp on 32bit platforms instead of
1756: being limited by LONG_MAX. bz#3206
1757:
1758: <li>Minor man page fixes (capitalization, commas, etc.) bz#3223
1759:
1760: <li><a href="https://man.openbsd.org/sftp.1">sftp(1)</a>: when doing
1761: an sftp recursive upload or download of a read-only directory, ensure
1762: that the directory is created with write and execute permissions in
1763: the interim so that the transfer can actually complete, then set the
1764: directory permission as the final step. bz#3222
1765:
1766: <li><a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:
1767: document the -Z, check the validity of its argument earlier and
1768: provide a better error message if it's not correct. bz#2879
1769:
1770: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: ignore
1771: comments at the end of config lines in ssh_config, similar to what we
1772: already do for sshd_config. bz#2320
1773:
1774: <li><a
1775: href="https://man.openbsd.org/sshd_config.5">sshd_config(5)</a>:
1776: mention that DisableForwarding is valid in a sshd_config Match block.
1777: bz3239
1778:
1779: <li><a href="https://man.openbsd.org/sftp.1">sftp(1)</a>: fix
1780: incorrect sorting of "ls -ltr" under some circumstances. bz3248.
1781:
1782: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
1783: href="https://man.openbsd.org/sshd.8">sshd(8)</a>: fix potential
1784: integer truncation of (unlikely) timeout values. bz#3250
1785:
1786: <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: make
1787: hostbased authentication send the signature algorithm in its
1788: SSH2_MSG_USERAUTH_REQUEST packets instead of the key type. This make
1789: HostbasedAcceptedAlgorithms do what it is supposed to - filter on
1790: signature algorithm and not key type.
1.1 deraadt 1791: </ul>
1792: </ul>
1793:
1794: <li>Ports and packages:
1795: <p>Many pre-built packages for each architecture:
1796: <!-- number of FTP packages minus SHA256, SHA256.sig, index.txt -->
1797: <ul style="column-count: 3">
1.69 sthen 1798: <li>aarch64: 10943
1.68 sthen 1799: <li>amd64: 11310
1.1 deraadt 1800: <li>arm: XXX
1.68 sthen 1801: <li>i386: 10468
1.1 deraadt 1802: <li>mips64: XXX
1803: <li>mips64el: XXX
1804: <li>powerpc: XXX
1805: <li>powerpc64: XXX
1.69 sthen 1806: <li>sparc64: 9642
1.1 deraadt 1807: </ul>
1808:
1.40 rsadowsk 1809: <p>Some highlights:
1810: <ul style="column-count: 3">
1811: <li>Asterisk 18.3.0
1812: <li>Audacity 2.4.2
1813: <li>CMake 3.19.4
1.50 lteo 1814: <li>Chromium 90.0.4430.72
1.40 rsadowsk 1815: <li>Emacs 27.2
1816: <li>FFmpeg 4.3.2
1817: <li>GCC 8.4.0
1818: <li>GHC 8.10.3
1819: <li>GNOME 3.38
1820: <li>Go 1.16.2
1821: <li>JDK 8u282 and 11.0.10
1822: <li>KDE Applications 20.12.3
1823: <li>KDE Frameworks 5.80.0
1824: <li>Krita 4.4.3
1.46 sthen 1825: <li>LLVM/Clang 10.0.1
1.40 rsadowsk 1826: <li>LibreOffice 7.0.5.2
1827: <li>Lua 5.1.5, 5.2.4 and 5.3.6
1828: <li>MariaDB 10.5.9
1829: <li>Mono 6.12.0.122
1.64 naddy 1830: <li>Mozilla Firefox 88.0 and ESR 78.10.0
1831: <li>Mozilla Thunderbird 78.10.0
1.40 rsadowsk 1832: <li>Mutt 2.0.6 and NeoMutt 20210205
1833: <li>Node.js 12.16.1
1834: <li>OCaml 4.10.0
1.45 sthen 1835: <li>OpenLDAP 2.4.58
1836: <li>PHP 7.2.34, 7.3.27, 7.4.16 and 8.0.3
1837: <li>Postfix 3.5.10
1.40 rsadowsk 1838: <li>PostgreSQL 13.2
1839: <li>Python 2.7.18, 3.8.8 and 3.9.2
1840: <li>Qt 5.15.2
1841: <li>R 4.0.5
1842: <li>Ruby 2.6.7, 2.7.3 and 3.0.1
1843: <li>Rust 1.51.0
1.45 sthen 1844: <li>SQLite 3.34.1
1.40 rsadowsk 1845: <li>Shotcut 21.01.29
1846: <li>Sudo 1.9.6p1
1847: <li>Suricata 6.0.1
1848: <li>Tcl/Tk 8.5.19 and 8.6.8
1849: <li>TeX Live 2020
1850: <li>Vim 8.2.2580 and Neovim 0.4.4
1851: <li>Xfce 4.16
1852: </ul>
1853: <p>
1854:
1.1 deraadt 1855: <li>As usual, steady improvements in manual pages and other documentation.
1856:
1857: <li>The system includes the following major components from outside suppliers:
1858: <ul>
1.5 benno 1859:
1860: <li>Xenocara (based on X.Org 7.7 with xserver 1.20.10 + patches,
1.32 matthieu 1861: freetype 2.10.4, fontconfig 2.12.4, Mesa 20.0.8, xterm 367,
1.5 benno 1862: xkeyboard-config 2.20, fonttosfnt 1.2.1 and more)
1.1 deraadt 1863: <li>LLVM/Clang 10.0.1 (+ patches)
1864: <li>GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
1.10 benno 1865: <li>Perl 5.32.1 (+ patches)
1.8 florian 1866: <li>NSD 4.3.6
1867: <li>Unbound 1.13.1
1.1 deraadt 1868: <li>Ncurses 5.7
1869: <li>Binutils 2.17 (+ patches)
1870: <li>Gdb 6.3 (+ patches)
1.5 benno 1871: <li>Awk December 18, 2020 version
1872: <li>Expat 2.2.10
1.1 deraadt 1873: </ul>
1874:
1875: </ul>
1876: </section>
1877:
1878: <hr>
1879:
1880: <section id=install>
1881: <h3>How to install</h3>
1882: <p>
1883: Please refer to the following files on the mirror site for
1884: extensive details on how to install OpenBSD 6.9 on your machine:
1885:
1886: <ul>
1887: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/alpha/INSTALL.alpha">
1888: .../OpenBSD/6.9/alpha/INSTALL.alpha</a>
1889: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/amd64/INSTALL.amd64">
1890: .../OpenBSD/6.9/amd64/INSTALL.amd64</a>
1891: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/arm64/INSTALL.arm64">
1892: .../OpenBSD/6.9/arm64/INSTALL.arm64</a>
1893: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/armv7/INSTALL.armv7">
1894: .../OpenBSD/6.9/armv7/INSTALL.armv7</a>
1895: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/hppa/INSTALL.hppa">
1896: .../OpenBSD/6.9/hppa/INSTALL.hppa</a>
1897: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/i386/INSTALL.i386">
1898: .../OpenBSD/6.9/i386/INSTALL.i386</a>
1899: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/landisk/INSTALL.landisk">
1900: .../OpenBSD/6.9/landisk/INSTALL.landisk</a>
1901: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/loongson/INSTALL.loongson">
1902: .../OpenBSD/6.9/loongson/INSTALL.loongson</a>
1903: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/luna88k/INSTALL.luna88k">
1904: .../OpenBSD/6.9/luna88k/INSTALL.luna88k</a>
1905: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/macppc/INSTALL.macppc">
1906: .../OpenBSD/6.9/macppc/INSTALL.macppc</a>
1907: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/octeon/INSTALL.octeon">
1908: .../OpenBSD/6.9/octeon/INSTALL.octeon</a>
1909: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/powerpc64/INSTALL.powerpc64">
1.4 landry 1910: .../OpenBSD/6.9/powerpc64/INSTALL.powerpc64</a>
1.1 deraadt 1911: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/sgi/INSTALL.sgi">
1912: .../OpenBSD/6.9/sgi/INSTALL.sgi</a>
1913: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/sparc64/INSTALL.sparc64">
1914: .../OpenBSD/6.9/sparc64/INSTALL.sparc64</a>
1915: </ul>
1916: </section>
1917:
1918: <hr>
1919:
1920: <section id=quickinstall>
1921: <p>
1922: Quick installer information for people familiar with OpenBSD, and the use of
1923: the "<a href="https://man.openbsd.org/disklabel.8">disklabel</a> -E" command.
1924: If you are at all confused when installing OpenBSD, read the relevant
1925: INSTALL.* file as listed above!
1926:
1927: <h3>OpenBSD/alpha:</h3>
1928:
1929: <p>
1930: If your machine can boot from CD, you can write <i>install69.iso</i> or
1931: <i>cd69.iso</i> to a CD and boot from it.
1932: Refer to INSTALL.alpha for more details.
1933:
1934: <h3>OpenBSD/amd64:</h3>
1935:
1936: <p>
1937: If your machine can boot from CD, you can write <i>install69.iso</i> or
1938: <i>cd69.iso</i> to a CD and boot from it.
1939: You may need to adjust your BIOS options first.
1940:
1941: <p>
1942: If your machine can boot from USB, you can write <i>install69.img</i> or
1943: <i>miniroot69.img</i> to a USB stick and boot from it.
1944:
1945: <p>
1946: If you can't boot from a CD, floppy disk, or USB,
1947: you can install across the network using PXE as described in the included
1948: INSTALL.amd64 document.
1949:
1950: <p>
1951: If you are planning to dual boot OpenBSD with another OS, you will need to
1952: read INSTALL.amd64.
1953:
1954: <h3>OpenBSD/arm64:</h3>
1955:
1956: <p>
1.60 jsg 1957: Write <i>install69.img</i> or <i>miniroot69.img</i> to a disk and boot from it
1958: after connecting to the serial console. Refer to INSTALL.arm64 for more
1959: details.
1.1 deraadt 1960:
1961: <h3>OpenBSD/armv7:</h3>
1962:
1963: <p>
1964: Write a system specific miniroot to an SD card and boot from it after connecting
1965: to the serial console. Refer to INSTALL.armv7 for more details.
1966:
1967: <h3>OpenBSD/hppa:</h3>
1968:
1969: <p>
1970: Boot over the network by following the instructions in INSTALL.hppa or the
1971: <a href="hppa.html#install">hppa platform page</a>.
1972:
1973: <h3>OpenBSD/i386:</h3>
1974:
1975: <p>
1976: If your machine can boot from CD, you can write <i>install69.iso</i> or
1977: <i>cd69.iso</i> to a CD and boot from it.
1978: You may need to adjust your BIOS options first.
1979:
1980: <p>
1981: If your machine can boot from USB, you can write <i>install69.img</i> or
1982: <i>miniroot69.img</i> to a USB stick and boot from it.
1983:
1984: <p>
1985: If you can't boot from a CD, floppy disk, or USB,
1986: you can install across the network using PXE as described in
1987: the included INSTALL.i386 document.
1988:
1989: <p>
1990: If you are planning on dual booting OpenBSD with another OS, you will need to
1991: read INSTALL.i386.
1992:
1993: <h3>OpenBSD/landisk:</h3>
1994:
1995: <p>
1996: Write <i>miniroot69.img</i> to the start of the CF
1997: or disk, and boot normally.
1998:
1999: <h3>OpenBSD/loongson:</h3>
2000:
2001: <p>
2002: Write <i>miniroot69.img</i> to a USB stick and boot bsd.rd from it
2003: or boot bsd.rd via tftp.
2004: Refer to the instructions in INSTALL.loongson for more details.
2005:
2006: <h3>OpenBSD/luna88k:</h3>
2007:
2008: <p>
2009: Copy 'boot' and 'bsd.rd' to a Mach or UniOS partition, and boot the bootloader
2010: from the PROM, and then bsd.rd from the bootloader.
2011: Refer to the instructions in INSTALL.luna88k for more details.
2012:
2013: <h3>OpenBSD/macppc:</h3>
2014:
2015: <p>
2016: Burn the image from a mirror site to a CDROM, and power on your machine
2017: while holding down the <i>C</i> key until the display turns on and
2018: shows <i>OpenBSD/macppc boot</i>.
2019:
2020: <p>
2021: Alternatively, at the Open Firmware prompt, enter <i>boot cd:,ofwboot
2022: /6.9/macppc/bsd.rd</i>
2023:
2024: <h3>OpenBSD/octeon:</h3>
2025:
2026: <p>
2027: After connecting a serial port, boot bsd.rd over the network via DHCP/tftp.
2028: Refer to the instructions in INSTALL.octeon for more details.
2029:
2030: <h3>OpenBSD/powerpc64:</h3>
2031:
2032: <p>
2033: To install, write <i>install69.img</i> or <i>miniroot69.img</i> to a
2034: USB stick, plug it into the machine and choose the <i>OpenBSD
2035: install</i> menu item in Petitboot.
2036: Refer to the instructions in INSTALL.powerpc64 for more details.
2037:
2038: <h3>OpenBSD/sgi:</h3>
2039:
2040: <p>
2041: To install, burn cd69.iso on a CD-R, put it in the CD drive of your
2042: machine and select <i>Install System Software</i> from the System Maintenance
2043: menu. Indigo/Indy/Indigo2 (R4000) systems will not boot automatically from
2044: CD-ROM, and need a proper invocation from the PROM prompt.
2045: Refer to the instructions in INSTALL.sgi for more details.
2046:
2047: <p>
2048: If your machine doesn't have a CD drive, you can setup a DHCP/tftp network
2049: server, and boot using "bootp()/bsd.rd.IP##" using the kernel matching your
2050: system type. Refer to the instructions in INSTALL.sgi for more details.
2051:
2052: <h3>OpenBSD/sparc64:</h3>
2053:
2054: <p>
2055: Burn the image from a mirror site to a CDROM, boot from it, and type
2056: <i>boot cdrom</i>.
2057:
2058: <p>
2059: If this doesn't work, or if you don't have a CDROM drive, you can write
2060: <i>floppy69.img</i> or <i>floppyB69.img</i>
2061: (depending on your machine) to a floppy and boot it with <i>boot
2062: floppy</i>. Refer to INSTALL.sparc64 for details.
2063:
2064: <p>
2065: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install
2066: will most likely fail.
2067:
2068: <p>
2069: You can also write <i>miniroot69.img</i> to the swap partition on
2070: the disk and boot with <i>boot disk:b</i>.
2071:
2072: <p>
2073: If nothing works, you can boot over the network as described in INSTALL.sparc64.
2074: </section>
2075:
2076: <hr>
2077:
2078: <section id=upgrade>
2079: <h3>How to upgrade</h3>
2080: <p>
1.22 benno 2081: If you already have an OpenBSD 6.8 system, and do not want to reinstall,
1.1 deraadt 2082: upgrade instructions and advice can be found in the
2083: <a href="faq/upgrade69.html">Upgrade Guide</a>.
2084: </section>
2085:
2086: <hr>
2087:
2088: <section id=sourcecode>
2089: <h3>Notes about the source code</h3>
2090: <p>
2091: <code>src.tar.gz</code> contains a source archive starting at <code>/usr/src</code>.
2092: This file contains everything you need except for the kernel sources,
2093: which are in a separate archive.
2094: To extract:
2095: <blockquote><pre>
2096: # <kbd>mkdir -p /usr/src</kbd>
2097: # <kbd>cd /usr/src</kbd>
2098: # <kbd>tar xvfz /tmp/src.tar.gz</kbd>
2099: </pre></blockquote>
2100: <p>
2101: <code>sys.tar.gz</code> contains a source archive starting at <code>/usr/src/sys</code>.
2102: This file contains all the kernel sources you need to rebuild kernels.
2103: To extract:
2104: <blockquote><pre>
2105: # <kbd>mkdir -p /usr/src/sys</kbd>
2106: # <kbd>cd /usr/src</kbd>
2107: # <kbd>tar xvfz /tmp/sys.tar.gz</kbd>
2108: </pre></blockquote>
2109: <p>
2110: Both of these trees are a regular CVS checkout. Using these trees it
2111: is possible to get a head-start on using the anoncvs servers as
2112: described <a href="anoncvs.html">here</a>.
2113: Using these files
2114: results in a much faster initial CVS update than you could expect from
2115: a fresh checkout of the full OpenBSD source tree.
2116: </section>
2117:
2118: <hr>
2119:
2120: <section id=ports>
2121: <h3>Ports Tree</h3>
2122: <p>
2123: A ports tree archive is also provided. To extract:
2124: <blockquote><pre>
2125: # <kbd>cd /usr</kbd>
2126: # <kbd>tar xvfz /tmp/ports.tar.gz</kbd>
2127: </pre></blockquote>
2128: <p>
2129: Go read the <a href="faq/ports/index.html">ports</a> page
2130: if you know nothing about ports
2131: at this point. This text is not a manual of how to use ports.
2132: Rather, it is a set of notes meant to kickstart the user on the
2133: OpenBSD ports system.
2134: <p>
2135: The <i>ports/</i> directory represents a CVS checkout of our ports.
2136: As with our complete source tree, our ports tree is available via
2137: <a href="anoncvs.html">AnonCVS</a>.
2138: So, in order to keep up to date with the -stable branch, you must make
2139: the <i>ports/</i> tree available on a read-write medium and update the tree
2140: with a command like:
2141: <blockquote><pre>
2142: # <kbd>cd /usr/ports</kbd>
2143: # <kbd>cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_6_9</kbd>
2144: </pre></blockquote>
2145: <p>
2146: [Of course, you must replace the server name here with a nearby anoncvs
2147: server.]
2148: <p>
2149: Note that most ports are available as packages on our mirrors. Updated
2150: ports for the 6.9 release will be made available if problems arise.
2151: <p>
2152: If you're interested in seeing a port added, would like to help out, or just
2153: would like to know more, the mailing list
2154: <a href="mail.html">ports@openbsd.org</a> is a good place to know.
2155: </section>