File: [local] / www / 69.html (download) (as text)
Revision 1.81, Sat Apr 20 21:41:42 2024 UTC (3 weeks, 4 days ago) by bentley
Branch: MAIN
CVS Tags: HEAD
Changes since 1.80: +1 -1 lines
Fix unintentional rendering errors, caught with the validator.
|
<!doctype html>
<html lang=en id=release>
<meta charset=utf-8>
<title>OpenBSD 6.9</title>
<meta name="description" content="OpenBSD 6.9">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" type="text/css" href="openbsd.css">
<link rel="canonical" href="https://www.openbsd.org/69.html">
<h2 id=OpenBSD>
<a href="index.html">
<i>Open</i><b>BSD</b></a>
6.9
</h2>
<table>
<tr>
<td>
<a href="images/nice.png">
<img width="227" height="303" src="images/nice-s.gif" alt="Nice"></a>
<td>
Released May 1, 2021. (50th OpenBSD release)<br>
Copyright 1997-2021, Theo de Raadt.<br>
<br>
6.9 Song:
<a href="lyrics.html#69">"Vetera Novis"</a>.
<br>
Artwork by Joy San.
<br>
<ul>
<li>See the information on <a href="ftp.html">the FTP page</a> for
a list of mirror machines.
<li>Go to the <code class=reldir>pub/OpenBSD/6.9/</code> directory on
one of the mirror sites.
<li>Have a look at <a href="errata69.html">the 6.9 errata page</a> for a list
of bugs and workarounds.
<li>See a <a href="plus69.html">detailed log of changes</a> between the
6.8 and 6.9 releases.
<p>
<li><a href="https://man.openbsd.org/signify.1">signify(1)</a>
pubkeys for this release:<p>
<table class=signify>
<tr><td>
openbsd-69-base.pub:
<td>
<a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/openbsd-69-base.pub">
RWQQsAemppS46LT4dNnAtVUZt51ResyNU35n4OH9yl/r7JcR3B75fO4V</a>
<tr><td>
openbsd-69-fw.pub:
<td>
RWQmtywnZCJ0lWWc2wr0Ity/Ys498gmQksAi2dSmpW5IwkjEH/OXYPaF
<tr><td>
openbsd-69-pkg.pub:
<td>
RWSG2ib5ZXSfQUmO/SK6MkA6wDVmjQ+7PHIUtEokG4TNnTghJnJ7NtkR
<tr><td>
openbsd-69-syspatch.pub:
<td>
RWQukL+0K9o9dQ7z3X8mPAftyJDzxmsm9ojLck+Yi9Q+YGEPqdxDK4ke
</table>
</ul>
<p>
All applicable copyrights and credits are in the src.tar.gz,
sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the
files fetched via <code>ports.tar.gz</code>.
</table>
<hr>
<section id=new>
<h3>What's New</h3>
<p>
This is a partial list of new features and systems included in OpenBSD 6.9.
For a comprehensive list, see the <a href="plus69.html">changelog</a> leading
to 6.9.
<ul>
<li>New/extended platforms:
<ul>
<li>Support for the <a href="powerpc64.html">powerpc64</a> platform was improved:
<ul>
<li>Added <a href="https://man.openbsd.org/astfb.4">astfb(4)</a>, a
driver for the framebuffer of the Aspeed BMC found on many POWER8 and
POWER9 systems.
<li>Added bsd.mp to powerpc64's installXX.{img,iso}.
<li>Added RETGUARD implementation for powerpc and powerpc64.
<li>Added a workaround for PCIO devices that cannot address the full
64-bit PCI address space to powerpc64. Needed for <a
href="https://man.openbsd.org/radeondrm.4">radeondrm(4)</a> and <a
href="https://man.openbsd.org/amdgpu.4">amdgpu(4)</a> since Radeon
GPUs only implement 36, 40, or 44 bits of address space.
<li>Added limited emulation of unaligned access in the powerpc64 kernel.
<li>Added support for netbooting to the powerpc64 RAMDISK kernel.
<li>Fixed booting on powerpc64 machines with memory banks higher in
physical address space, needing a larger TCE table.
<li>Introduced power-saving mode on POWER9 CPUs.
<li>Enabled floating-point exceptions on powerpc64.
<li>Added support for <a
href="https://man.openbsd.org/ipmi.4">ipmi(4)</a> on PowerNV systems.
</ul>
<li>Preliminary support was added for devices using the Apple M1 SoC:
<ul>
<li>Recognized Apple Icestorm/Firestorm cores on arm64.
<li>Added support for BCM4378 chips, as found on the Apple M1 SoCs, to
<a href="https://man.openbsd.org/bwfm.4">bwfm(4)</a>.
<li>Added <a href="https://man.openbsd.org/exuart.4">exuart(4)</a>
support for the UART found on the Apple M1 SoC.
<li>Added <a href="https://man.openbsd.org/apldog.4">apldog(4)</a>, a
driver for the watchdog on Apple M1 SoCs, allowing reboot of the
machine.
<li>Added <a href="https://man.openbsd.org/aplintc.4">aplintc(4)</a>,
a driver for the interrupt controller found on Apple M1 SoCs.
<li>Added <a href="https://man.openbsd.org/aplpcie.4">aplpcie(4)</a>,
a driver for the PCIe host bridge on Apple M1 SoCs.
<li>Added <a href="https://man.openbsd.org/apldart.4">apldart(4)</a>,
a driver for the IOMMU on Apple M1 SoCs.
<li>Added support for CPUs with 8-bit ASIDs such as those on
Apple's M1 SoC.
</ul>
<li>The arm64 platform support was improved with the following changes:
<ul>
<li>Optimized arm64 <a
href="https://man.openbsd.org/copyin.9">copyin(9)</a>, <a
href="https://man.openbsd.org/copyout.9">copyout(9)</a> and <a
href="https://man.openbsd.org/kcopy.9">kcopy(9)</a> by doing 16-byte
copies if possible.
<li>Added recognition of Cortex-A78AE, Cortex-X1 and Neoverse V1 arm64 CPUs.
<li>Added clock support for i.MX8MP SoCs.
<li>Added support for the VF610 I2C controller to <a
href="https://man.openbsd.org/imxiic.4">imxiic(4)</a>.
<li>Added <a href="https://man.openbsd.org/dwgpio.4">dwgpio(4)</a>, a
driver for the Synopsys DesignWare GPIO controller.
<li>Added <a
href="https://man.openbsd.org/amlpinctrl.4">amlpinctrl(4)</a> support
for the "Always On" GPIOs.
<li>Made large read and write transactions work in <a
href="https://man.openbsd.org/amliic.4">amliic(4)</a>.
<li>Added support for the PCIe controller found on Amlogic
G12A/G12B/SM1 SoCs to <a
href="https://man.openbsd.org/dwpcie.4">dwpcie(4)</a>.
<li>Implemented legacy interrupt support to <a
href="https://man.openbsd.org/mvkpcie.4">mvkpcie(4)</a>.
<li>Added <a href="https://man.openbsd.org/cryptox.4">cryptox(4)</a>,
a driver for armv8 cryptographic extensions.
<li>Added support for PCIe on the NanoPi R4S to <a
href="https://man.openbsd.org/rkpcie.4">rkpcie(4)</a>.
<li>Added <a href="https://man.openbsd.org/smmu.4">smmu(4)</a>, a
driver for the ARM System MMU.
<li>Introduced an IOVA early-allocation scheme in <a
href="https://man.openbsd.org/smmu.4">smmu(4)</a>, mitigating the
performance penalty of typical IOVA allocation designs.
<li>Introduced Guard Pages in <a
href="https://man.openbsd.org/smmu.4">smmu(4)</a>, to spot misuse
and misconfiguration of I/O devices more easily.
<li>Added support for RK809 to <a
href="https://man.openbsd.org/rkpmic.4">rkpmic(4)</a>, as seen on the
Rock Pi N10 with the rk3399pro.
<li>Added support for <a
href="https://man.openbsd.org/sdhc.4">sdhc(4)</a> on the Raspberry Pi
in ACPI mode.
<li>Enabled <a href="https://man.openbsd.org/ixl.4">ixl(4)</a> on arm64.
<li>Updated device-tree bindings for <a
href="https://man.openbsd.org/cwfg.4">cwfg(4)</a> battery capacity
driver to correct attaching and account for monitoring interval
change, making cwfg(4) export values under hw.sensors as expected when
using a Pinebook Pro.
<li>Added ARMv8-5 instruction set related CPU features to arm64.
</ul>
</ul>
<li>Various kernel improvements:
<ul>
<li>Added the RAID1C (encrypted raid1) <a
href="https://man.openbsd.org/softraid.4">softraid(4)</a> discipline,
encrypting data like the CRYPTO discipline and accepting multiple
chunks during creation and assembly like the RAID1 discipline.
<li>Corrected raidlevel verification specified by the -c option in <a
href="https://man.openbsd.org/bioctl.8">bioctl(8)</a>.
<li>Introduced kern.video.record for <a
href="https://man.openbsd.org/video.4">video(4)</a> devices, a privacy feature analog
to the kern.audio.record <a
href="https://man.openbsd.org/sysctl.8">sysctl(8)</a> parameter for <a
href="https://man.openbsd.org/audio.4">audio(4)</a> devices. By
default, kern.video.record will be set to zero and blank all data
delivered by drivers attaching to <a
href="https://man.openbsd.org/video.4">video(4)</a>.
<li>Allowed a process to open a <a
href="https://man.openbsd.org/video.4">video(4)</a> device multiple
times. Fixes webcam usage with Firefox and BigBlueButton.
<li>Enabled multiple opens of a <a
href="https://man.openbsd.org/video.4">video(4)</a> device as
described in the V4L2 specification.
<li>Added basic support for kclock timeouts to <a
href="https://man.openbsd.org/timeout.9">timeout(9)</a>.
<li>Changed the <a href="https://man.openbsd.org/pool.9">pool(9)</a>
timeouts to use the system uptime instead of ticks.
<li>Ensured <a href="https://man.openbsd.org/sleep.3">sleep(3)</a>
calls <a href="https://man.openbsd.org/nanosleep.2">nanosleep(2)</a>
if seconds is zero, now delegating all decisions about whether or not
to yield the CPU.
<li>Added a top-level 'reboot' command to <a
href="https://man.openbsd.org/ddb.4">ddb(4)</a>.
<li>Added <a href="https://man.openbsd.org/witness.4">witness(4)</a>
check for uninitialized (or zeroed) lock usage.
<li>Added fd close notification for kqueue-based <a
href="https://man.openbsd.org/poll.2">poll(2)</a> and <a
href="https://man.openbsd.org/select.2">select(2)</a>.
<li>Added a global "nowake" channel for threads avoiding <a
href="https://man.openbsd.org/wakeup.9">wakeup(9)</a> to <a
href="https://man.openbsd.org/tsleep.9">tsleep(9)</a>.
<li>Added trace points for <a
href="https://man.openbsd.org/malloc.9">malloc(9)</a> and <a
href="https://man.openbsd.org/free.9">free(9)</a>, making them
traceable via <a href="https://man.openbsd.org/dt.4">dt(4)</a> and <a
href="https://man.openbsd.org/btrace.8">btrace(8)</a>.
<li>Added <a href="https://man.openbsd.org/btrace.8">btrace(8)</a> -n
(no action) mode, which parses the program and then exits.
<li>Fixed a boot-time crash on sparc64 due to mutex use during the
message buffer initialization.
<li>Prevented a panic in some ACPI firmware that provided invalid
memory regions in their reserved memory region reporting table.
<li>Added a barrier between reading the cqe flags and the command ID
to prevent completion of the wrong SCSI I/O for <a
href="https://man.openbsd.org/nvme.4">nvme(4)</a> drives.
<li>Prevented attachment of <a href="https://man.openbsd.org/nvme.4">nvme(4)</a>
devices of zero size.
<li>Introduced new function <a
href="https://man.openbsd.org/if_unit.9">if_unit(9)</a>, returning a
pointer to the interface descriptor corresponding to the unique name.
<li>Clear interrupts on luna88k processors more efficiently at boot
time.
<li>Added <a
href="https://man.openbsd.org/acpiiort.4">acpiiort(4)</a>, a driver
for the ACPI I/O Remapping Table.
<li>Updated clock interrupt count atomically on mips64.
<li>Prevented an amd64 kernel crash with protection fault due to an
invalid offset when reading /dev/kmem.
<li>Permitted access to kern.somaxconn sysctl information when the
unix <a href="https://man.openbsd.org/pledge.2">pledge(2)</a> is used,
allowing Go programs to use "unix" without also including "inet".
<li>Excluded the first page and added a guard page between I/O
virtual address space allocations on arm64.
<li>Prevented attachment of SCSI devices that fail to provide
adequate INQUIRY data.
</ul>
<li>SMP Improvements
<ul>
<li>Introduced "if_cloners_lock" rwlock and used it to serialize
if_clone_{create,destroy}(), avoiding multiple race conditions.
<li>Introduced a system-wide mutex that serializes msgbuf operations.
<li>Made <a
href="https://man.openbsd.org/uvm_pagealloc.9">uvm_pagealloc(9)</a> of
the physical memory allocator mp-safe.
<li>Unlocked <a href="https://man.openbsd.org/getppid.2">getppid(2)</a>.
<li>Introduced locking for amaps and anons, improving build performance.
<li>Moved UNIX domain sockets out of the kernel lock, using the new
"unp_lock" <a href="https://man.openbsd.org/rwlock.9">rwlock(9)</a> as
solock()'s backend to protect the whole layer.
<li>Unlocked <a href="https://man.openbsd.org/sendsyslog.2">sendsyslog(2)</a>.
<li>Used per-CPU counter for fault and stats counters reached in uvm_fault().
</ul>
<li>Direct Rendering Manager
<ul>
<li>Fixed <a
href="https://man.openbsd.org/wsconsctl.8">wsconsctl(8)</a>
backlight commands when using
<a href="https://man.openbsd.org/drm.4">drm(4)</a> drivers on
macppc.
<li>Fixed a <a
href="https://man.openbsd.org/radeondrm.4">radeondrm(4)</a>
panic on macppc with Powerbook5,6 and RV350.
<li>Fixed DRI3 support on <a
href="https://man.openbsd.org/amdgpu.4">amdgpu(4)</a> and <a
href="https://man.openbsd.org/ati.4">ati(4)</a>.
<li>/dev/dri/ device nodes are created to be more compatible with Linux.
</ul>
<li>VMM/VMD improvements
<ul>
<li>Prevented memory corruption or improper page access in <a
href="https://man.openbsd.org/vmm.4">vmm(4)</a> due to improper TLB
flushing for now by wiring the pages used by virtual machines.
<li>Removed the ability of <a
href="https://man.openbsd.org/vmd.8">vmd(8)</a> to boot from kernels
in raw/qcow2 images.
<li>Made <a href="https://man.openbsd.org/vmctl.8">vmctl(8)</a>
properly indicate VMs are stopping instead of "running" with "vmctl
status".
<li>Simplify argument parsing of
<code><a href="https://man.openbsd.org/vmctl.8">vmctl(8)</a> stop</code>
thereby avoiding a
<a href="https://man.openbsd.org/printf.3">printf(3)</a> "%s" NULL,
a use of uninitialized and a dead else branch.
<li>Cleaned up events on <a
href="https://man.openbsd.org/vmd.8">vmd(8)</a> pause or resume and
fixed an issue leading to broken serial console by cleanly tearing
down and restoring emulated device state on vm send/receive.
<li>Propagated host-side <a
href="https://man.openbsd.org/tap.4">tap(4)</a> lladdr to guest vm
process to allow unicast dhcp and bootp renewals with <a
href="https://man.openbsd.org/vmd.8">vmd(8)</a>'s built-in dhcp
server.
<li>Added <a href="https://man.openbsd.org/veb.4">veb(4)</a> to the
list of supported bridges for <a
href="https://man.openbsd.org/vmd.8">vmd(8)</a>.
<li>Improved MSR exit handling in <a
href="https://man.openbsd.org/vmm.4">vmm(4)</a> on SVM and VMX
hosts preventing invalid reads and fixing support for 9front.
<li>Added ability to boot compressed ramdisks to <a
href="https://man.openbsd.org/vmd.8">vmd(8)</a>.
</ul>
<li>Various new userland features:
<ul>
<li>Added <a
href="https://man.openbsd.org/doas.conf.5">doas.conf(5)</a> "nolog"
option to avoid <a
href="https://man.openbsd.org/syslog.3">syslog(3)</a>.
<li>Allowed specific <a
href="https://man.openbsd.org/sndio.7">sndio(7)</a> devices to be used
for play-only and rec-only modes.
<li>Use an 8th order FIR low-pass filter for resampling in <a
href="https://man.openbsd.org/sndiod.8">sndiod(8)</a> and for <a
href="https://man.openbsd.org/aucat.1">aucat(1)</a>, removing most of
the aliasing noise during resampling.
<li>Disabled <a href="https://man.openbsd.org/sndiod.8">sndiod(8)</a>
autovolume by default and set the default volume to 127. Setting "-w
on" will replicate the previous behavior of automatically decreasing
playback volume when new programs start playing.
<li>Allowed mixing of alternative devices (-F) with different
capabilities in <a
href="https://man.openbsd.org/sndiod.8">sndiod(8)</a> by treating any
device as full-duplex.
<li>Fixed visibility of <a
href="https://man.openbsd.org/sndioctl.1">sndioctl(1)</a> output when
used through a pipe.
<li>Enabled build and install of <a href="https://man.openbsd.org/lldb.1">lldb(1)</a>.
<li>Added <a href="https://man.openbsd.org/logger.1">logger(1)</a>
support to <a href="https://man.openbsd.org/rcctl.8">rcctl(8)</a>, <a
href="https://man.openbsd.org/rc.subr.8">rc.subr(8)</a> and <a
href="https://man.openbsd.org/rc.d.8">rc.d(8)</a> for daemons logging
to stdout/stderr.
<li>Added a configurable button mapping for tap gestures on touchpads
to <a href="https://man.openbsd.org/wsconsctl.8">wsconsctl(8)</a>.
<li>Made <a href="https://man.openbsd.org/wscons.4">wscons(4)</a>
touchpad tap detection less restrictive for multi-finger taps and
improved tap detection.
<li>Enable <a
href="https://man.openbsd.org/man4/arm64/apm.4">apm(4)</a> on arm64 to
display meaningful information about battery use and capacity.
</ul>
<li>Various bugfixes and tweaks in userland:
<ul>
<li>Fixed a pledge violation in <a
href="https://man.openbsd.org/csh.1">csh(1)</a> where redirecting
input from a file containing ^T would cause csh(1) to perform a tty
ioctl operation against a non-tty.
<li>Made <a href="https://man.openbsd.org/syspatch.8">syspatch(8)</a> work
again when fewer than 3 patches are available.
<li>Stopped exempting file systems from <a
href="https://man.openbsd.org/security.8">security(8)</a> on the basis
of nodev and nosuid options, which may not be used for file systems
mounted beneath.
<li>Modified <a href="https://man.openbsd.org/daily.8">daily(8)</a>
to stop reporting disk status and networking statistics.
<li>Made <a
href="https://man.openbsd.org/sysupgrade.8">sysupgrade(8)</a> specify
a version when it uses <a
href="https://man.openbsd.org/fw_update.1">fw_update(1)</a> to avoid
the situation where upgrading a pre-6.8 snapshot to 6.8 release with
"-r" would install firmware packages from snapshots.
<li>Increased speed of the dependency check pass for <a
href="https://man.openbsd.org/pkg_add.1">pkg_add(1)</a>.
<li>Prevented process exit in multithreaded programs from reporting
the wrong error code.
<li>Allowed booting of amd64/i386 from GPT formatted disks larger than 4TB.
<li>When using the <a href="https://man.openbsd.org/cat.1">cat(1)</a>
-n flag, correctly enumerate files with more than INT_MAX lines.
<li>Fixed a memory leak in ld.so's malloc.
<li>Added a "xenodm" login class for <a
href="https://man.openbsd.org/xenodm.1">xenodm(1)</a> and increased
openfiles to 512 to avoid running out of file descriptors with a busy
desktop.
<li>Stopped <a href="https://man.openbsd.org/xenodm.1">xenodm(1)</a>
from adding authorizations for TCP connections by default and added
"listenTCP" to explicitly add authorizations for existing IP addresses
on startup.
<li>Skip adding the IPv6 link local addresses for TCP listener
authorizations in <a href="https://man.openbsd.org/xenodm.1">xenodm(1)</a>,
matching what is done by
<a href="https://man.openbsd.org/startx.1">startx(1)</a>.
<li>Fixed -s option for <a href="https://man.openbsd.org/cmp.1">cmp(1)</a>.
<li>Improve pledge in <a
href="https://man.openbsd.org/doas.1">doas(1)</a>, specifically added
pledge to the "-C" code path.
<li>Improved performance of <a
href="https://man.openbsd.org/malloc.3">malloc(3)</a>'s cache.
<li>Made editing GPT in <a
href="https://man.openbsd.org/fdisk.8">fdisk(8)</a> safer by
defaulting offset to the beginning of the largest free space and
preventing the creation of overlapping partitions.
<li>Fixed a crash that could occur in <a
href="https://man.openbsd.org/sndiod.8">sndiod(8)</a> when a USB
device is unplugged.
<li>Append .html suffixes to temporary files in <a
href="https://man.openbsd.org/mandoc.1">mandoc(1)</a> to allow
recognition by browsers.
<li>Allow specification of a path to the <a
href="https://man.openbsd.org/mg.1">mg(1)</a> startup file on the
command line.
<li>Added a "batch" mode to <a
href="https://man.openbsd.org/mg.1">mg(1)</a> via the "-b" command
line option, which will initialize a pty, run the specified file of mg
commands and then exit.
<li>Inverted the <a href="https://man.openbsd.org/mg.1">mg(1)</a> "R"
indicator to mean that a "*" next to a file's name indicates that it
is read-only. Made the active buffer indicator more visible by
changing it to ">".
<li>Fixed <a href="https://man.openbsd.org/ksh.1">ksh(1)</a>
redrawing of a multiline PS1 prompt in vi mode and added support for
^R (redraw) in insert mode.
<li>Used <a href="https://man.openbsd.org/unveil.2">unveil(2)</a> to
restrict filesystem access in <a
href="https://man.openbsd.org/apmd.8">apmd(8)</a>.
<li>Removed the 30s minimum delay for <a
href="https://man.openbsd.org/xlock.1">xlock(1)</a> timeouts.
<li>Stopped deleting the control socket on exit in <a
href="https://man.openbsd.org/apmd.8">apmd(8)</a>, as deleting
the socket after calling <a
href="https://man.openbsd.org/unveil.2">unveil(2)</a> would cause an
unveil violation.
</ul>
<li>Improved hardware support and driver bugfixes, including:
<ul>
<li>Corrected accounting of zero length Transfer Descriptors in <a
href="https://man.openbsd.org/xhci.4">xhci(4)</a>, preventing running
out of free Transfer Ring Blocks.
<li>Moved mfokclock(4) from loongson to make it available for other
platforms and renamed it to <a
href="https://man.openbsd.org/mfokrtc.4">mfokrtc(4)</a>.
<li>Fixed brightness setting on MacBooks.
<li>Added AMD Vi and Intel VTD IOMMU support. This creates separate
domains for each PCI device and can provide protection against invalid
memory access.
<li>Enabled brightness keys on powerbooks where the keyboard attaches
as <a href="https://man.openbsd.org/ukbd.4">ukbd(4)</a>.
<li>Set initial default display brightness on macppc via
of_setbrightness() to ensure <a
href="https://man.openbsd.org/wscons.4">wscons(4)</a> and ofw are in
sync.
<li>Added support for the PL2303HXN series chips to <a
href="https://man.openbsd.org/uplcom.4">uplcom(4)</a>.
<li>Added support for the PCA9547 I2C mux to <a
href="https://man.openbsd.org/pcamux.4">pcamux(4)</a>.
<li>Extended <a href="https://man.openbsd.org/pcamux.4">pcamux(4)</a>
with ACPI support.
<li>Added <a href="https://man.openbsd.org/acpige.4">acpige(4)</a>, a
driver for ACPI generic event devices, used on various
systems to implement power button handling.
<li>Added <a href="https://man.openbsd.org/pchgpio.4">pchgpio(4)</a>,
a driver for the GPIO controllers found on modern Intel PCHs.
<li>Added ACPI support to <a
href="https://man.openbsd.org/imxiic.4">imxiic(4)</a>.
<li>Fixed panics on the HoneyComb LX2K with <a
href="https://man.openbsd.org/amdgpu.4">amdgpu(4)</a>.
<li>Fixed very old <a
href="https://man.openbsd.org/umass.4">umass(4)</a> devices where the
INQUIRY command succeeds but with a residue equal to the requested
bytes.
<li>Added Gemini Lake I2C id to <a
href="https://man.openbsd.org/dwiic.4">dwiic(4)</a>, making the
touchpad work on the Teclast F7 Plus laptop.
<li>Introduced <a href="https://man.openbsd.org/ujoy.4">ujoy(4)</a>, a
restricted subset of <a
href="https://man.openbsd.org/uhid.4">uhid(4)</a> for game controllers
which uses /dev/ujoy/* device nodes.
<li>Set up <a href="https://man.openbsd.org/ims.4">ims(4)</a> devices
in X11 to behave like touchpads.
<li>Stopped relying on USB devices to correctly present their
indices, instead searching for the correct interfaces. This fixes E+
Corp. DAC Audio devices.
<li>Introduced <a
href="https://man.openbsd.org/uhidpp.4">uhidpp(4)</a>, a driver for
Logitech HID++ devices.
<li>Separated reading of general and touchpad-specific <a
href="https://man.openbsd.org/wsmouse.4">wsmouse(4)</a> settings and
corrected identification of device type when reading touchpad
parameters fails.
<li>Added support for 30-bit color modes to <a
href="https://man.openbsd.org/simplefb.4">simplefb(4)</a>
and <a href="https://man.openbsd.org/wsfb.4">wsfb(4)</a>.
<li>Made loongson kernels recognize Lynloong LM9002/9003 and LM9013 models.
<li>Use native display resolution 1368x768 for Lynloong all-in-one computers.
</ul>
<li>New or improved network hardware support:
<ul>
<li>Fixed link state change behavior in 82598 <a
href="https://man.openbsd.org/ix.4">ix(4)</a> chips.
<li>Fixed issues with network stopping after the first down/up cycle
in <a href="https://man.openbsd.org/mvpp.4">mvpp(4)</a> Marvel Armada
Ethernet device.
<li>Added SFP+ support to ofw, including support for direct attach cables.
<li>Added 10G media support to <a
href="https://man.openbsd.org/mvpp.4">mvpp(4)</a>.
<li>Added support for 1000base-x and 2500base-x connections to <a
href="https://man.openbsd.org/mvneta.4">mvneta(4)</a>.
<li>Added <a href="https://man.openbsd.org/mvsw.4">mvsw(4)</a>, a
driver for Marvel "SOHO" switches.
<li>Enabled auto-negotiation on the SerDes links, allowing
in-band-status to work between <a
href="https://man.openbsd.org/mvpp.4">mvpp(4)</a> and <a
href="https://man.openbsd.org/mvsw.4">mvsw(4)</a> on the ClearFog GT
8K.
<li>Added support for the i.MX8MP PCIe clocks, USB clocks and second
ethernet.
<li>Added Wake on LAN support to <a
href="https://man.openbsd.org/rge.4">rge(4)</a>.
<li>Enabled IPv4 and TCP/UDP checksum offload on transmission in <a
href="https://man.openbsd.org/ogx.4">ogx(4)</a>.
<li>Raised the maximum number of queues/interrupts from 1 to 16 on <a
href="https://man.openbsd.org/mcx.4">mcx(4)</a> devices.
<li>Added support for the Netgear ProSecure UTM25 to octeon.
<li>Added vid/pid table to <a
href="https://man.openbsd.org/umb.4">umb(4)</a> allowing matching to
alternate configurations.
</ul>
<li>Added or improved wireless network drivers:
<ul>
<li>Fixed the <a href="https://man.openbsd.org/athn.4">athn(4)</a> and
<a href="https://man.openbsd.org/urtwn.4">urtwn(4)</a> drivers
in client mode against access points which use WPA1/TKIP as
the group cipher.
<li>Added multicast support to <a
href="https://man.openbsd.org/bwfm.4">bwfm(4)</a> to allow IPv6.
<li>Fixed <a href="https://man.openbsd.org/urtwn.4">urtwn(4)</a>
repeated DEAUTH and loss/restoration of link.
<li>Introduced a delay to work around an issue in <a
href="https://man.openbsd.org/bwfm.4">bwfm(4)</a> on the BCM43602 that
was triggering "unexpected pairwise key update" errors.
<li>Enabled <a href="https://man.openbsd.org/athn.4">athn(4)</a> for arm64.
<li>Implemented a new 802.11n Tx rate adaptation algorithm ("RA") for
<a href="https://man.openbsd.org/iwm.4">iwm(4)</a>,
<a href="https://man.openbsd.org/iwn.4">iwn(4)</a>, and
<a href="https://man.openbsd.org/athn.4">athn(4)</a>.
<li>Fixed association problems with the <a
href="https://man.openbsd.org/ipw.4">ipw(4)</a> and <a
href="https://man.openbsd.org/iwi.4">iwi(4)</a> drivers.
<li>Made <a href="https://man.openbsd.org/iwx.4">iwx(4)</a> attach to
AX201 devices with PCI IDs 0x34f0 and 0x06f0. Needs <a
href="https://man.openbsd.org/fw_update.1">fw_update(1)</a>.
<li>Fixed a problem where <a
href="https://man.openbsd.org/iwn.4">iwn(4)</a> firmware would
generate bogus block ack requests and stall traffic.
<li>Fixed automatic channel selection in the <a
href="https://man.openbsd.org/athn.4">athn(4)</a> driver
when running in hostap or monitor mode.
</ul>
<li>IEEE 802.11 wireless stack improvements and bugfixes:
<ul>
<li>Fixed length calculations in <a
href="https://man.openbsd.org/iwm.4">iwm(4)</a> and <a
href="https://man.openbsd.org/iwx.4">iwx(4)</a> when there are
multiple MPDUs in one packet.
<li>Fixed 802.11n interoperability with access points that offer
management frame protection.
<li>Flush the A-MPDU reorder buffer after gap timeout to prevent
frames from remaining in the buffer until the next frame
is received.
<li>Avoid spurious "input packet decapsulations failed" errors in
<a href="https://man.openbsd.org/netstat.1">netstat(1)</a> -W with
A-MSDU enabled.
<li>Fixed automatic selection of the 11a/b/g/n/ac operating mode when
the interface is running as an access point.
<li>Ensured crypto keys are installed before the link is brought up.
</ul>
<li>Generic network stack improvements and bugfixes:
<ul>
<li>Removed the maxburst feature from tcp_output().
Sending out TCP segments was limited to 4 packets per burst.
This did not scale well on high bandwidth, high latency links.
Especially when the receiving side delays ACK packets
aggressively, the maxburst limitation could seriously reduce
TCP throughput per connection.
<li>Added a MONITOR feature to interfaces. Packets received on these
interfaces do not enter the network stack for further processing. This
can be used to watch traffic, for example with <a
href="https://man.openbsd.org/bpf.4">bpf(4)</a> without risk of the packets
interfering with the system.
<li>Added etherbridge, the internals of a reusable learning bridge
interface providing common code reusable for other drivers needing a
mac learning bridge.
<li>Introduced <a href="https://man.openbsd.org/veb.4">veb(4)</a>, a
Virtual Ethernet Bridge driver.
<li>Added the ability to force the selection of source IP address for
programs that do not specify a source IP, overriding the default
source IP selection algorithm. This is configurable via <a
href="https://man.openbsd.org/route.8">route(8)</a>
<code>sourceaddr</code> command.
<li>Bring interfaces up when autoconfiguration for inet or inet6 is
enabled (AUTOCONF4 or AUTOCONF6 flags).
<li>Adjust terminology in <a
href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a> to refer to
"temporary address extensions" rather than the former "privacy
extensions," including the addition of an AUTOCONF6TEMP flag (to
replace the negative flag "INET6_NOPRIVACY"). The autoconfprivacy
option in <a href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a>
has been deprecated.
<li>Made it possible to disable the "autoconf" flag but keep
"temporary" enabled in <a
href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a>.
<li>For IPv6 addresses, added tracking of address proposal creation
times to be able to establish total lifetime. This information is used
to renew pltime/vltime of privacy addresse per RFC 4941.
<li>Prevented kernel reuse of mbuf memory when generating the ICMP6
response to an IPv6 packet.
<li>Use the toeplitz hash algorithm to set a flowid for tcp packets,
which in turn is used to choose the tx ring on network cards with
multiple rings.
<li>Fixed <a href="https://man.openbsd.org/wg.4">wg(4)</a> on macppc
by keeping track of allowed ips pointer correctly.
<li>Fixed <a href="https://man.openbsd.org/wg.4">wg(4)</a> ioctl to
handle multiple wgpeers.
<li>Fixed a race between tx/rx handshakes in <a
href="https://man.openbsd.org/wg.4">wg(4)</a>.
<li>Prevented a potential hang when trying to remove a <a
href="https://man.openbsd.org/tun.4">tun(4)</a> interface.
<li>Used the correct rdomain when adding and deleting routes with <a
href="https://man.openbsd.org/mpip.4">mpip(4)</a> and <a
href="https://man.openbsd.org/mpw.4">mpw(4)</a>.
<li>Made <a href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a>
"-mplslabel" work with <a
href="https://man.openbsd.org/mpw.4">mpw(4)</a>.
</ul>
<li>Installer and upgrade improvements:
<ul>
<li>Prevented a race in <a
href="https://man.openbsd.org/dhclient.8">dhclient(8)</a> privsep
which could cause autoinstall to fail by calling <a
href="https://man.openbsd.org/ftp.1">ftp(1)</a> without a local
address.
<li>Fixed hangs on amd64 bsd.rd due to misreported core clock
frequency on newer Intel Comet Lake models.
<li>Began distributing the gzip'd version of bsd.rd on all platforms
with boot methods supporting it.
<li>Fixed a problem which prevented use of <a
href="https://man.openbsd.org/sysupgrade.8">sysupgrade(8)</a> when an
interface failed to come up and <a
href="https://man.openbsd.org/dhclient.8">dhclient(8)</a> didn't
notice link-timeout expiration.
<li>Prevented <a
href="https://man.openbsd.org/disklabel.8">disklabel(8)</a> from
adjusting the swap 'b' partition size if physmem is zero to keep the
auto-allocate code from putting a filesystem on that partition.
<li>Emulate "[inet] autoconf" <a
href="https://man.openbsd.org/hostname.if.5">hostname.if(5)</a> lines
with "dhcp" so users testing <a
href="https://man.openbsd.org/dhcpleased.8">dhcpleased(8)</a> will
still be able to upgrade manually while the installer uses only <a
href="https://man.openbsd.org/dhclient.8">dhclient(8)</a>.
<li>Restored <a
href="https://man.openbsd.org/dhclient.conf.5">dhclient.conf(5)</a>
to the group of network configuration files used during upgrades.
</ul>
<li>Security improvements:
<ul>
<li>Added notices to syslog whenever the "%n" format string component
of <a href="https://man.openbsd.org/printf.3">printf(3)</a> is used.
<li>Removed workaround permitting Go executables to do syscalls
directly, forcing them to use shared libc like all other dynamic
binaries.
</ul>
<li>Routing daemons and other userland network improvements:
<ul>
<li>The <a href="https://man.openbsd.org/bgpd.8">bgpd(8)</a> daemon saw the following changes:
<ul>
<li>Introduced <a href="https://man.openbsd.org/bgpd.8">bgpd(8)</a>
<code>rde evaluate all</code> to reduce path hiding in IXP
route-server environments.
<li>Added RTR support to <a href="https://man.openbsd.org/bgpd.8">OpenBGPD</a>.
<li>Added <a href="https://man.openbsd.org/bgpctl.8">bgpctl(8)</a>
"show rtr" to display basic information about RTR sessions.
<li>Added <a href="https://man.openbsd.org/bgpctl.8">bgpctl(8)</a>
"show sets" to display information about the roa-set, as-sets and
prefix-sets loaded into <a
href="https://man.openbsd.org/bgpd.8">bgpd(8)</a>.
<li>Properly implemented "rde med compare strict" in <a
href="https://man.openbsd.org/bgpd.8">bgpd(8)</a> and ensured that the
order of prefixes is always correct.
<li>Introduced a send hold timer in <a
href="https://man.openbsd.org/bgpd.8">bgpd(8)</a> to detect stalls on
the sending side of a TCP connection, acting as a last resort to
detect faulty peers.
<li>Introduced the <a
href="https://man.openbsd.org/bgpd.conf.5">bgpd.conf(5)</a> per
neighbor and global config option "reject as-set yes/no" to allow
rejection of received UPDATES with AS_SET segments. These rejected
prefixes can be viewed with <a
href="https://man.openbsd.org/bgpctl.8">bgpctl(8)</a> "show rib in
error".
<li>No longer allow configuration of the same neighbor multiple
times in <a href="https://man.openbsd.org/bgpd.8">bgpd(8)</a>.
<li><a href="https://man.openbsd.org/pf.4">pf(4)</a> tables now track
prefixes correctly even when received by multiple sessions.
<li>Fixed a memory leak when parsing <a
href="https://man.openbsd.org/bgpd.8">bgpd(8)</a> roa-set lists.
</ul>
<li>The <a
href="https://man.openbsd.org/ospfd.8">ospfd(8)</a> and <a
href="https://man.openbsd.org/ospf6d.8">ospf6d(8)</a> routing
daemons were refactored to keep the code similar to
changes in other routing daemons and to improve maintainability.<br>
Additionally, support for point-to-point interfaces in <a
href="https://man.openbsd.org/ospf6d.8">ospf6d(8)</a> was fixed and <a
href="https://man.openbsd.org/ospfd.8">ospfd(8)</a> now works with
point-to-point interfaces which use a common IP address.
<li>The <a href="https://man.openbsd.org/pf.4">pf(4)</a> packet filter and its userland utility:
<ul>
<li>Relaxed checks in <a
href="https://man.openbsd.org/pfctl.8">pfctl(8)</a> and <a
href="https://man.openbsd.org/pf.4">pf(4)</a> to accept any valid
routing domain, even if it does not yet exist.
<li>Made <a href="https://man.openbsd.org/pfctl.8">pfctl(8)</a>
detect and reject bogus ranges before loading the ruleset to prevent a
panic.
<li>Changed route-to in <a
href="https://man.openbsd.org/pf.conf.5">pf.conf(5)</a> to send
packets to IPs instead of interfaces.
<li>Changed pf_route so <a
href="https://man.openbsd.org/pf.4">pf(4)</a> only runs when packets
enter and leave the stack. Running the same packet through pf multiple
times creates confusion for the state table. By default, pf states are
floating, meaning that packets are matched to states regardless of
which interface they're going over. This diff avoids multiple pf(4)
traversals of one packet causing confusion in the state table.
<li>Prevented the kernel from being stuck in an endless recursion
during TCP path MTU discovery when <a
href="https://man.openbsd.org/pf.4">pf(4)</a> changes the routing
table when sending packets.
<li>When cutting off the head of an overlapping fragment during <a
href="https://man.openbsd.org/pf.4">pf(4)</a> reassembly, reinserted
the fragment into the lookup table with the correct index.
<li>Improved
<a href="https://man.openbsd.org/tftpd.8">tftpd(8)</a> logging to report the reasons
a transfer failed.
</ul>
<li>IPSEC support in the kernel and the <a href="https://man.openbsd.org/iked.8">iked(8)</a> userland daemon:
<ul>
<li>Added support to request IP addresses as IKEv2 initiator to <a
href="https://man.openbsd.org/iked.8">iked(8)</a>. If 'request addr
0.0.0.0' is configured, any address will be accepted.
<li>Make <a href="https://man.openbsd.org/iked.8">iked(8)</a> accept
ANY dynamic address with 'request addr 0.0.0.0'.
<li>Added 'dynamic' keyword to <a
href="https://man.openbsd.org/iked.conf.5">iked.conf(5)</a> to allow
configuration of flows to dynamically assigned addresses.
<li>Added the 'any' keyword to <a
href="https://man.openbsd.org/iked.conf.5">iked.conf(5)</a> for
requests to allow "request address any".
<li>Enabled <a href="https://man.openbsd.org/iked.8">iked(8)</a>
support for ASN1_DN ipsec identifiers.
<li>Implemented <a href="https://man.openbsd.org/iked.8">iked(8)</a>
"from dynamic," installing flows where "dynamic" is replaced by the
received dynamic IP address.
<li>Made sure not to replace 0.0.0.0 with a dynamic address in <a
href="https://man.openbsd.org/iked.8">iked(8)</a> if it is a network
address.
<li>Added <a href="https://man.openbsd.org/iked.8">iked(8)</a> -s
socket option to specify a control socket.
<li>Used a counter instead of random IV for AES-GCM in <a
href="https://man.openbsd.org/iked.8">iked(8)</a>, eliminating the
risk of random collisions.
<li>Added <a href="https://man.openbsd.org/iked.8">iked(8)</a>
support for multiple address pools.
<li>Added the <a href="https://man.openbsd.org/iked.8">iked(8)</a>
"set stickyaddress" option, which attempts to assign the same "config
address" when an IKESA is negotiated with the DSTID of an existing
IKESA.
<li>Ensured rekeying of every child SA in <a
href="https://man.openbsd.org/iked.8">iked(8)</a>.
<li>Added <a href="https://man.openbsd.org/iked.8">iked(8)</a> support
for RSASSA-PSS signature verification (RFC 7427).
<li>Corrected the first packet of an <a
href="https://man.openbsd.org/ipsec.4">ipsec(4)</a> SA to have
sequence number 1.
<li>Accepted reject and blackhole routes for IPsec PMTU discovery.
<li>Prevented leaking of ipsec_hosts in <a
href="https://man.openbsd.org/iked.8">iked(8)</a> when building
hosts_list.
<li>Prevented initiation of new additional SAs for each policy upon
every <a href="https://man.openbsd.org/ikectl.8">ikectl(8)</a> config
reload.
<li>Fixed "any" and "dynamic" keywords for flows in <a
href="https://man.openbsd.org/iked.8">iked(8)</a> and added proper
IPv6 support.
<li>Created a path MTU host route for <a
href="https://man.openbsd.org/ipsec.4">IPsec(4)</a> over IPv6.
<li>Added support for INVALID_KE_PAYLOAD in <a
href="https://man.openbsd.org/iked.8">iked(8)</a> CREATE_CHILD_SA
exchange.
<li>Added support for RSA-PSS PKCS1 signatures to <a
href="https://man.openbsd.org/iked.8">iked(8)</a>.
<li>Fixed path MTU discovery for ESP tunnels in IPv6.
<li>Upgraded to OpenSSL 1.1 compatible crypto API in <a
href="https://man.openbsd.org/iked.8">iked(8)</a>.
<li>Added an optional "group none" transform for child SAs in <a
href="https://man.openbsd.org/iked.8">iked(8)</a> to ensure the
ability to negotiate optional PFS.
<li>Added <a href="https://man.openbsd.org/iked.8">iked(8)</a>
dynamic address configuration for roadwarrior clients, with a new
"iface" config option which can be used to specify an interface for
the virtual addresses received from the peer.
<li>Fixed an <a href="https://man.openbsd.org/iked.8">iked(8)</a>
interop problem with strongswan if make-before-break is enabled.
</ul>
<li>The <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> webserver saw numerous improvements:
<ul>
<li>Prevented a crash due to
<a href="https://man.openbsd.org/httpd.8">httpd(8)</a> listening on port
443 with missing TLS certificates.
<li>Created a new "location (found|notfound)" option for
<a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> to allow
testing for resource path existence.
<li>Fixed detection of duplicate locations in <a
href="https://man.openbsd.org/httpd.8">httpd(8)</a>.
<li>Fixed leak of access and error log filenames on config reload in
<a href="https://man.openbsd.org/httpd.8">httpd(8)</a>.
<li>Avoid leaking the log message in
<a href="https://man.openbsd.org/httpd.8">httpd(8)</a>'s
server_sendlog.
<li>Incorrect order of
<a href="https://man.openbsd.org/close.2">close(2)</a> and
<a href="https://man.openbsd.org/tls_close.3">tls_close(3)</a>
together with a bug in libssl led to leaking memory in
<a href="https://man.openbsd.org/httpd.8">httpd(8)</a>
for each TLS connection.
<li>Fixed the <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>
example configuration not to generate errors when running without TLS
keys already in place.
<li>Optimized disk reads of
<a href="https://man.openbsd.org/httpd.8">httpd(8)</a>
by using st_blocksize as high water mark instead of
the socket buffer size.
<li>Do not compare TLS config params for non-TLS servers.
This allows using <code>listen on * port 80</code> and
<code>listen on * port 443</code> in the same server block in
<a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a>.
</ul>
<li><a
href="https://man.openbsd.org/rpki-client.8">rpki-client(8)</a>
received the following new features and bugfixes:
<ul>
<li>Added RRDP (The RPKI Repository Delta Protocol, RFC 8182) support
as a 'technology preview'. To use it, the "-r" flag needs to be used.
<li>Support the use of more than one URI in the TAL file,
sorting with a preference for https.
<li>Validation of ghostbuster records (RFC 6493).
<li>Fixed checks of the manifest validity interval.
<li>The rsync connection is now killed when the rsync server stalls.
<li>Limited the URL embedded in .cer files to
alphanumeric characters and punctuation.
<li>Added a "-V" option to show version.
<li>Included the default cert.pem file path in tls_load_file error
messages.
</ul>
<li>The <a href="https://man.openbsd.org/dig.1">dig(1)</a> DNS
utility received the following updates:
<ul>
<li>Implemented RFC 8914 Extended DNS Errors for <a
href="https://man.openbsd.org/dig.1">dig(1)</a>.
<li>Fixed <a href="https://man.openbsd.org/dig.1">dig(1)</a> EDNS
Client Subnet option (+subnet=).
<li>Fixed IPv6 link-local address handling for nameservers to talk to
and for address to bind to in <a
href="https://man.openbsd.org/dig.1">dig(1)</a>.
<li>Implemented ZONEMD (RFC 8976) in <a
href="https://man.openbsd.org/dig.1">dig(1)</a> to convey a message
digest of the content of a DNS zone.
</ul>
<li>Changes to <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a>:
<ul>
<li>Fixed incorrect behavior when using <a
href="https://man.openbsd.org/dhclient.conf.5">dhclient.conf(5)</a> to
change the lease renew/rebind/expiry timing.
<li>Allowed the provision of <a
href="https://man.openbsd.org/dhclient.8">dhclient(8)</a> options on
"dhcp" lines in <a
href="https://man.openbsd.org/hostname.if.5">hostname.if(5)</a> files.
<li>Converted all timers from
<a
href="https://man.openbsd.org/time.3">time(3)</a> values
to <a
href="https://man.openbsd.org/clock_gettime.2">clock_gettime(2)</a>
CLOCK_MONOTONIC values.
<li>Removed -L command line option.
<li>Improved debug output.
<li>Improved re-acquisition of a previous address by immediately
accepting any OFFER for the address, rather than waiting for
'select-timeout' to expire.
<li>Exit immediately if the -c option specifies a non-existent file.
<li>Exit immediately if the -i option contains invalid information.
</ul>
<li>Two new daemons, <a
href="https://man.openbsd.org/dhcpleased.8">dhcpleased(8)</a> and <a
href="https://man.openbsd.org/resolvd.8">resolvd(8)</a> were added.
These work alongside with <a
href="https://man.openbsd.org/slaacd.8">slaacd(8)</a> and <a
href="https://man.openbsd.org/unwind.8">unwind(8)</a> to provide a
coherent and simple automatic configuration of network interfaces and
DNS resolution.<br>
The two daemons are not enabled by default for now, but can be tested
by enabling them with <a href="https://man.openbsd.org/rcctl.8">rcctl(8)</a>.
<ul>
<li><a href="https://man.openbsd.org/dhcpleased.8">dhcpleased(8)</a>
implements the DHCP protocol to acquire IPv4 address leases from
servers.
<li><a href="https://man.openbsd.org/resolvd.8">resolvd(8)</a>
manages the content of <a
href="https://man.openbsd.org/resolv.conf.5">resolv.conf(5)</a> based
on nameserver proposals from
<a href="https://man.openbsd.org/dhcpleased.8">dhcpleased(8)</a>,
<a href="https://man.openbsd.org/slaacd.8">slaacd(8)</a>, and
drivers like <a href="https://man.openbsd.org/umb.4">umb(4)</a>.
</ul>
<li>Changes to snmp related tools:
<ul>
<li><a href="https://man.openbsd.org/agentx.3">libagentx(3)</a> moved its
API prefix from subagentx_ to agentx_.
<li><a href="https://man.openbsd.org/agentx.3">agentx_varbind_integer(3)</a>
now accepts an int32_t as per SMI/RFC 2578.
<li><a href="https://man.openbsd.org/agentx.3">agentx_varbind_unsigned32(3)</a>
has been added as an alias for
<a href="https://man.openbsd.org/agentx.3">agentx_varbind_gauge32(3)</a>.
<li><a href="https://man.openbsd.org/snmpd.conf.5">snmpd.conf(5)</a> no
longer accepts the old <code>listen on address [tcp|udp]</code>
syntax. Only the new <code>listen on [tcp|udp] address</code>
syntax is now supported.
<li><a href="https://man.openbsd.org/snmpd.8">snmpd(8)</a> now fully
implements RFC3584 Trapv1 to Trapv2 conversion for the
<code>trap handle</code>.
<li>sysUpTime and snmpTrapOID now respect
<a href="https://man.openbsd.org/snmpd.8">snmpd(8)</a>'s -N flag,
similar to the other values sent by the <code>trap handle</code>.
<li><a href="https://man.openbsd.org/snmpd.conf.5">snmpd.conf(5)</a> now
accepts the <code>read</code>, <code>write</code>, and
<code>notify</code> keywords. This allows for request type
filtering per <code>listen on</code> statement and custom
<code>trap handle</code> ports.
<li><a href="https://man.openbsd.org/snmp.1">snmp(1)</a> now has initial
support for SMI enums. For now only TruthValue is implemented
on ifPromiscuousMode and ifConnectorPresent.
<li><a href="https://man.openbsd.org/snmp.1">snmp(1)</a> now interprets
the "u" data type as unsigned integer.
</ul>
<li>Other userland network changes:
<ul>
<li>Fixed <a href="https://man.openbsd.org/ldapd.8">ldapd(8)</a> cert
and key path inference for absolute paths.
<li>Fixed incorrect cast in a
<a href="https://man.openbsd.org/vsnprintf.3">vsnprintf(3)</a>
error check
in <a href="https://man.openbsd.org/ldapd.8">ldapd(8)</a>.
<li>Applied <a href="https://man.openbsd.org/unveil.2">unveil(2)</a>
to <a href="https://man.openbsd.org/ldapd.8">ldapd(8)</a>.
<li>Changed <a href="https://man.openbsd.org/ping.8">ping(8)</a> to
drain the raw socket of packets received before it is fully set up to
avoid reporting ICMP responses intended for other instances of ping(8)
running in parallel.
<li>Added <a href="https://man.openbsd.org/ping.8">ping(8)</a> -g
option to provide a visual display of packets received and lost.
<li>Changed <a href="https://man.openbsd.org/slaacd.8">slaacd(8)</a>
Duplicate Address Detection (DAD) to only generate a new address if we
are using Semantically Opaque Interface Identifiers.
<li>Handled an autoconf interface changing its rdomain in <a
href="https://man.openbsd.org/slaacd.8">slaacd(8)</a>.
<li>Completed <a
href="https://man.openbsd.org/slaacd.8">slaacd(8)</a> implementation
of RFC 8981 temporary address extensions.
<li>Do not leak the domains listed in
<a href="https://man.openbsd.org/unwind.8">unwind(8)</a>'s
blocklist file on each config reload.
<li>Do not leak duplicate domain nodes when loading the
<a href="https://man.openbsd.org/unwind.8">unwind(8)</a>
config.
<li>Fixed rare crashes of <a
href="https://man.openbsd.org/unwind.8">unwind(8)</a> when DNS answers
are larger than the maximum imsg size.
<li>Implemented <a
href="https://man.openbsd.org/unwind.8">unwind(8)</a> listening on
TCP.
<li>Implemented DNS64 synthesis in <a
href="https://man.openbsd.org/unwind.8">unwind(8)</a>.
<li>Disabled logging to <a
href="https://man.openbsd.org/syslog.3">syslog(3)</a> for libunbound
with <a href="https://man.openbsd.org/unwind.8">unwind(8)</a>. Does
not prevent logging to stderr with "unwind -d".
<li>Added a simple --timeout implementation to <a
href="https://man.openbsd.org/openrsync.1">openrsync(1)</a>.
<li>Added the <a href="https://man.openbsd.org/rsync.1">rsync(1)</a>
option --no-motd to suppress the information output by the client at
the start of a daemon transfer.
<li>Added support for the use of !command to <a
href="https://man.openbsd.org/mygate.5">mygate(5)</a>, so that
netstart has a late opportunity to perform network configuration.
<li>Make <a href="https://man.openbsd.org/rad.8">rad(8)</a> to handle
multiple rdomains in a single daemon (instead of running it in
multiple rdomains).
<li>Added a specific headline to <a
href="https://man.openbsd.org/netstat.1">netstat(1)</a> for TCP state
and IP protocol.
<li>Handle permanent redirects (RFC 7538) in <a
href="https://man.openbsd.org/ftp.1">ftp(1)</a> fetch.
<li>Introduced <a href="https://man.openbsd.org/ftp.1">ftp(1)</a>
support for sending the If-Modified-Since header while fetching over
http or https. Switched to using the timestamps from the remote
server's Last-Modified header if available when saving local files and
introduced the ftp "-u" flag to disable this behavior.
<li>Made <a href="https://man.openbsd.org/ftp.1">ftp(1)</a> set
timestamps only on files.
<li>Added requests for a new certificate without requiring -F when <a
href="https://man.openbsd.org/acme-client.1">acme-client(1)</a>
detects an added or removed SAN in the config file not reflected in
the existing certificate on disk.
<li>Print rewritten addresses in <a
href="https://man.openbsd.org/tcpdump.8">tcpdump(8)</a> logged with <a
href="https://man.openbsd.org/pflog.4">pflog(4)</a> for rdr-to, nat-to
and af-to rules.
<li>When calling <a
href="https://man.openbsd.org/getaddrinfo.3">getaddrinfo(3)</a> with
AI_ADDRCONFIG, consider the routing domain when checking for available
address families. This ensures that name resolution is only performed
for the address families available in the rdomain.
<li>Implemented the <a href="https://man.openbsd.org/nc.1">nc(1)</a>
-D socket debug option in <a
href="https://man.openbsd.org/tcpbench.1">tcpbench(1)</a>, allowing
analysis of TCP connections.
<li>Avoid leaking the help text in
<a href="https://man.openbsd.org/tcpbench.1">systat(8)</a>.
<li>Increased the maximum length for CHAP challenges to 96 octets to
ensure <a href="https://man.openbsd.org/npppd.8">npppd(8)</a> can
handle longer challenges, such as those sent by Juniper.
</ul>
</ul>
<li><a href="https://man.openbsd.org/tmux">tmux(1)</a> improvements and bug fixes:
<ul>
<li>Made <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> synchronize-panes a pane option and added set-option -U flag to unset an option on all panes.
<li>Allowed use of ## and # in <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> styles and added a "w" format modifier for width.
<li>Added a -C flag to <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> run-shell to use a tmux command rather than a shell command.
<li>Added a <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> -N flag to never start the server even if the command would normally do so.
<li>Added the new <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> -S flag to new-window to select the existing window if one with the given name already exists, rather than failing.
<li>Added support for X11 color names and other variations for OSC 10/11 and added OSC 110 and 111 to <a href="https://man.openbsd.org/tmux.1">tmux(1)</a>.
<li>Removed <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> support for popups where the content is provided directly to tmux.
<li>Added a <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> "absolute-centre" alignment to use the center of the total space instead of the available space.
<li>Added <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> split-window -Z to start the pane zoomed.
<li>Added client-detached notification in <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> control mode.
<li>Changed <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> search-again with vi keys to work like <a href="https://man.openbsd.org/vi.1">vi(1)</a>.
</ul>
<li>OpenSMTPD 6.9.0
<ul>
<li>Introduced <a href="https://man.openbsd.org/smtp.1">smtp(1)</a>
-a to perform authentication before sending a message.
<li>Fixed a memory leak in <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> resolver.
<li>Prevented a crash due to premature release of resources by the <a
href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> filter state
machine.
<li>Switch to libtls internally.
<li>Change the way SNI works in <a href="https://man.openbsd.org/smtpd.conf.5#pki~2">smtpd.conf(5)</a>.
TLS listeners may be configured with multiple certificates.
The matching is based on the names included in these certificates.
<li>Allow to specify tls protocols and ciphers per listener and relay action.
</ul>
<li>LibreSSL 3.3.2
<ul>
<li>New Features
<ul>
<li>Support for DTLSv1.2.
<li>Continued rewrite of the record layer for the legacy stack.
<li>Numerous bugs and interoperability issues were fixed in the new verifier.
A few bugs and incompatibilities remain, so this release uses the old
verifier by default.
<li>The OpenSSL 1.1 TLSv1.3 API is not yet available.
</ul>
<li>Portable Improvements
<ul>
<li>Added '--enable-libtls-only' build option, which builds and installs a
statically-linked libtls, skipping libcrypto and libssl. This is useful
for systems that ship with OpenSSL but wish to also package libtls.
<li>Update getentropy on Windows to use Cryptography Next Generation
(CNG). wincrypt is deprecated and no longer works with newer Windows
environments, such as in Windows Store apps.
</ul>
<li>API and Documentation Enhancements
<ul>
<li>Add a number of RPKI OIDs from RFC 6482, 6484, 6493, 8182, 8360,
draft-ietf-sidrops-rpki-rta, and draft-ietf-opsawg-finding-geofeeds.
<li>Add support for
<a href="https://man.openbsd.org/SSL_get_shared_ciphers.3">SSL_get_shared_ciphers(3)</a>
with TLSv1.3.
<li>Add DTLSv1.2 methods.
<li>Implement SSL_is_dtls(3) and use it internally in place of the
SSL_IS_DTLS macro.
<li>Provide
<a href="https://man.openbsd.org/EVP_PKEY_new_CMAC_KEY.3">EVP_PKEY_new_CMAC_KEY(3)</a>.
<li>Add missing prototype for
<a href="https://man.openbsd.org/d2i_DSAPrivateKey_fp.3">d2i_DSAPrivateKey_fp(3)</a>
to x509.h.
<li>Add DTLSv1.2 to
<a href="https://man.openbsd.org/openssl.1">openssl(1)</a>
s_server and s_client protocol message logging.
<li>Provide
<a href="https://man.openbsd.org/SSL_use_certificate_chain_file.3">SSL_use_certificate_chain_file(3)</a>.
<li>Provide
<a href="https://man.openbsd.org/SSL_set_hostflags.3">SSL_set_hostflags(3)</a>
and
<a href="https://man.openbsd.org/SSL_get0_peername.3">SSL_get0_peername(3)</a>.
<li>Provide various DTLSv1.2 specific functions and defines.
<li>Document meaning of '*' in the genrsa output.
<li>Updated documentation for
<a href="https://man.openbsd.org/SSL_get_shared_ciphers.3">SSL_get_shared_ciphers(3)</a>.
<li>Add documentation for
<a href="https://man.openbsd.org/SSL_get_finished.3">SSL_get_finished(3)</a>.
<li>Document
<a href="https://man.openbsd.org/EVP_PKEY_new_CMAC_key.3">EVP_PKEY_new_CMAC_key(3)</a>.
<li>Document
<a href="https://man.openbsd.org/SSL_use_certificate_chain_file.3">SSL_use_certificate_chain_file(3)</a>.
<li>Document
<a href="https://man.openbsd.org/SSL_set_hostflags.3">SSL_set_hostflags(3)</a>
and
<a href="https://man.openbsd.org/SSL_get0_peername.3">SSL_get0_peername(3)</a>.
<li>Update
<a href="https://man.openbsd.org/SSL_get_version.3">SSL_get_version(3)</a>
manual for DTLSv.1.2 support.
<li>Make supported protocols and options for DHE params more prominent
in <a href="https://man.openbsd.org/tls_config_set_protocols.3">tls_config_set_protocols(3)</a>.
<li>Various documentation improvements around TLS methods.
</ul>
<li>Compatibility Changes
<ul>
<li>Make <a href="https://man.openbsd.org/openssl.3">openssl(1)</a> s_server
ignore -4 and -6 for compatibility with OpenSSL.
<li>Set SO_REUSEADDR on the server socket in the
<a href="https://man.openbsd.org/openssl.1">openssl(1)</a> ocsp command.
<li>Send a host header with OCSP queries to make
<a href="https://man.openbsd.org/openssl.1">openssl(1)</a> ocsp
work with some widely used OCSP responders.
<li>Add ability to
<a href="https://man.openbsd.org/ocspcheck.8">ocspcheck(8)</a>
to parse a port in the specified OCSP URL.
<li>Implement auto chain for the TLSv1.3 server since some software
relies on this.
<li>Implement key exporter for TLSv1.3.
<li>Align <a href="https://man.openbsd.org/SSL_get_shared_ciphers.3">SSL_get_shared_ciphers(3)</a>
with OpenSSL. This takes into account that it never returned server
ciphers, so now it will fail when called from the client side.
<li>Sync cert.pem with Mozilla NSS root CAs except "GeoTrust Global CA".
<li>Make
<a href="https://man.openbsd.org/SSL_CTX_get_min_proto_version.3">SSL{_CTX,}_get_{min,max}_proto_version(3)</a>
return a version of zero if the minimum or maximum has been set to
zero to match OpenSSL's behavior.
<li>Add DTLSv1.2 support to
<a href="https://man.openbsd.org/openssl.1">openssl(1)</a> s_client/s_server.
</ul>
<li>Testing and Proactive Security
<ul>
<li>Malformed ASN.1 in a certificate revocation list or a timestamp
response token can lead to a NULL pointer dereference.
<li>Pull in fix for
<a href="https://man.openbsd.org/EVP_CipherUpdate.3">EVP_CipherUpdate(3)</a>
overflow from OpenSSL.
<li>Use EXFLAG_INVALID to handle out of memory and parse errors in
x509v3_cache_extensions().
<li>Refactor and clean up
<a href="https://man.openbsd.org/ocspcheck.8">ocspcheck(8)</a>
and add regression tests.
</ul>
<li>Internal Improvements
<ul>
<li>Further cleanup of the DTLS record handling.
<li>Continue the replacement of the TLSv1.2 record layer by
reimplementing the read side of the TLSv1.2 record handling.
<li>Replace DTLSv1_enc_data() with TLSv1_1_enc_data().
<li>Merge d1_{clnt,srvr}.c into ssl_{clnt,srvr}.c.
<li>Add const to ssl_ciphers and tls1[23]_sigalgs* to push them into
.data.rel.ro and .rodata, respectively.
<li>Add a const qualifier to srtp_known_profiles.
<li>Simplify TLS method by removing the client and server specific
methods internally.
<li>Avoid casting away const in ssl_ctx_make_profiles().
<li>Avoid explicitly conditioning an assert on DTLS1_VERSION to make
the assert work for newer DTLS versions.
<li>Merge SSL_ENC_METHOD into SSL_METHOD_INTERNAL.
<li>Add a flag to mark DTLS methods as DTLS to have an easy way to
recognize DTLS methods that avoids inspecting the version number.
<li>Mark a few more internal static tables const.
<li>Switch finish{,_peer}_md_len from an int to a size_t.
<li>Use EVP_MD_MAX_MD_SIZE instead of 2 * EVP_MD_MAX_MD_SIZE as size
for cert_verify_md[], finish_md[] and peer_finish_md[]. The factor 2
was a historical artefact.
<li>Free struct members in tls13_record_layer_free() in their natural
order for reviewability.
<li>Use consistent names in tls13_{client,server}_finished_{recv,send}().
<li>Add tls13_secret_{init,cleanup}() and use them throughout the
TLSv1.3 code base.
<li>Move the read MAC key into the TLSv1.2 record layer.
<li>Make tls12_record_layer_free() NULL safe.
<li>Split the record protection from the TLSv1.2 record layer.
<li>Clean up sequence number handling in the new TLSv1.2 record layer.
<li>Clean up sequence number handling in DTLS.
<li>Clean up dtls1_reset_seq_numbers().
<li>Factor out code for explicit IV length, block size and MAC length
from tls12_record_layer_open_record_protected_cipher().
<li>Provide record layer overhead for DTLS.
<li>Provide functions to determine if TLSv1.2 record protection is
engaged.
<li>Add code to handle change of cipher state in the new TLSv1.2 record
layer.
<li>Mop up now unused dtls1_build_sequence_numbers() function.
<li>Allow setting a keypair on a tls context without specifying the
private key, and fake it internally in libtls. This removes the
need for privsep engines like relayd to use bogus keys.
<li>Skip the private key check for fake private keys.
<li>Move the private key setup from tls_configure_ssl_keypair() to a
helper function with proper error checking.
<li>Change the internal tls_configure_ssl_keypair() function to
return -1 instead of 1 on failure.
<li>Move sequence numbers into the new TLSv1.2 record layer.
<li>Move AEAD handling into the new TLSv1.2 record layer.
<li>Factor out legacy stack version checks.
<li>Correct handshake MAC/PRF for various TLSv1.2 cipher suites which
were originally added with the default handshake MAC and PRF rather
than the SHA256 handshake MAC and PRF.
<li>Absorb ssl3_get_algorithm2() into ssl_get_handshake_evp_md().
<li>Use dtls1_record_retrieve_buffered_record() to load buffered
application data.
<li>Enforce read ahead with DTLS.
<li>Remove bogus DTLS checks that disabled ECC and OCSP.
<li>Clean up and simplify dtls1_get_cipher().
<li>Group HelloVerifyRequest decoding and add missing check for trailing
data.
<li>Revise HelloVerifyRequest handling for DTLSv1.2.
<li>Handle DTLS1_2_VERSION in various places.
<li>Rename the "truncated" label into "decode_err" and the "f_err"
label into "fatal_err".
<li>Factor out and change some of the legacy client version code.
<li>Simplify version checks in the TLSv1.3 client. Ensure that the
server announced TLSv1.3 and nothing higher and check that the
legacy_version is set to TLSv1.2 as required by RFC 8446.
<li>Only use TLS versions internally rather than both TLS and DTLS
versions since the latter are the one's complement of the human
readable version numbers, which means that newer versions decrease
in value.
<li>Identify DTLS based on the version major value.
<li>Move handling of cipher/hash based cipher suites into the new record
layer.
<li>Add tls12_record_protection_unused() and call it from CCS functions.
<li>Move key/IV length checks closer to usage sites. Also add explicit
checks against
<a href="https://man.openbsd.org/EVP_CIPHER_iv_length.3">EVP_CIPHER_{iv,key}_length()</a>.
<li>Replace two handrolled tls12_record_protection_engaged().
<li>Improve internal version handling: add handshake fields for our
minimum version, our maximum version and the TLS version negotiated
during the handshake. Convert most of the internal code to use these
version fields.
<li>Guard against future internal use of TLS1_get_{client,}_version()
macros.
<li>Remove the internal ssl_downgrade_max_version() function which is no
longer needed.
<li>Add support for DTLSv1.2 version handling.
<li>Remove no longer needed read ahead workarounds in the s_client and
s_server.
<li>Split TLSv1.3 record protection from record layer.
<li>Move the TLSv1.3 handshake struct inside the shared handshake
struct.
<li>Fully initialize rrec in tls12_record_layer_open_record_protected()
to avoid confusing some static analyzers.
<li>Use tls_set_errorx() on OCSP_basic_verify() failure since the latter
does not set errno.
<li>Convert openssl(1) x509 to new option handling and do the usual
clean up that goes along with it.
<li>Add SSL_HANDSHAKE_TLS12 for TLSv1.2 specific handshake data.
<li>Rename new_cipher to cipher to align naming with keyblock or other
parts of the handshake data.
<li>Move the TLSv1.2 record number increment into the new record layer.
<li>Move finished and peer finished into the handshake struct.
<li>Remove pointless assignment in SSL_get0_alpn_selected().
<li>Add some error checking to openssl(1) x509.
</ul>
<li>Bug Fixes
<ul>
<li>Move point-on-curve check to set_affine_coordinates to avoid
verifying ECDSA signatures with unchecked public keys.
<li>Fix
<a href="https://man.openbsd.org/SSL_is_server.3">SSL_is_server(3)</a>
to behave as documented by re-introducing the client-specific
methods.
<li>Avoid undefined behavior due to memcpy(NULL, NULL, 0).
<li>Make SSL_get{,_peer}_finished() work when used with TLSv1.3.
<li>Correct the return value type from ERR_peek_error() to a long.
<li>Avoid use of uninitialized in ASN1_time_parse() which could happen
on parsing UTCTime if the caller did not initialize the passed
struct tm.
<li>Destroy the mutex in a tls_config object on tls_config_free().
<li>Free alert_data and phh_data in tls13_record_layer_free().
These could leak if
<a href="https://man.openbsd.org/SSL_shutdown.3">SSL_shutdown(3)</a>
or <a href="https://man.openbsd.org/tls_close.3">tls_close(3)</a>
were called after closing the underlying socket().
<li>Gracefully handle root certificates being both trusted and
untrusted.
<li>Handle X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE in the new
verifier.
<li>Use the legacy verifier when building auto chains for TLS.
<li>Search the intermediates only after searching the root certs in the
new verifier to avoid problems with the legacy callback.
<li>Bail out early after finding a single chain in the new verifier, if
we have been called via the legacy verifier API.
<li>Set (invalid and likely incomplete) chain on the xsc on chain build
failure prior to calling the callback. This is required by various
callers, including auto chain.
<li>Remove direct assignment of aead_ctx to avoid a leak.
<li>Fail early in legacy exporter if the master secret is not available
to avoid a segfault if it is called when the handshake is not
completed.
<li>Only print the certificate file once on verification failure.
<li>Fix an off-by-one in x509_verify_set_xsc_chain() to make sure that
the new validator checks for EXFLAG_CRITICAL in
x509_vfy_check_chain_extension() for all untrusted certs in the
chain. Take into account that the root is not necessarily trusted.
<li>Avoid passing last and depth to x509_verify_cert_error() on ENOMEM.
<li>Fix two bugs in the legacy verifier that resulted from refactoring
of
<a href="https://man.openbsd.org/X509_verify_cert.3">X509_verify_cert(3)</a>
for the new verifier: a return value was incorrectly treated as
boolean, making it insufficient to decide whether validation should
carry on or not.
<li>Fix checks for memory caps of constraints names. There are internal
caps on the number of name constraints and other names, that the new
name constraints code allocates per cert chain. These limits were
checked too late, making them only partially effective.
<li>Fix a copy-paste error - skid was confused with an akid when
checking for EXFLAG_INVALID. This broke OCSP validation with
certain mirrors.
<li>Avoid a use-after-scope in tls13_cert_add().
<li>Avoid mangled output in BIO_debug_callback().
<li>Fix client initiated renegotiation by replacing use of s->internal-type
with s->server.
<li>Avoid transcript initialization when sending a TLS HelloRequest,
fixing server initiated renegotiation.
<li>Avoid leaking param->name in x509_verify_param_zero().
<li>Avoid a leak in an error path in openssl(1) x509.
<li>When sending an alert in TLSv1.3, only set its error code when no
other error was set previously. Certain clients rely on specific
SSL_R_ error codes to identify that they are dealing with a self
signed cert.
<li>When switching from the TLSv1.3 stack to the legacy stack include
a TLS record header. This is necessary if there is more than one
handshake message in the TLS plaintext record.
<li>Fix resource handling on error in OCSP_request_add0_id().
<li>Make sure there is enough room for stashing the handshake message
when switching to the legacy TLS stack.
<li>Fix a memory leak in the openssl(1) s_client.
<li>Unbreak DTLS retransmissions for flights that include a CCS.
<li>If x509_verify() fails, ensure that the error is set on both
the x509_verify_ctx() and its store context to make some failures
visible from SSL_get_verify_result().
<li>Use the X509_STORE_CTX get_issuer() callback from the new X.509
verifier to fix hashed certificate directories.
<li>Only check
<a href="https://man.openbsd.org/BIO_should_read.3">BIO_should_read(3)</a>
on read and
<a href="https://man.openbsd.org/BIO_should_write.3">BIO_should_write(3)</a>
on write. Previously,
<a href="https://man.openbsd.org/BIO_should_write.3">BIO_should_write(3)</a>
was also checked after read and
<a href="https://man.openbsd.org/BIO_should_read.3">BIO_should_read(3)</a>
after write which could cause stalls in software that uses the same
BIO for read and write.
<li>In <a href="https://man.openbsd.org/openssl.1">openssl(1)</a>
verify, also check for error on the store context since the return
value of
<a href="https://man.openbsd.org/X509_verify_cert.3">X509_verify_cert(3)</a>
is unreliable in presence of a callback that returns 1 too often.
<li>Handle additional certificate error cases in the new X.509 verifier.
Keep track of the errors encountered if a verify callback tells the
verifier to continue and report them back via the error on the store
context. This mimics the behavior of the old verifier that would
persist the first error encountered while building the chain.
<li>Report specific failures for "self signed certificates" in a way
compatible with the old verifier since software relies on the
error code.
<li>Plug a large memory leak in the new verifier caused by calling
X509_policy_check(3) repeatedly.
<li>Avoid leaking memory in x509_verify_chain_dup().
</ul>
</ul>
<li>OpenSSH 8.5
<ul>
<li>Security fixes
<ul>
<li><a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>:
fixed a double-free memory corruption that was introduced in OpenSSH
8.2 . We treat all such memory faults as potentially exploitable. This
bug could be reached by an attacker with access to the agent socket.<br>
On modern operating systems where the OS can provide information
about the user identity connected to a socket, OpenSSH ssh-agent and
sshd limit agent socket access only to the originating user and root.
Additional mitigation may be afforded by the system's
malloc(3)/free(3) implementation, if it detects double-free
conditions.<br>
The most likely scenario for exploitation is a user forwarding an
agent either to an account shared with a malicious user or to a host
with an attacker holding root access.
</ul>
<li>Potentially incompatible changes
<ul>
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
href="https://man.openbsd.org/sshd.8">sshd(8)</a>: this release
changes the first-preference signature algorithm from ECDSA to
ED25519.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
href="https://man.openbsd.org/sshd.8">sshd(8)</a>: set the TOS/DSCP
specified in the configuration for interactive use prior to TCP
connect. The connection phase of the SSH session is time-sensitive and
often explicitly interactive. The ultimate interactive/bulk TOS/DSCP
will be set after authentication completes.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
href="https://man.openbsd.org/sshd.8">sshd(8)</a>: remove the
pre-standardization cipher rijndael-cbc@lysator.liu.se. It is an alias
for aes256-cbc before it was standardized in RFC4253 (2006), has been
deprecated and disabled by default since OpenSSH 7.2 (2016) and was
only briefly documented in ssh.1 in 2001.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
href="https://man.openbsd.org/sshd.8">sshd(8)</a>: update/replace the
experimental post-quantum hybrid key exchange method based on
Streamlined NTRU Prime coupled with X25519.<br>
The previous sntrup4591761x25519-sha512@tinyssh.org method is
replaced with sntrup761x25519-sha512@openssh.com. Per its designers,
the sntrup4591761 algorithm was superseded almost two years ago by
sntrup761.
(Note that both the updated method and the one that it replaced are
disabled by default.)
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: disable
CheckHostIP by default. It provides insignificant benefits while
making key rotation significantly more difficult, especially for hosts
behind IP-based load-balancers.
</ul>
<li>New Features
<ul>
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: this release
enables UpdateHostkeys by default subject to some conservative
preconditions:
<ul>
<li>The key was matched in the UserKnownHostsFile (and not in the
GlobalKnownHostsFile).
<li>The same key does not exist under another name.
<li>A certificate host key is not in use.
<li>known_hosts contains no matching wildcard hostname pattern.
<li>VerifyHostKeyDNS is not enabled.
<li>The default UserKnownHostsFile is in use.
</ul>
We expect some of these conditions will be modified or relaxed in
future.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
href="https://man.openbsd.org/sshd.8">sshd(8)</a>: add a new
LogVerbose configuration directive for that allows forcing maximum
debug logging by file/function/line pattern-lists.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: when
prompting the user to accept a new hostkey, display any other host
names/addresses already associated with the key.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: allow
UserKnownHostsFile=none to indicate that no known_hosts file should be
used to identify host keys.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: add a
ssh_config KnownHostsCommand option that allows the client to obtain
known_hosts data from a command in addition to the usual files.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: add a
ssh_config PermitRemoteOpen option that allows the client to restrict
the destination when RemoteForward is used with SOCKS.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: for FIDO
keys, if a signature operation fails with a "incorrect PIN" reason and
no PIN was initially requested from the user, then request a PIN and
retry the operation. This supports some biometric devices that fall
back to requiring PIN when reading of the biometric failed, and
devices that require PINs for all hosted credentials.
<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>: implement
client address-based rate-limiting via new <a
href="https://man.openbsd.org/sshd_config.5">sshd_config(5)</a>
PerSourceMaxStartups and PerSourceNetBlockSize directives that provide
more fine-grained control on a per-origin address basis than the
global MaxStartups limit.
</ul>
<li>Bugfixes
<ul>
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: Prefix
keyboard interactive prompts with "(user@host)" to make it easier to
determine which connection they are associated with in cases like scp
-3, ProxyJump, etc. bz#3224
<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>: fix
sshd_config SetEnv directives located inside Match blocks. GHPR#201
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: when
requesting a FIDO token touch on stderr, inform the user once the
touch has been recorded.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: prevent
integer overflow when ridiculously large ConnectTimeout values are
specified, capping the effective value (for most platforms) at 24
days. bz#3229
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: consider the
ECDSA key subtype when ordering host key algorithms in the client.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
href="https://man.openbsd.org/sshd.8">sshd(8)</a>: rename the
PubkeyAcceptedKeyTypes keyword to PubkeyAcceptedAlgorithms. The
previous name incorrectly suggested that it control allowed key
algorithms, when this option actually specifies the signature
algorithms that are accepted. The previous name remains available as
an alias. bz#3253
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
href="https://man.openbsd.org/sshd.8">sshd(8)</a>: similarly, rename
HostbasedKeyTypes (ssh) and HostbasedAcceptedKeyTypes (sshd) to
HostbasedAcceptedAlgorithms.
<li><a
href="https://man.openbsd.org/sftp-server.8">sftp-server(8)</a>: add
missing lsetstat@openssh.com documentation and advertisement in the
server's SSH2_FXP_VERSION hello packet.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
href="https://man.openbsd.org/sshd.8">sshd(8)</a>: more strictly
enforce KEX state-machine by banning packet types once they are
received. Fixes memleak caused by duplicate
SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).
<li><a href="https://man.openbsd.org/sftp.1">sftp(1)</a>: allow the
full range of UIDs/GIDs for chown/chgrp on 32bit platforms instead of
being limited by LONG_MAX. bz#3206
<li>Minor man page fixes (capitalization, commas, etc.) bz#3223
<li><a href="https://man.openbsd.org/sftp.1">sftp(1)</a>: when doing
an sftp recursive upload or download of a read-only directory, ensure
that the directory is created with write and execute permissions in
the interim so that the transfer can actually complete, then set the
directory permission as the final step. bz#3222
<li><a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:
document the -Z, check the validity of its argument earlier and
provide a better error message if it's not correct. bz#2879
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: ignore
comments at the end of config lines in ssh_config, similar to what we
already do for sshd_config. bz#2320
<li><a
href="https://man.openbsd.org/sshd_config.5">sshd_config(5)</a>:
mention that DisableForwarding is valid in a sshd_config Match block.
bz3239
<li><a href="https://man.openbsd.org/sftp.1">sftp(1)</a>: fix
incorrect sorting of "ls -ltr" under some circumstances. bz3248.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>, <a
href="https://man.openbsd.org/sshd.8">sshd(8)</a>: fix potential
integer truncation of (unlikely) timeout values. bz#3250
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>: make
hostbased authentication send the signature algorithm in its
SSH2_MSG_USERAUTH_REQUEST packets instead of the key type. This makes
HostbasedAcceptedAlgorithms do what it is supposed to - filter on
signature algorithm and not key type.
</ul>
</ul>
<li>Ports and packages:
<p>Many pre-built packages for each architecture:
<!-- number of FTP packages minus SHA256, SHA256.sig, index.txt -->
<ul style="column-count: 3">
<li>aarch64: 10943
<li>amd64: 11310
<li>arm: 8691
<li>i386: 10468
<li>mips64: 8182
<li>mips64el: 7493
<li>powerpc: 9475
<li>powerpc64: 9341
<li>sparc64: 9642
</ul>
<p>Some highlights:
<ul style="column-count: 3">
<li>Asterisk 18.3.0
<li>Audacity 2.4.2
<li>CMake 3.19.4
<li>Chromium 90.0.4430.72
<li>Emacs 27.2
<li>FFmpeg 4.3.2
<li>GCC 8.4.0
<li>GHC 8.10.3
<li>GNOME 3.38
<li>Go 1.16.2
<li>JDK 8u282 and 11.0.10
<li>KDE Applications 20.12.3
<li>KDE Frameworks 5.80.0
<li>Krita 4.4.3
<li>LLVM/Clang 10.0.1
<li>LibreOffice 7.0.5.2
<li>Lua 5.1.5, 5.2.4 and 5.3.6
<li>MariaDB 10.5.9
<li>Mono 6.12.0.122
<li>Mozilla Firefox 88.0 and ESR 78.10.0
<li>Mozilla Thunderbird 78.10.0
<li>Mutt 2.0.6 and NeoMutt 20210205
<li>Node.js 12.16.1
<li>OCaml 4.10.0
<li>OpenLDAP 2.4.58
<li>PHP 7.2.34, 7.3.27, 7.4.16 and 8.0.3
<li>Postfix 3.5.10
<li>PostgreSQL 13.2
<li>Python 2.7.18, 3.8.8 and 3.9.2
<li>Qt 5.15.2
<li>R 4.0.5
<li>Ruby 2.6.7, 2.7.3 and 3.0.1
<li>Rust 1.51.0
<li>SQLite 3.34.1
<li>Shotcut 21.01.29
<li>Sudo 1.9.6p1
<li>Suricata 6.0.1
<li>Tcl/Tk 8.5.19 and 8.6.8
<li>TeX Live 2020
<li>Vim 8.2.2580 and Neovim 0.4.4
<li>Xfce 4.16
</ul>
<p>
<li>As usual, steady improvements in manual pages and other documentation.
<li>The system includes the following major components from outside suppliers:
<ul>
<li>Xenocara (based on X.Org 7.7 with xserver 1.20.10 + patches,
freetype 2.10.4, fontconfig 2.12.4, Mesa 20.0.8, xterm 367,
xkeyboard-config 2.20, fonttosfnt 1.2.1 and more)
<li>LLVM/Clang 10.0.1 (+ patches)
<li>GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
<li>Perl 5.32.1 (+ patches)
<li>NSD 4.3.6
<li>Unbound 1.13.1
<li>Ncurses 5.7
<li>Binutils 2.17 (+ patches)
<li>Gdb 6.3 (+ patches)
<li>Awk December 18, 2020 version
<li>Expat 2.2.10
</ul>
</ul>
</section>
<hr>
<section id=install>
<h3>How to install</h3>
<p>
Please refer to the following files on the mirror site for
extensive details on how to install OpenBSD 6.9 on your machine:
<ul>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/alpha/INSTALL.alpha">
.../OpenBSD/6.9/alpha/INSTALL.alpha</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/amd64/INSTALL.amd64">
.../OpenBSD/6.9/amd64/INSTALL.amd64</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/arm64/INSTALL.arm64">
.../OpenBSD/6.9/arm64/INSTALL.arm64</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/armv7/INSTALL.armv7">
.../OpenBSD/6.9/armv7/INSTALL.armv7</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/hppa/INSTALL.hppa">
.../OpenBSD/6.9/hppa/INSTALL.hppa</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/i386/INSTALL.i386">
.../OpenBSD/6.9/i386/INSTALL.i386</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/landisk/INSTALL.landisk">
.../OpenBSD/6.9/landisk/INSTALL.landisk</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/loongson/INSTALL.loongson">
.../OpenBSD/6.9/loongson/INSTALL.loongson</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/luna88k/INSTALL.luna88k">
.../OpenBSD/6.9/luna88k/INSTALL.luna88k</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/macppc/INSTALL.macppc">
.../OpenBSD/6.9/macppc/INSTALL.macppc</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/octeon/INSTALL.octeon">
.../OpenBSD/6.9/octeon/INSTALL.octeon</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/powerpc64/INSTALL.powerpc64">
.../OpenBSD/6.9/powerpc64/INSTALL.powerpc64</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/sgi/INSTALL.sgi">
.../OpenBSD/6.9/sgi/INSTALL.sgi</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/6.9/sparc64/INSTALL.sparc64">
.../OpenBSD/6.9/sparc64/INSTALL.sparc64</a>
</ul>
</section>
<hr>
<section id=quickinstall>
<p>
Quick installer information for people familiar with OpenBSD, and the use of
the "<a href="https://man.openbsd.org/disklabel.8">disklabel</a> -E" command.
If you are at all confused when installing OpenBSD, read the relevant
INSTALL.* file as listed above!
<h3>OpenBSD/alpha:</h3>
<p>
If your machine can boot from CD, you can write <i>install69.iso</i> or
<i>cd69.iso</i> to a CD and boot from it.
Refer to INSTALL.alpha for more details.
<h3>OpenBSD/amd64:</h3>
<p>
If your machine can boot from CD, you can write <i>install69.iso</i> or
<i>cd69.iso</i> to a CD and boot from it.
You may need to adjust your BIOS options first.
<p>
If your machine can boot from USB, you can write <i>install69.img</i> or
<i>miniroot69.img</i> to a USB stick and boot from it.
<p>
If you can't boot from a CD, floppy disk, or USB,
you can install across the network using PXE as described in the included
INSTALL.amd64 document.
<p>
If you are planning to dual boot OpenBSD with another OS, you will need to
read INSTALL.amd64.
<h3>OpenBSD/arm64:</h3>
<p>
Write <i>install69.img</i> or <i>miniroot69.img</i> to a disk and boot from it
after connecting to the serial console. Refer to INSTALL.arm64 for more
details.
<h3>OpenBSD/armv7:</h3>
<p>
Write a system specific miniroot to an SD card and boot from it after connecting
to the serial console. Refer to INSTALL.armv7 for more details.
<h3>OpenBSD/hppa:</h3>
<p>
Boot over the network by following the instructions in INSTALL.hppa or the
<a href="hppa.html#install">hppa platform page</a>.
<h3>OpenBSD/i386:</h3>
<p>
If your machine can boot from CD, you can write <i>install69.iso</i> or
<i>cd69.iso</i> to a CD and boot from it.
You may need to adjust your BIOS options first.
<p>
If your machine can boot from USB, you can write <i>install69.img</i> or
<i>miniroot69.img</i> to a USB stick and boot from it.
<p>
If you can't boot from a CD, floppy disk, or USB,
you can install across the network using PXE as described in
the included INSTALL.i386 document.
<p>
If you are planning on dual booting OpenBSD with another OS, you will need to
read INSTALL.i386.
<h3>OpenBSD/landisk:</h3>
<p>
Write <i>miniroot69.img</i> to the start of the CF
or disk, and boot normally.
<h3>OpenBSD/loongson:</h3>
<p>
Write <i>miniroot69.img</i> to a USB stick and boot bsd.rd from it
or boot bsd.rd via tftp.
Refer to the instructions in INSTALL.loongson for more details.
<h3>OpenBSD/luna88k:</h3>
<p>
Copy 'boot' and 'bsd.rd' to a Mach or UniOS partition, and boot the bootloader
from the PROM, and then bsd.rd from the bootloader.
Refer to the instructions in INSTALL.luna88k for more details.
<h3>OpenBSD/macppc:</h3>
<p>
Burn the image from a mirror site to a CDROM, and power on your machine
while holding down the <i>C</i> key until the display turns on and
shows <i>OpenBSD/macppc boot</i>.
<p>
Alternatively, at the Open Firmware prompt, enter <i>boot cd:,ofwboot
/6.9/macppc/bsd.rd</i>
<h3>OpenBSD/octeon:</h3>
<p>
After connecting a serial port, boot bsd.rd over the network via DHCP/tftp.
Refer to the instructions in INSTALL.octeon for more details.
<h3>OpenBSD/powerpc64:</h3>
<p>
To install, write <i>install69.img</i> or <i>miniroot69.img</i> to a
USB stick, plug it into the machine and choose the <i>OpenBSD
install</i> menu item in Petitboot.
Refer to the instructions in INSTALL.powerpc64 for more details.
<h3>OpenBSD/sgi:</h3>
<p>
To install, burn cd69.iso on a CD-R, put it in the CD drive of your
machine and select <i>Install System Software</i> from the System Maintenance
menu. Indigo/Indy/Indigo2 (R4000) systems will not boot automatically from
CD-ROM, and need a proper invocation from the PROM prompt.
Refer to the instructions in INSTALL.sgi for more details.
<p>
If your machine doesn't have a CD drive, you can setup a DHCP/tftp network
server, and boot using "bootp()/bsd.rd.IP##" using the kernel matching your
system type. Refer to the instructions in INSTALL.sgi for more details.
<h3>OpenBSD/sparc64:</h3>
<p>
Burn the image from a mirror site to a CDROM, boot from it, and type
<i>boot cdrom</i>.
<p>
If this doesn't work, or if you don't have a CDROM drive, you can write
<i>floppy69.img</i> or <i>floppyB69.img</i>
(depending on your machine) to a floppy and boot it with <i>boot
floppy</i>. Refer to INSTALL.sparc64 for details.
<p>
Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install
will most likely fail.
<p>
You can also write <i>miniroot69.img</i> to the swap partition on
the disk and boot with <i>boot disk:b</i>.
<p>
If nothing works, you can boot over the network as described in INSTALL.sparc64.
</section>
<hr>
<section id=upgrade>
<h3>How to upgrade</h3>
<p>
If you already have an OpenBSD 6.8 system, and do not want to reinstall,
upgrade instructions and advice can be found in the
<a href="faq/upgrade69.html">Upgrade Guide</a>.
</section>
<hr>
<section id=sourcecode>
<h3>Notes about the source code</h3>
<p>
<code>src.tar.gz</code> contains a source archive starting at <code>/usr/src</code>.
This file contains everything you need except for the kernel sources,
which are in a separate archive.
To extract:
<blockquote><pre>
# <kbd>mkdir -p /usr/src</kbd>
# <kbd>cd /usr/src</kbd>
# <kbd>tar xvfz /tmp/src.tar.gz</kbd>
</pre></blockquote>
<p>
<code>sys.tar.gz</code> contains a source archive starting at <code>/usr/src/sys</code>.
This file contains all the kernel sources you need to rebuild kernels.
To extract:
<blockquote><pre>
# <kbd>mkdir -p /usr/src/sys</kbd>
# <kbd>cd /usr/src</kbd>
# <kbd>tar xvfz /tmp/sys.tar.gz</kbd>
</pre></blockquote>
<p>
Both of these trees are a regular CVS checkout. Using these trees it
is possible to get a head-start on using the anoncvs servers as
described <a href="anoncvs.html">here</a>.
Using these files
results in a much faster initial CVS update than you could expect from
a fresh checkout of the full OpenBSD source tree.
</section>
<hr>
<section id=ports>
<h3>Ports Tree</h3>
<p>
A ports tree archive is also provided. To extract:
<blockquote><pre>
# <kbd>cd /usr</kbd>
# <kbd>tar xvfz /tmp/ports.tar.gz</kbd>
</pre></blockquote>
<p>
Go read the <a href="faq/ports/index.html">ports</a> page
if you know nothing about ports
at this point. This text is not a manual of how to use ports.
Rather, it is a set of notes meant to kickstart the user on the
OpenBSD ports system.
<p>
The <i>ports/</i> directory represents a CVS checkout of our ports.
As with our complete source tree, our ports tree is available via
<a href="anoncvs.html">AnonCVS</a>.
So, in order to keep up to date with the -stable branch, you must make
the <i>ports/</i> tree available on a read-write medium and update the tree
with a command like:
<blockquote><pre>
# <kbd>cd /usr/ports</kbd>
# <kbd>cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_6_9</kbd>
</pre></blockquote>
<p>
[Of course, you must replace the server name here with a nearby anoncvs
server.]
<p>
Note that most ports are available as packages on our mirrors. Updated
ports for the 6.9 release will be made available if problems arise.
<p>
If you're interested in seeing a port added, would like to help out, or just
would like to know more, the mailing list
<a href="mail.html">ports@openbsd.org</a> is a good place to know.
</section>
![[BACK]](/icons/back.gif){kind=icon}
Return to 69.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www