=================================================================== RCS file: /cvsrepo/anoncvs/cvs/www/73.html,v retrieving revision 1.45 retrieving revision 1.46 diff -c -r1.45 -r1.46 *** www/73.html 2023/04/07 01:08:06 1.45 --- www/73.html 2023/04/07 06:58:29 1.46 *************** *** 180,190 ****
  • Various bugfixes and tweaks in userland: --- 259,265 ---- href="https://man.openbsd.org/lastcomm.1">lastcomm(1) reporting for process kills due to execve(2) from non-pinned ! syscall address.
  • Various bugfixes and tweaks in userland: *************** *** 336,342 ****
  • Extended disklabel(8) template parsing to allow "[mount point] *" as the specification for putting ! the maximum available free space into a partition, and extended command line parsing to allow "T-" as the specification to read the template from stdin.
  • Repaired Extended disklabel(8) template parsing to allow "[mount point] *" as the specification for putting ! the maximum available free space into a partition. Extended command line parsing to allow "T-" as the specification to read the template from stdin.
  • Repaired
  • Made aplhidev(4) recognize M1 ! laptops with touchbars and Translated Fn+(1-10,-,=) keys to F1-F12 on these systems.
  • Added suspend/resume support to aplns(4). --- 462,468 ----
  • Made aplhidev(4) recognize M1 ! laptops with touchbars and translated Fn+(1-10,-,=) keys to F1-F12 on these systems.
  • Added suspend/resume support to aplns(4). *************** *** 701,714 **** softraid(4) chunks.
  • Made efiboot fdt support device trees with NOPs in them (like the kernel version).
  • Improved the default choice for the installer's install media ! disk question to show the first disk (a) not the root disk and (b) not ! a disk with softraid chunks (hosting the root disk, for example).
  • Stopped offering WEP in the installer if not supported.
  • Fixed lock file error on installer exit/abort.
  • Made installboot(8) -p support softraid(4).
  • Made installboot(8) silently skip ! softraid(4). keydisks.
  • Fixed passing explicit stages files to installboot(8). --- 701,714 ---- softraid(4) chunks.
  • Made efiboot fdt support device trees with NOPs in them (like the kernel version).
  • Improved the default choice for the installer's install media ! disk question to show the first disk that (a) is not the root disk and (b) ! is not a disk with softraid chunks (hosting the root disk, for example).
  • Stopped offering WEP in the installer if not supported.
  • Fixed lock file error on installer exit/abort.
  • Made installboot(8) -p support softraid(4).
  • Made installboot(8) silently skip ! softraid(4) keydisks.
  • Fixed passing explicit stages files to installboot(8). *************** *** 734,740 **** makes sense for the bootloader to control it.
  • Added "machine poweroff" command on luna88k bootloader.
  • Switched alpha to machine-independent boot blocks. !
  • Switched all architectures (except alpha and luna88k) ramdisks to use installboot(8) -p.
  • Fixed ofwboot OpenFirmware map call to unbreak boot on some machines.
  • Reduced ofwboot.net size after libz update to unbreak netboot on some machines. --- 734,740 ---- makes sense for the bootloader to control it.
  • Added "machine poweroff" command on luna88k bootloader.
  • Switched alpha to machine-independent boot blocks. !
  • Switched all architectures' ramdisks (except alpha's and luna88k's) to use installboot(8) -p.
  • Fixed ofwboot OpenFirmware map call to unbreak boot on some machines.
  • Reduced ofwboot.net size after libz update to unbreak netboot on some machines. *************** *** 747,753 ****
  • Security improvements:
  • Updated zlib to 1.2.13. *************** *** 1020,1029 **** href="https://man.openbsd.org/resolvd.8">resolvd(8).
  • Restrict the characters allowed in the hostname argument of getaddrinfo(3) to the ! set [A-z0-9-_.]. Additionally two consecutive dots ('.') are not allowed nor can the string start with - or '.'. This removes characters like '$', '`', '\n' or '*' that can traverse the DNS ! without problems, but have special meaning, for example a shell.
  • Fixed a number of out of bounds reads in DNS response parsing of the async DNS resolver in libc.
  • Added resolvd(8).
  • Restrict the characters allowed in the hostname argument of getaddrinfo(3) to the ! set [A-z0-9-_.]. Additionally, two consecutive dots ('.') are not allowed nor can the string start with - or '.'. This removes characters like '$', '`', '\n' or '*' that can traverse the DNS ! without problems but have special meaning as in a shell.
  • Fixed a number of out of bounds reads in DNS response parsing of the async DNS resolver in libc.
  • Added ifconfig(8) to when either a wireguard interface is specified or the flag "-A" is used.
  • Implemented the RFC 8781 PREF64 router advertisement option in ! rad(8) which is used to o communicate NAT64 prefixes to hosts.
  • Moved the documentation of flag mappings displayed by "route show" from the netstat(1) manpage to ifconfig(8) to when either a wireguard interface is specified or the flag "-A" is used.
  • Implemented the RFC 8781 PREF64 router advertisement option in ! rad(8) which is used to communicate NAT64 prefixes to hosts.
  • Moved the documentation of flag mappings displayed by "route show" from the netstat(1) manpage to Stop claiming connection success in UDP mode unless true.
  • Do not test the connection in non-interactive mode. The test writes characters to the socket which can corrupt data that is ! possible piped into nc.
  • Some refactoring and code cleanup. --- 1049,1055 ----
  • Stop claiming connection success in UDP mode unless true.
  • Do not test the connection in non-interactive mode. The test writes characters to the socket which can corrupt data that is ! possibly piped into nc.
  • Some refactoring and code cleanup. *************** *** 1234,1241 **** provide it, for use by the VerifyHostKeyDNS feature. A specifically crafted DNS response could cause this function to perform an out-of-bounds read of adjacent stack data, but this ! condition does not appear to be exploitable beyond denial-of- ! service to the ssh(1) client.
    The getrrsetbyname(3) replacement is only included if the system's standard library lacks this function and portable OpenSSH was not compiled with the ldns library (--with-ldns). getrrsetbyname(3) is --- 1235,1242 ---- provide it, for use by the VerifyHostKeyDNS feature. A specifically crafted DNS response could cause this function to perform an out-of-bounds read of adjacent stack data, but this ! condition does not appear to be exploitable beyond denial-of-service ! to the ssh(1) client.
    The getrrsetbyname(3) replacement is only included if the system's standard library lacks this function and portable OpenSSH was not compiled with the ldns library (--with-ldns). getrrsetbyname(3) is