===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/innovations.html,v
retrieving revision 1.58
retrieving revision 1.59
diff -c -r1.58 -r1.59
*** www/innovations.html 2017/10/31 01:00:45 1.58
--- www/innovations.html 2017/11/03 10:59:03 1.59
***************
*** 11,557 ****
!
! This is a list of software and ideas developed or maintained by the OpenBSD
! project, sorted in order of approximate introduction. Some of them are
! explained in detail in our research papers.
!
!
! Programs and subsystems
! - ypbind(8),
! ypset(8),
! ypcat(1),
! ypmatch(1),
! ypwhich(1),
! and libc support: Started by Theo de Raadt.
! Imported April 26, 1993 and first released with NetBSD 0.9.
!
- ypserv(8):
! Started by Mats O. Jansson in 1994.
! Imported October 23, 1995 and first released with OpenBSD 2.0.
!
- mopd(8):
! Started by Mats O. Jansson in 1993.
! Imported September 21, 1996 and first released with OpenBSD 2.0.
!
- AnonCVS:
! Designed and implemented by Chuck Cranor and Theo de Raadt in 1995
! (paper,
! slides)
!
- aucat(1):
! Started by Kenneth Stailey.
! Imported January 2, 1997 and first released with OpenBSD 2.1.
! Now maintained by Alexandre Ratchov.
!
- OpenSSH
! including ssh(1),
! scp(1),
! sftp(1),
! ssh-add(1),
! ssh-agent(1),
! ssh-keygen(1),
! sshd(8),
! sftp-server(8):
! Started by Aaron Campbell, Bob Beck, Dug Song, Markus Friedl,
! Niels Provos, and Theo de Raadt
! as a fork of SSH 1.2.12 by Tatu Ylonen.
! Imported September 26, 1999 and first released with OpenBSD 2.6.
! Now maintained by Markus Friedl, Damien Miller, Darren Tucker, and
! Theo de Raadt.
!
- mg(1):
! Started by Dave Conroy in November 1986.
! Imported February 25, 2000 and first released with OpenBSD 2.7.
! Now maintained by Mark Lumsden.
!
- m4(1):
! Originally implemented by Ozan Yigit and Richard A. O'Keefe for 4.3BSD-Reno.
! Considerably extended and maintained by Marc Espie since 1999.
!
- pf(4),
! pfctl(8),
! pflogd(8),
! authpf(8),
! ftp-proxy(8):
! Started by Daniel Hartmeier
! as a replacement for the non-free ipf by Darren Reed.
! Imported June 24, 2001 and first released with OpenBSD 3.0.
! Now maintained by Henning Brauer.
!
- systrace(4),
! systrace(1):
! Started by Niels Provos.
! Imported June 4, 2002 and first released with OpenBSD 3.2.
! Deleted after OpenBSD 5.9 because
! pledge(2) is even better.
!
- spamd(8):
! Written by Bob Beck. Imported December 21, 2002 and first released with OpenBSD 3.3.
!
- dc(1):
! Written and maintained by Otto Moerbeek.
! Imported September 19, 2003 and first released with OpenBSD 3.5.
!
- bc(1):
! Written and maintained by Otto Moerbeek.
! Imported September 25, 2003 and first released with OpenBSD 3.5.
!
- sensorsd(8):
! Started by Henning Brauer.
! Imported September 24, 2003 and first released with OpenBSD 3.5.
! Reworked by Constantine A. Murenin.
!
- pkg_add(1):
! Written and maintained by Marc Espie.
! Imported October 16, 2003 and first released with OpenBSD 3.5.
!
- carp(4):
! Written by Mickey Shalayeff, Markus Friedl, Marco Pfatschbacher,
! and Ryan McBride.
! Imported October 17, 2003 and first released with OpenBSD 3.5.
!
- OpenBGPD
! including bgpd(8)
! and bgpctl(8):
! Written and maintained by Henning Brauer and Claudio Jeker,
! and also maintained by Peter Hessler.
! Imported December 17, 2003 and first released with OpenBSD 3.5.
!
- dhclient(8):
! Started by Ted Lemon and Elliot Poger in 1996.
! Imported January 18, 2004 and first released with OpenBSD 3.5.
! Reworked by Henning Brauer.
! Now maintained by Kenneth Westerback.
!
- dhcpd(8):
! Started by Ted Lemon in 1995.
! Imported April 13, 2004 and first released with OpenBSD 3.6.
! Reworked by Henning Brauer.
! Now maintained by Kenneth Westerback.
!
- hotplugd(8):
! Started by Alexander Yurchenko.
! Imported May 30, 2004 and first released with OpenBSD 3.6.
!
- OpenNTPD
! including ntpd(8)
! and ntpctl(8):
! Written and maintained by Henning Brauer.
! Imported May 31, 2004 and first released with OpenBSD 3.6.
! Portable version maintained by Brent Cook.
!
- dpb(1):
! Started by Nikolay Sturm on August 10, 2004; first available for OpenBSD 3.6.
! Rewritten and maintained by Marc Espie since August 20, 2010.
!
- ospfd(8),
! ospfctl(8):
! Started by Esben Norby and Claudio Jeker.
! Imported January 28, 2005 and first released with OpenBSD 3.7.
!
- ifstated(8):
! Started by Marco Pfatschbacher and Ryan McBride.
! Imported January 23, 2004 and first released with OpenBSD 3.8.
!
- bioctl(8):
! Started by Marco Peereboom.
! Imported March 29, 2005 and first released with OpenBSD 3.8.
!
- hostapd(8):
! Written and maintained by Reyk Floeter.
! Imported May 26, 2005 and first released with OpenBSD 3.8.
!
- watchdogd(8):
! Started by Marc Balmer.
! Imported August 8, 2005 and first released with OpenBSD 3.8.
!
- sdiff(1):
! Written by Ray Lai.
! Imported December 27, 2005 and first released with OpenBSD 3.9.
!
- dvmrpd(8),
! dvmrpctl(8):
! Started by Esben Norby.
! Imported June 1, 2006 and first released with OpenBSD 4.0.
!
- ripd(8),
! ripctl(8):
! Started by Michele Marchetto.
! Imported October 18, 2006 and first released with OpenBSD 4.1.
!
- pkg-config(1):
! Started by Chris Kuethe and Marc Espie.
! Imported November 27, 2006 and first released with OpenBSD 4.1.
! Now maintained by Jasper Lievisse Adriaanse.
!
- relayd(8)
! with relayctl(8):
! Started by Pierre-Yves Ritschard and Reyk Floeter.
! Imported December 16, 2006 and first released with OpenBSD 4.1.
! Now maintained by Reyk Floeter and Sebastian Benoit.
! - cwm(1):
! Started by Marius
! Aamodt Eriksen in 2004.
! Imported April 27, 2007 and first released with OpenBSD 4.2.
! Now maintained by Okan Demirmen.
! Portable version
! maintained by Leah Neukirchen.
!
- ospf6d(8),
! ospf6ctl(8):
! Started by Esben Norby and Claudio Jeker.
! Imported October 8, 2007 and first released with OpenBSD 4.2.
!
- libtool(1):
! Written by Steven Mestdagh and Marc Espie.
! Imported October 28, 2007 and first available for OpenBSD 4.3.
! Now maintained by Marc Espie, Jasper Lievisse Adriaanse,
! and Antoine Jacoutot.
!
- snmpd(8),
! snmpctl(8):
! Started by Reyk Floeter.
! Imported December 5, 2007 and first released with OpenBSD 4.3.
! Maintained by Reyk Floeter and Bret Lambert.
!
- sysmerge(8):
! Written and maintained by Antoine Jacoutot,
! originally forked from mergemaster by Douglas Barton.
! Imported April 22, 2008, first released with OpenBSD 4.4.
!
- ypldap(8):
! Started by Pierre-Yves Ritschard.
! Imported June 26, 2008 and first released with OpenBSD 4.4.
!
- OpenSMTPD
! including smtpd(8),
! smtpctl(8),
! makemap(8):
! Started by Gilles Chehade.
! Imported November 1, 2008 and first released with OpenBSD 4.6.
! Now maintained by Gilles Chehade and Eric Faurot.
!
- tmux,
! tmux(1):
! Started in 2007 and maintained by Nicholas Marriott.
! Imported June 1, 2009, first released with OpenBSD 4.6.
!
- ldpd(8),
! ldpctl(8):
! Started by Michele Marchetto.
! Imported June 1, 2009 and first released with OpenBSD 4.6.
! Now maintained by Claudio Jeker.
!
- mandoc
! including mandoc(1),
! man(1),
! apropos(1),
! makewhatis(8),
! man.cgi(8):
! Started by Kristaps Dzonsons in November 2008.
! Imported April 6, 2009, first released with OpenBSD 4.8.
! Now maintained by Ingo Schwarze.
!
- ldapd(8),
! ldapctl(8):
! Written by Martin Hedenfalk.
! Imported May 31, 2010 and first released with OpenBSD 4.8.
!
- OpenIKED
! including iked(8)
! and ikectl(8):
! Started by Reyk Floeter.
! Imported June 3, 2010 and first released with OpenBSD 4.8.
! Now maintained by Reyk Floeter and Mike Belopuhov.
!
- iscsid(8),
! iscsictl(8):
! Written and maintained by Claudio Jeker.
! Imported September 24, 2010 and first released with OpenBSD 4.9.
!
- rc.d(8),
! rc.subr(8):
! Written and maintained by Robert Nagy and Antoine Jacoutot.
! Imported October 26, 2010 and first released with OpenBSD 4.9.
!
- tftpd(8):
! Written and maintained by David Gwynne.
! Imported March 2, 2012 and first released with OpenBSD 5.2.
!
- npppd(8),
! npppctl(8):
! Started by Internet Initiative Japan Inc.
! Imported January 11, 2010, first released with OpenBSD 5.3.
! Maintained by YASUOKA Masahiko.
!
- ldomd(8),
! ldomctl(8):
! Written and maintained by Mark Kettenis.
! Imported October 26, 2012 and first released with OpenBSD 5.3.
!
- sndiod(8):
! Written and maintained by Alexandre Ratchov.
! Imported November 23, 2012 and first released with OpenBSD 5.3.
!
- cu(1):
! Written and maintained by Nicholas Marriott.
! Imported July 10, 2012 and first released with OpenBSD 5.4.
!
- identd(8):
! Written and maintained by David Gwynne.
! Imported March 18, 2013 and first released with OpenBSD 5.4.
!
- slowcgi(8):
! Written and maintained by Florian Obser.
! Imported May 23, 2013 and first released with OpenBSD 5.4.
!
- signify(1):
! Written and maintained by Ted Unangst.
! Imported December 31, 2013 and first released with OpenBSD 5.5.
!
- htpasswd(1):
! Written and maintained by Florian Obser.
! Imported March 17, 2014 and first released with OpenBSD 5.6.
!
- LibreSSL:
! Started by Ted Unangst, Bob Beck, Joel Sing, Miod Vallat, Philip Guenther,
! and Theo de Raadt on April 13, 2014, as a fork of OpenSSL 1.0.1g.
! First released with OpenBSD 5.6.
! Portable version maintained by Brent Cook.
!
- httpd(8):
! Started by Reyk Floeter.
! Imported July 12, 2014 and first released with OpenBSD 5.6.
! Maintained by Reyk Floeter and Florian Obser.
!
- rcctl(8):
! Written and maintained by Antoine Jacoutot.
! Imported August 19, 2014 and first released with OpenBSD 5.7.
!
- file(1):
! Rewritten from scratch and maintained by Nicholas Marriott.
! Imported April 24, 2015 and first released with OpenBSD 5.8.
!
- doas(1):
! Written and maintained by Ted Unangst.
! Imported July 16, 2015 and first released with OpenBSD 5.8.
!
- radiusd(8):
! Written and maintained by YASUOKA Masahiko.
! Imported July 21, 2015 and first released with OpenBSD 5.8.
!
- eigrpd(8),
! eigrpctl(8):
! Written and maintained by Renato Westphal.
! Imported October 2, 2015 and first released with OpenBSD 5.9.
!
- rebound(8):
! Written and maintained by Ted Unangst.
! Imported October 15, 2015 and first released with OpenBSD 5.9.
!
- vmm(4),
! vmd(8),
! vmctl(8):
! Written and maintained by Mike Larkin and Reyk Floeter.
! Imported November 13, 2015 and first released with OpenBSD 5.9.
!
- pdisk(8):
! Originally written by Eryk Vershen in 1996-1998,
! rewritten and maintained by Kenneth Westerback since January 11, 2016
! and first released with OpenBSD 5.9.
!
- mknod(8):
! Original version from Version 6 AT&T UNIX (1975),
! last rewritten by Marc Espie on March 5, 2016
! and first released with OpenBSD 6.0.
!
- audioctl(1):
! Originally written by Lennart Augustsson in 1997,
! rewritten and maintained by Alexandre Ratchov since June 21, 2016
! and first released with OpenBSD 6.0.
!
- switchd(8),
! switchctl(8):
! Written and maintained by Reyk Floeter.
! Imported July 19, 2016; released with OpenBSD 6.1.
!
- acme-client(1):
! Written by Kristaps Dzonsons, imported August 31, 2016; released
! with OpenBSD 6.1.
!
- syspatch(8):
! Written and maintained by Antoine Jacoutot.
! Imported September 5, 2016; released with OpenBSD 6.1.
!
- ping(8):
! Restructured to include IPv6 functionality and maintained by Florian Obser.
! The separate
! ping6(8)
! was superseded on September 17, 2016,
! and the new, combined version was released with OpenBSD 6.1.
!
- xenodm(1):
! Cleaned-up fork of
! xdm(1)
! maintained by Matthieu Herrb.
! Imported October 23, 2016; released with OpenBSD 6.1.
!
- ocspcheck(8):
! Written and maintained by Bob Beck.
! Imported January 24, 2017; released with OpenBSD 6.1.
!
- slaacd(8):
! Written and maintained by Florian Obser.
! Imported March 18, 2017; released with OpenBSD 6.2.
! Concepts
! - ipsec(4):
! Started by John Ioannidis, Angelos D. Keromytis, Niels Provos, and
! Niklas Hallqvist, imported February 20, 1997. OpenBSD was the first
! free operating system to provide an IPSec stack.
!
- inet6(4):
! First complete integration and adoption of IPv6 led by
! "Itojun" (Dr. Junichiro Hagino) [WIDE/KAME], Craig Metz [NRL], and
! Angelos D. Keromytis starting Jan 6, 1999.
! Almost fully operational Jun 6, 1999 during the
! first OpenBSD hackathon.
! OpenBSD 2.7.
!
- Privilege separation:
! First implemented by
! Niels Provos
! and Markus Friedl in OpenSSH in March 2002, released with OpenBSD 3.2.
! The concept is now used in many OpenBSD programs, for example
! bgpd(8),
! dhclient(8),
! dhcpd(8),
! dvmrpd(8),
! eigrpd(8),
! file(1),
! httpd(8),
! iked(8),
! ldapd(8),
! ldpd(8),
! mountd(8),
! npppd(8),
! ntpd(8),
! ospfd(8),
! ospf6d(8),
! pflogd(8),
! radiusd(8),
! relayd(8),
! ripd(8),
! script(1),
! smtpd(8),
! syslogd(8),
! tcpdump(8),
! tmux(1),
! xconsole(1),
! xdm(1),
! Xserver(1),
! ypldap(8),
! pkg_add(1),
! etc.
!
- Privilege revocation:
! Related to the work on privilege separation, some programs were refactored
! to drop privileges while holding onto a tricky resource such as a raw socket,
! reserved port, or modification-locked bpf(4) descriptor,
! for example
! ping(8),
! traceroute(8),
! etc.
!
- Stack protector: Developed since 2001 as "propolice" by Hiroaki Etoh.
! Integrated, and implemented for additional hardware platforms,
! by Miod Vallat and Theo de Raadt. OpenBSD 3.3 was the first operating
! system to enable it systemwide by default.
!
- W^X: First used for sparc, sparc64, alpha, and hppa in OpenBSD 3.3.
! Strictly enforced by default since OpenBSD 6.0: a program can only
! violate it if the executable is marked with
PT_OPENBSD_WXNEEDED
! and it is located on a filesystem mounted with the wxallowed
! mount(8) option.
! - GOT and PLT protection by ld.so: first done as part of the W^X
! work in OpenBSD 3.3, by Dale Rahn and Theo de Raadt.
! The GOT and PLT regions are read-only outside of ld.so itself.
! Extended to the .init/.fini sections (constructors and destructors)
! in OpenBSD 3.4.
!
- ASLR: OpenBSD 3.4 was the first widely used operating system to
! provide it by default.
!
- gcc-local(1)
! __attribute__((__bounded__)) static analysis annotation
! and checking mechanism:
! Started by Anil Madhavapeddy on June 26, 2003
! and ported to GCC 4 by Nicholas Marriott.
! First released with OpenBSD 3.4.
!
- malloc(3)
! randomization implemented by Thierry Deval. Guard pages and randomized (delayed) free added by Ted Unangst.
! Reimplemented by Otto Moerbeek
! for OpenBSD 4.4.
! - PIE: OpenBSD 5.3 was the first widely used operating system to enable
! it globally by default, on seven hardware platforms.
!
- Random-data memory: the ability to specify that a variable
! should be initialized at load time with random byte values was
! implemented in OpenBSD 5.3 by Matthew Dempsky.
!
- Stack protector per shared object: using the random-data memory
! feature, each shared object was given its own stack protector
! cookie in OpenBSD 5.3 by Matthew Dempsky.
!
- Static-PIE: Position-independent static binaries for /bin, /sbin and ramdisks.
! First released with OpenBSD 5.7.
!
- SROP (sigreturn(2)
! oriented programming) mitigation: Researched by
! Eric Bosman
! and Herbert Bos in 2014, implemented by Theo de Raadt in May 2016,
! enabled by default since OpenBSD 6.0.
!
- Library order randomization:
! In rc(8), re-link
!
libc.so, libcrypto, and ld.so
! on startup, placing the objects in a random order.
! Theo de Raadt and Robert Peichaer, May 2016,
! enabled by default since OpenBSD 6.0 and 6.2.
! - Kernel-assisted lazy-binding for W^X safety in multi-threaded programs.
! A new syscall kbind(2)
! permits lazy-binding to be W^X safe in multi-threaded programs.
! Implemented for OpenBSD 5.9 by Philip Guenther in July 2015.
!
- Process layouts in memory tightened to remove execute permission from
! all segmented, non-instruction data and to remove write permission from
! data that is only modified during loading and relocation.
! By combining the RELRO (Read-Only after Relocation) design from the
! GNU project with the original ASLR work from OpenBSD 3.3 and
! strict lazy-binding work from OpenBSD 5.9, this is applied to not
! just a subset of programs and libraries but rather to all programs
! and libraries.
! Implemented for OpenBSD 6.1 by Philip Guenther in August 2016.
!
- Use of fork+exec in privilege separated programs. The strategy is to give
! each process a fresh & unique address space for ASLR, stack protector -- as
! protection against address space discovery attacks. Implemented first by
! Damien Miller (sshd(8) 2004),
! Claudio Jeker (bgpd(8), 2015),
! Eric Faurot (smtpd(8), 2016),
! Rafael Zalamena (various, 2016), and others.
!
- trapsleds: Reduction of incidental NOP instructions/sequences in the
! instruction stream which could be useful potentially for ROP attack methods
! to innaccurately target gadgets. These NOP sequences are converted into
! trap sequences where possible. Todd Mortimer and Theo de Raadt, June 2017.
!
- The .o files of the kernel are relinked in random order from a link-kit,
! before every reboot. This provides substantial interior randomization in
! the kernel's text and data segments for layout and relative branches/calls.
! Basically a unique address space for each kernel boot, similar to the userland
! fork+exec model described above but for the kernel. Theo de Raadt, June 2017.
- Functions
! - arc4random(3):
! David Mazieres, December 28, 1996, OpenBSD 2.1
!
- bcrypt(3):
! Implemented by Niels Provos and David Mazieres
! Imported February 13, 1997 and first released with OpenBSD 2.1.
!
- strlcpy(3),
! strlcat(3):
! Todd Miller and Theo de Raadt, July 1, 1998, OpenBSD 2.4
!
- strtonum(3):
! Ted Unangst, Todd Miller, and Theo de Raadt, May 3, 2004, OpenBSD 3.6
!
- imsg:
! Message passing API, written by Henning Brauer.
! In libutil since May 26, 2010, OpenBSD 4.8;
! used by various daemons before that.
!
- timingsafe_bcmp(3):
! Damien Miller, July 13, 2010, OpenBSD 4.9
!
- explicit_bzero(3):
! Ted Unangst and Matthew Dempsky, January 22, 2014, OpenBSD 5.5
!
- ohash:
! Written and maintained by Marc Espie.
! In libutil since May 12, 2014, OpenBSD 5.6;
! used by make(1) and m4(1) before that.
!
- asr:
! Replacement resolver written and maintained by Eric Faurot.
! Imported April 14, 2012; activated on March 26, 2014, OpenBSD 5.6.
!
- reallocarray(3):
! Theo de Raadt and Ted Unangst, April 22, 2014, OpenBSD 5.6
!
- getentropy(2):
! Matthew Dempsky and Theo de Raadt, June 13, 2014, OpenBSD 5.6
!
- sendsyslog(2):
! Theo de Raadt, July 10, 2014, OpenBSD 5.6
!
- timingsafe_memcmp(3):
! Matthew Dempsky, July 13, 2014, OpenBSD 5.6
!
- pledge(2):
! Theo de Raadt, July 19, 2015, OpenBSD 5.9
!
- getpwnam_shadow(3),
! getpwuid_shadow(3):
! Ted Unangst and Theo de Raadt, November 18, 2015, OpenBSD 5.9
!
- recallocarray(3):
! Otto Moerbeek, Joel Sing and Theo de Raadt, March 6, 2017, OpenBSD 6.1
!
- freezero(3):
! Otto Moerbeek, April 10, 2017, OpenBSD 6.2
Projects maintained by OpenBSD developers outside OpenBSD
! - sudo:
! Started by Bob Coggeshall and Cliff Spencer around 1980.
! Imported November 18, 1999, first released with OpenBSD 2.7.
! Now maintained by Todd Miller.
!
- femail:
! Written and maintained by Henning Brauer.
! Started in 2005, port available since September 22, 2005.
!
- midish:
! Written and maintained by Alexandre Ratchov.
! Started in 2003, port available since November 4, 2005.
!
- fdm:
! Written and maintained by Nicholas Marriott.
! Started in 2006, port available since January 18, 2007.
!
- toad:
! Written and maintained by Antoine Jacoutot.
! Started in 2013, port available since October 8, 2013.
!
- portroach:
! Written and maintained by Jasper Lievisse Adriaanse,
! originally forked from FreeBSD's portscout.
! Started in 2014, port available since September 5, 2014.
!
- cvs2gitdump:
! Written and maintained by YASUOKA Masahiko.
! Started in 2012, port available since August 1, 2016.
--- 11,806 ----
! This is a list of software and ideas developed or maintained by the OpenBSD
! project, sorted in order of approximate introduction. Some of them are
! explained in detail in our research papers.
!
! Concepts
! -
! ipsec(4):
! Started by John Ioannidis, Angelos D. Keromytis, Niels Provos, and
! Niklas Hallqvist, imported February 20, 1997. OpenBSD was the first
! free operating system to provide an IPSec stack.
!
! -
! inet6(4):
! First complete integration and adoption of IPv6 led by
! "Itojun" (Dr. Junichiro Hagino) [WIDE/KAME], Craig Metz [NRL], and
! Angelos D. Keromytis starting Jan 6, 1999.
! Almost fully operational Jun 6, 1999 during the
! first OpenBSD hackathon.
! OpenBSD 2.7.
!
! -
! Privilege separation:
! First implemented by
! Niels Provos
! and Markus Friedl in OpenSSH in March 2002, released with OpenBSD 3.2.
! The concept is now used in many OpenBSD programs, for example
! bgpd(8),
! dhclient(8),
! dhcpd(8),
! dvmrpd(8),
! eigrpd(8),
! file(1),
! httpd(8),
! iked(8),
! ldapd(8),
! ldpd(8),
! mountd(8),
! npppd(8),
! ntpd(8),
! ospfd(8),
! ospf6d(8),
! pflogd(8),
! radiusd(8),
! relayd(8),
! ripd(8),
! script(1),
! smtpd(8),
! syslogd(8),
! tcpdump(8),
! tmux(1),
! xconsole(1),
! xdm(1),
! Xserver(1),
! ypldap(8),
! pkg_add(1),
! etc.
!
! -
! Privilege revocation:
! Related to the work on privilege separation, some programs were refactored
! to drop privileges while holding onto a tricky resource such as a raw socket,
! reserved port, or modification-locked bpf(4) descriptor,
! for example
! ping(8),
! traceroute(8),
! etc.
!
! -
! Stack protector:
! Developed since 2001 as "propolice" by Hiroaki Etoh. Integrated, and
! implemented for additional hardware platforms, by Miod Vallat and Theo
! de Raadt. OpenBSD 3.3 was the first operating system to enable it
! systemwide by default.
!
! -
! W^X:
! First used for sparc, sparc64, alpha, and hppa in OpenBSD 3.3.
! Strictly enforced by default since OpenBSD 6.0: a program can only
! violate it if the executable is marked with
PT_OPENBSD_WXNEEDED
! and it is located on a filesystem mounted with the wxallowed
! mount(8) option.
!
! -
! GOT and PLT protection by ld.so:
! first done as part of the W^X work in OpenBSD 3.3, by Dale Rahn and
! Theo de Raadt. The GOT and PLT regions are read-only outside of ld.so
! itself. Extended to the .init/.fini sections (constructors and
! destructors) in OpenBSD 3.4.
!
! -
! ASLR:
! OpenBSD 3.4 was the first widely used operating system to
! provide it by default.
!
! -
! gcc-local(1)
! __attribute__((__bounded__)) static analysis annotation
! and checking mechanism:
! Started by Anil Madhavapeddy on June 26, 2003
! and ported to GCC 4 by Nicholas Marriott.
! First released with OpenBSD 3.4.
!
! -
! malloc(3)
! randomization implemented by Thierry Deval. Guard pages and randomized (delayed) free added by Ted Unangst.
! Reimplemented by Otto Moerbeek
! for OpenBSD 4.4.
!
! -
! PIE:
! OpenBSD 5.3 was the first widely used operating system to enable it
! globally by default, on seven hardware platforms.
!
! -
! Random-data memory:
! the ability to specify that a variable should be initialized at load
! time with random byte values was implemented in OpenBSD 5.3 by Matthew
! Dempsky.
!
! -
! Stack protector per shared object:
! using the random-data memory feature, each shared object was given its
! own stack protector cookie in OpenBSD 5.3 by Matthew Dempsky.
!
! -
! Static-PIE:
! Position-independent static binaries for /bin, /sbin and ramdisks.
! First released with OpenBSD 5.7.
!
! -
! SROP
! (sigreturn(2)
! oriented programming) mitigation: Researched by
! Eric Bosman
! and Herbert Bos in 2014, implemented by Theo de Raadt in May 2016,
! enabled by default since OpenBSD 6.0.
!
! -
! Library order randomization:
! In rc(8), re-link
!
libc.so, libcrypto, and ld.so
! on startup, placing the objects in a random order.
! Theo de Raadt and Robert Peichaer, May 2016,
! enabled by default since OpenBSD 6.0 and 6.2.
!
! -
! Kernel-assisted lazy-binding for W^X safety in multi-threaded programs.
! A new syscall kbind(2)
! permits lazy-binding to be W^X safe in multi-threaded programs.
! Implemented for OpenBSD 5.9 by Philip Guenther in July 2015.
!
! -
! Process layouts in memory tightened to remove execute permission from
! all segmented, non-instruction data and to remove write permission from
! data that is only modified during loading and relocation.
! By combining the RELRO (Read-Only after Relocation) design from the
! GNU project with the original ASLR work from OpenBSD 3.3 and
! strict lazy-binding work from OpenBSD 5.9, this is applied to not
! just a subset of programs and libraries but rather to all programs
! and libraries.
! Implemented for OpenBSD 6.1 by Philip Guenther in August 2016.
!
! -
! Use of fork+exec in privilege separated programs. The
! strategy is to give each process a fresh & unique address space for
! ASLR, stack protector -- as protection against address space discovery attacks.
! Implemented first by
! Damien Miller (sshd(8) 2004),
! Claudio Jeker (bgpd(8), 2015),
! Eric Faurot (smtpd(8), 2016),
! Rafael Zalamena (various, 2016), and others.
!
! -
! trapsleds:
! Reduction of incidental NOP instructions/sequences in the instruction
! stream which could be useful potentially for ROP attack methods to
! innaccurately target gadgets. These NOP sequences are converted into
! trap sequences where possible. Todd Mortimer and Theo de Raadt, June
! 2017.
!
! -
! Kernel relinking at boot:
! the .o files of the kernel are relinked in random order from a
! link-kit, before every reboot. This provides substantial interior
! randomization in the kernel's text and data segments for layout and
! relative branches/calls. Basically a unique address space for each
! kernel boot, similar to the userland fork+exec model described above
! but for the kernel. Theo de Raadt, June 2017.
!
! Functions
! -
! arc4random(3):
! David Mazieres, December 28, 1996, OpenBSD 2.1
!
! -
! bcrypt(3):
! Implemented by Niels Provos and David Mazieres
! Imported February 13, 1997 and first released with OpenBSD 2.1.
!
! -
! strlcpy(3),
! strlcat(3):
! Todd Miller and Theo de Raadt, July 1, 1998, OpenBSD 2.4
!
! -
! strtonum(3):
! Ted Unangst, Todd Miller, and Theo de Raadt, May 3, 2004, OpenBSD 3.6
!
! -
! imsg:
! Message passing API, written by Henning Brauer.
! In libutil since May 26, 2010, OpenBSD 4.8;
! used by various daemons before that.
!
! -
! timingsafe_bcmp(3):
! Damien Miller, July 13, 2010, OpenBSD 4.9
!
! -
! explicit_bzero(3):
! Ted Unangst and Matthew Dempsky, January 22, 2014, OpenBSD 5.5
!
! -
! ohash:
! Written and maintained by Marc Espie.
! In libutil since May 12, 2014, OpenBSD 5.6;
! used by make(1) and m4(1) before that.
!
! -
! asr:
! Replacement resolver written and maintained by Eric Faurot.
! Imported April 14, 2012; activated on March 26, 2014, OpenBSD 5.6.
!
! -
! reallocarray(3):
! Theo de Raadt and Ted Unangst, April 22, 2014, OpenBSD 5.6
!
! -
! getentropy(2):
! Matthew Dempsky and Theo de Raadt, June 13, 2014, OpenBSD 5.6
!
! -
! sendsyslog(2):
! Theo de Raadt, July 10, 2014, OpenBSD 5.6
!
! -
! timingsafe_memcmp(3):
! Matthew Dempsky, July 13, 2014, OpenBSD 5.6
!
! -
! pledge(2):
! Theo de Raadt, July 19, 2015, OpenBSD 5.9
!
! -
! getpwnam_shadow(3),
! getpwuid_shadow(3):
! Ted Unangst and Theo de Raadt, November 18, 2015, OpenBSD 5.9
!
! -
! recallocarray(3):
! Otto Moerbeek, Joel Sing and Theo de Raadt, March 6, 2017, OpenBSD 6.1
!
! -
! freezero(3):
! Otto Moerbeek, April 10, 2017, OpenBSD 6.2
!
+ Programs and subsystems
+
! -
! ypbind(8),
! ypset(8),
! ypcat(1),
! ypmatch(1),
! ypwhich(1),
! and libc support: Started by Theo de Raadt.
! Imported April 26, 1993 and first released with NetBSD 0.9.
!
! -
! ypserv(8):
! Started by Mats O. Jansson in 1994.
! Imported October 23, 1995 and first released with OpenBSD 2.0.
!
! -
! mopd(8):
! Started by Mats O. Jansson in 1993.
! Imported September 21, 1996 and first released with OpenBSD 2.0.
!
! -
! AnonCVS:
! Designed and implemented by Chuck Cranor and Theo de Raadt in 1995
! (paper,
! slides)
!
! -
! aucat(1):
! Started by Kenneth Stailey.
! Imported January 2, 1997 and first released with OpenBSD 2.1.
! Now maintained by Alexandre Ratchov.
!
! -
! OpenSSH
! including ssh(1),
! scp(1),
! sftp(1),
! ssh-add(1),
! ssh-agent(1),
! ssh-keygen(1),
! sshd(8),
! sftp-server(8):
! Started by Aaron Campbell, Bob Beck, Dug Song, Markus Friedl,
! Niels Provos, and Theo de Raadt
! as a fork of SSH 1.2.12 by Tatu Ylonen.
! Imported September 26, 1999 and first released with OpenBSD 2.6.
! Now maintained by Markus Friedl, Damien Miller, Darren Tucker, and
! Theo de Raadt.
!
! -
! mg(1):
! Started by Dave Conroy in November 1986.
! Imported February 25, 2000 and first released with OpenBSD 2.7.
! Now maintained by Mark Lumsden.
!
! -
! m4(1):
! Originally implemented by Ozan Yigit and Richard A. O'Keefe for 4.3BSD-Reno.
! Considerably extended and maintained by Marc Espie since 1999.
!
! -
! pf(4),
! pfctl(8),
! pflogd(8),
! authpf(8),
! ftp-proxy(8):
! Started by Daniel Hartmeier as a replacement for the non-free ipf by
! Darren Reed. Imported June 24, 2001 and first released with OpenBSD
! 3.0. Now maintained by Henning Brauer.
!
! -
! systrace(4),
! systrace(1):
! Started by Niels Provos.
! Imported June 4, 2002 and first released with OpenBSD 3.2.
! Deleted after OpenBSD 5.9 because
! pledge(2) is even better.
!
! -
! spamd(8):
! Written by Bob Beck. Imported December 21, 2002 and first released with
! OpenBSD 3.3.
!
! -
! dc(1):
! Written and maintained by Otto Moerbeek.
! Imported September 19, 2003 and first released with OpenBSD 3.5.
!
! -
! bc(1):
! Written and maintained by Otto Moerbeek.
! Imported September 25, 2003 and first released with OpenBSD 3.5.
!
! -
! sensorsd(8):
! Started by Henning Brauer.
! Imported September 24, 2003 and first released with OpenBSD 3.5.
! Reworked by Constantine A. Murenin.
!
! -
! pkg_add(1):
! Written and maintained by Marc Espie.
! Imported October 16, 2003 and first released with OpenBSD 3.5.
!
! -
! carp(4):
! Written by Mickey Shalayeff, Markus Friedl, Marco Pfatschbacher,
! and Ryan McBride.
! Imported October 17, 2003 and first released with OpenBSD 3.5.
!
! -
! OpenBGPD
! including bgpd(8)
! and bgpctl(8):
! Written and maintained by Henning Brauer and Claudio Jeker,
! and also maintained by Peter Hessler.
! Imported December 17, 2003 and first released with OpenBSD 3.5.
!
! -
! dhclient(8):
! Started by Ted Lemon and Elliot Poger in 1996.
! Imported January 18, 2004 and first released with OpenBSD 3.5.
! Reworked by Henning Brauer.
! Now maintained by Kenneth Westerback.
!
! -
! dhcpd(8):
! Started by Ted Lemon in 1995.
! Imported April 13, 2004 and first released with OpenBSD 3.6.
! Reworked by Henning Brauer.
! Now maintained by Kenneth Westerback.
!
! -
! hotplugd(8):
! Started by Alexander Yurchenko.
! Imported May 30, 2004 and first released with OpenBSD 3.6.
!
! -
! OpenNTPD
! including ntpd(8)
! and ntpctl(8):
! Written and maintained by Henning Brauer.
! Imported May 31, 2004 and first released with OpenBSD 3.6.
! Portable version maintained by Brent Cook.
!
! -
! dpb(1):
! Started by Nikolay Sturm on August 10, 2004; first available for OpenBSD 3.6.
! Rewritten and maintained by Marc Espie since August 20, 2010.
!
! -
! ospfd(8),
! ospfctl(8):
! Started by Esben Norby and Claudio Jeker.
! Imported January 28, 2005 and first released with OpenBSD 3.7.
!
! -
! ifstated(8):
! Started by Marco Pfatschbacher and Ryan McBride.
! Imported January 23, 2004 and first released with OpenBSD 3.8.
!
! -
! bioctl(8):
! Started by Marco Peereboom.
! Imported March 29, 2005 and first released with OpenBSD 3.8.
!
! -
! hostapd(8):
! Written and maintained by Reyk Floeter.
! Imported May 26, 2005 and first released with OpenBSD 3.8.
!
! -
! watchdogd(8):
! Started by Marc Balmer.
! Imported August 8, 2005 and first released with OpenBSD 3.8.
!
! -
! sdiff(1):
! Written by Ray Lai.
! Imported December 27, 2005 and first released with OpenBSD 3.9.
!
! -
! dvmrpd(8),
! dvmrpctl(8):
! Started by Esben Norby.
! Imported June 1, 2006 and first released with OpenBSD 4.0.
!
! -
! ripd(8),
! ripctl(8):
! Started by Michele Marchetto.
! Imported October 18, 2006 and first released with OpenBSD 4.1.
!
! -
! pkg-config(1):
! Started by Chris Kuethe and Marc Espie.
! Imported November 27, 2006 and first released with OpenBSD 4.1.
! Now maintained by Jasper Lievisse Adriaanse.
!
! -
! relayd(8)
! with relayctl(8):
! Started by Pierre-Yves Ritschard and Reyk Floeter.
! Imported December 16, 2006 and first released with OpenBSD 4.1.
! Now maintained by Reyk Floeter and Sebastian Benoit.
!
! -
! cwm(1):
! Started by Marius
! Aamodt Eriksen in 2004.
! Imported April 27, 2007 and first released with OpenBSD 4.2.
! Now maintained by Okan Demirmen.
! Portable version
! maintained by Leah Neukirchen.
!
! -
! ospf6d(8),
! ospf6ctl(8):
! Started by Esben Norby and Claudio Jeker.
! Imported October 8, 2007 and first released with OpenBSD 4.2.
!
! -
! libtool(1):
! Written by Steven Mestdagh and Marc Espie.
! Imported October 28, 2007 and first available for OpenBSD 4.3.
! Now maintained by Marc Espie, Jasper Lievisse Adriaanse,
! and Antoine Jacoutot.
!
! -
! snmpd(8),
! snmpctl(8):
! Started by Reyk Floeter.
! Imported December 5, 2007 and first released with OpenBSD 4.3.
! Maintained by Reyk Floeter and Bret Lambert.
!
! -
! sysmerge(8):
! Written and maintained by Antoine Jacoutot,
! originally forked from mergemaster by Douglas Barton.
! Imported April 22, 2008, first released with OpenBSD 4.4.
!
! -
! ypldap(8):
! Started by Pierre-Yves Ritschard.
! Imported June 26, 2008 and first released with OpenBSD 4.4.
!
! -
! OpenSMTPD
! including smtpd(8),
! smtpctl(8),
! makemap(8):
! Started by Gilles Chehade.
! Imported November 1, 2008 and first released with OpenBSD 4.6.
! Now maintained by Gilles Chehade and Eric Faurot.
!
! -
! tmux,
! tmux(1):
! Started in 2007 and maintained by Nicholas Marriott.
! Imported June 1, 2009, first released with OpenBSD 4.6.
!
! -
! ldpd(8),
! ldpctl(8):
! Started by Michele Marchetto.
! Imported June 1, 2009 and first released with OpenBSD 4.6.
! Now maintained by Claudio Jeker.
!
! -
! mandoc
! including mandoc(1),
! man(1),
! apropos(1),
! makewhatis(8),
! man.cgi(8):
! Started by Kristaps Dzonsons in November 2008.
! Imported April 6, 2009, first released with OpenBSD 4.8.
! Now maintained by Ingo Schwarze.
!
! -
! ldapd(8),
! ldapctl(8):
! Written by Martin Hedenfalk.
! Imported May 31, 2010 and first released with OpenBSD 4.8.
!
! -
! OpenIKED
! including iked(8)
! and ikectl(8):
! Started by Reyk Floeter.
! Imported June 3, 2010 and first released with OpenBSD 4.8.
! Now maintained by Reyk Floeter and Mike Belopuhov.
!
! -
! iscsid(8),
! iscsictl(8):
! Written and maintained by Claudio Jeker.
! Imported September 24, 2010 and first released with OpenBSD 4.9.
!
! -
! rc.d(8),
! rc.subr(8):
! Written and maintained by Robert Nagy and Antoine Jacoutot.
! Imported October 26, 2010 and first released with OpenBSD 4.9.
!
! -
! tftpd(8):
! Written and maintained by David Gwynne.
! Imported March 2, 2012 and first released with OpenBSD 5.2.
!
! -
! npppd(8),
! npppctl(8):
! Started by Internet Initiative Japan Inc.
! Imported January 11, 2010, first released with OpenBSD 5.3.
! Maintained by YASUOKA Masahiko.
!
! -
! ldomd(8),
! ldomctl(8):
! Written and maintained by Mark Kettenis.
! Imported October 26, 2012 and first released with OpenBSD 5.3.
!
! -
! sndiod(8):
! Written and maintained by Alexandre Ratchov.
! Imported November 23, 2012 and first released with OpenBSD 5.3.
!
! -
! cu(1):
! Written and maintained by Nicholas Marriott.
! Imported July 10, 2012 and first released with OpenBSD 5.4.
!
! -
! identd(8):
! Written and maintained by David Gwynne.
! Imported March 18, 2013 and first released with OpenBSD 5.4.
!
! -
! slowcgi(8):
! Written and maintained by Florian Obser.
! Imported May 23, 2013 and first released with OpenBSD 5.4.
!
! -
! signify(1):
! Written and maintained by Ted Unangst.
! Imported December 31, 2013 and first released with OpenBSD 5.5.
!
! -
! htpasswd(1):
! Written and maintained by Florian Obser.
! Imported March 17, 2014 and first released with OpenBSD 5.6.
!
! -
! LibreSSL:
! Started by Ted Unangst, Bob Beck, Joel Sing, Miod Vallat, Philip Guenther,
! and Theo de Raadt on April 13, 2014, as a fork of OpenSSL 1.0.1g.
! First released with OpenBSD 5.6.
! Portable version maintained by Brent Cook.
!
! -
! httpd(8):
! Started by Reyk Floeter.
! Imported July 12, 2014 and first released with OpenBSD 5.6.
! Maintained by Reyk Floeter and Florian Obser.
!
! -
! rcctl(8):
! Written and maintained by Antoine Jacoutot.
! Imported August 19, 2014 and first released with OpenBSD 5.7.
!
! -
! file(1):
! Rewritten from scratch and maintained by Nicholas Marriott.
! Imported April 24, 2015 and first released with OpenBSD 5.8.
!
! -
! doas(1):
! Written and maintained by Ted Unangst.
! Imported July 16, 2015 and first released with OpenBSD 5.8.
!
! -
! radiusd(8):
! Written and maintained by YASUOKA Masahiko.
! Imported July 21, 2015 and first released with OpenBSD 5.8.
!
! -
! eigrpd(8),
! eigrpctl(8):
! Written and maintained by Renato Westphal.
! Imported October 2, 2015 and first released with OpenBSD 5.9.
!
! -
! rebound(8):
! Written and maintained by Ted Unangst.
! Imported October 15, 2015 and first released with OpenBSD 5.9.
!
! -
! vmm(4),
! vmd(8),
! vmctl(8):
! Written and maintained by Mike Larkin and Reyk Floeter.
! Imported November 13, 2015 and first released with OpenBSD 5.9.
!
! -
! pdisk(8):
! Originally written by Eryk Vershen in 1996-1998,
! rewritten and maintained by Kenneth Westerback since January 11, 2016
! and first released with OpenBSD 5.9.
!
! -
! mknod(8):
! Original version from Version 6 AT&T UNIX (1975),
! last rewritten by Marc Espie on March 5, 2016
! and first released with OpenBSD 6.0.
!
! -
! audioctl(1):
! Originally written by Lennart Augustsson in 1997,
! rewritten and maintained by Alexandre Ratchov since June 21, 2016
! and first released with OpenBSD 6.0.
!
! -
! switchd(8),
! switchctl(8):
! Written and maintained by Reyk Floeter.
! Imported July 19, 2016; released with OpenBSD 6.1.
!
! -
! acme-client(1):
! Written by Kristaps Dzonsons, imported August 31, 2016; released
! with OpenBSD 6.1.
!
! -
! syspatch(8):
! Written and maintained by Antoine Jacoutot.
! Imported September 5, 2016; released with OpenBSD 6.1.
!
! -
! ping(8):
! Restructured to include IPv6 functionality and maintained by Florian Obser.
! The separate
! ping6(8)
! was superseded on September 17, 2016,
! and the new, combined version was released with OpenBSD 6.1.
!
! -
! xenodm(1):
! Cleaned-up fork of
! xdm(1)
! maintained by Matthieu Herrb.
! Imported October 23, 2016; released with OpenBSD 6.1.
!
! -
! ocspcheck(8):
! Written and maintained by Bob Beck.
! Imported January 24, 2017; released with OpenBSD 6.1.
!
! -
! slaacd(8):
! Written and maintained by Florian Obser.
! Imported March 18, 2017; released with OpenBSD 6.2.
!
Projects maintained by OpenBSD developers outside OpenBSD
! -
! sudo:
! Started by Bob Coggeshall and Cliff Spencer around 1980.
! Imported November 18, 1999, first released with OpenBSD 2.7.
! Now maintained by Todd Miller.
!
! -
! femail:
! Written and maintained by Henning Brauer.
! Started in 2005, port available since September 22, 2005.
!
! -
! midish:
! Written and maintained by Alexandre Ratchov.
! Started in 2003, port available since November 4, 2005.
!
! -
! fdm:
! Written and maintained by Nicholas Marriott.
! Started in 2006, port available since January 18, 2007.
!
! -
! toad:
! Written and maintained by Antoine Jacoutot.
! Started in 2013, port available since October 8, 2013.
!
! -
! portroach:
! Written and maintained by Jasper Lievisse Adriaanse,
! originally forked from FreeBSD's portscout.
! Started in 2014, port available since September 5, 2014.
!
! -
! cvs2gitdump:
! Written and maintained by YASUOKA Masahiko.
! Started in 2012, port available since August 1, 2016.
!