loginterface feature to be disabled.
volatile sig_atomic_t.
We are working on OpenBSD-current.
! The following list sums up (almost) all the changes made up to July 9.
-
+
- Make httpd(8)
chroot()and droprootprivileges by default. + - pf(4) now accepts an interface in most of the places it can take an IP address, and picks up all the IPv4 and IPv6 addresses on that interface. +
- Some updates to cron(8). +
- Remove ab(1) from the Apache installation. +
- Remove NTP support from the kernel. +
- Don't attempt to resubmit a structure we just freed in ipsec(4) / ipcomp(4). +
- Small fixes to IP-in-IP encapsulation code. +
- Add Security Mode options to atactl(8). +
- Support a few more HPT pciide(4) cards. +
- Make
NEED_VERSIONobsolete in bsd.port.mk(5). + - Fill IPv6 null pointer dereference in cvs(1)
pserver. + - Remove some old upgrade hacks from the installer script. +
- pf(4) chokes on invalid '
! <interface>' syntax, instead of just ignoring the '!'. - Fix pf(4) interface stats, and allow the
loginterfacefeature to be disabled. - Make signal handler flags in isakmpd(8) of type
volatile sig_atomic_t. - Fix a few GCC 3.1 moans in isakmpd(8). *************** *** 58,76 ****
- Cleanup of rpcgen(1).
- RELIABILITY FIX: Don't assume we have an active exchange during payload validation, otherwise isakmpd(8) can be made to crash.
A source code patch exists to remedy the problem.
! - ep(4) on isapnp(4) now works on alpha.
- Improve the way the installer's fileset selection UI works. !
- Fix a potential buffer overflow in xsystrace(1).
- Add a note to the unwary in
distrib/notesabout the danger of skipping several versions when upgrading. - Don't have ssh(1) allocate memory for stuff we don't need, just to discard it straight away. !
- Set
IP_PORTTANGE_HIGHfor active mode data channel of ftp(1). - Add some more usb(4) product IDs.
- Fix an off-by-one error in rmt(8) and improve string handling in general.
- Normalise nc(1)'s EOF handling.
- Plug a few ssh(1) memory leaks.
- Tweak the tga(4/ALPHA) driver. !
- Fix several missing or broken malloc(3) failure checks.
- In rcs(1), actually exit(3) after spotting that
LocalIdis too long. - Lots of ANSIfication of function declarations and prototypes.
- Fix bug causing '
SPL NOT LOWERED' errors from the ami(4) RAID controller. --- 71,89 ---- - Cleanup of rpcgen(1).
- RELIABILITY FIX: Don't assume we have an active exchange during payload validation, otherwise isakmpd(8) can be made to crash.
A source code patch exists to remedy the problem.
! [Applied to stable] - ep(4) on isapnp(4) now works on alpha.
- Improve the way the installer's fileset selection UI works. !
- Fix a potential buffer overflow in
xsystrace. - Add a note to the unwary in
distrib/notesabout the danger of skipping several versions when upgrading. - Don't have ssh(1) allocate memory for stuff we don't need, just to discard it straight away. !
- Set
IP_PORTRANGE_HIGHfor active mode data channel of ftp(1). - Add some more usb(4) product IDs.
- Fix an off-by-one error in rmt(8) and improve string handling in general.
- Normalise nc(1)'s EOF handling.
- Plug a few ssh(1) memory leaks.
- Tweak the tga(4/ALPHA) driver. !
- Fix several missing or broken malloc(3) and realloc(3) failure checks.
- In rcs(1), actually exit(3) after spotting that
LocalIdis too long. - Lots of ANSIfication of function declarations and prototypes.
- Fix bug causing '
SPL NOT LOWERED' errors from the ami(4) RAID controller. *************** *** 98,107 **** - Add AlphaServer 800 and 1000 support.
- Enable lc(4) devices in alpha GENERIC kernel.
- Fix isapnp(4) panics on alpha. !
- Make xf86config(1) give the option of configuring a mouse wheel.
- Gracefully handle i386_iopl(2) failure in the X server when trying to give up privileges.
- Add wscons(4) files to fbtab(5) on i386. !
- Add to use kqueue(2) support to syslog(3).
- Evolve
strtou?q()intostrtou?ll(). Use weak aliases if available (wrappers otherwise) to fakestrtou?q(). - Run rpc.rstatd(8) and rpc.rusersd(8) as
rootfrom inetd(8) again, but go tonobody's jail at startup. - Lots more bounds-checking all over the place. --- 111,120 ----
- Add AlphaServer 800 and 1000 support.
- Enable lc(4) devices in alpha GENERIC kernel.
- Fix isapnp(4) panics on alpha. !
- Make
xf86configgive the option of configuring a mouse wheel. - Gracefully handle i386_iopl(2) failure in the X server when trying to give up privileges.
- Add wscons(4) files to fbtab(5) on i386. !
- Add kqueue(2) support to syslog(3).
- Evolve
strtou?q()intostrtou?ll(). Use weak aliases if available (wrappers otherwise) to fakestrtou?q(). - Run rpc.rstatd(8) and rpc.rusersd(8) as
rootfrom inetd(8) again, but go tonobody's jail at startup. - Lots more bounds-checking all over the place. *************** *** 133,139 ****
- Skip routing table lookup when {broad,multi}casting and the outgoing interface is set using setsockopt(2). Removes the need for a
224/4route. - Make X use
/dev/wsmouseinstead of/dev/wsmouse0by default. - Add some m68k opcode aliases for GNU as(1) from recent binutils. !
- Pull the
bzero()fix insys/netinet/tcp_input.cfrom -current into 3.0-stable. - Fix the FTP relay in faithd(8).
- Fix wi(4) reassociation after an AP reboot.
- SECURITY FIX: A buffer overflow can
--- 146,152 ----
- Skip routing table lookup when {broad,multi}casting and the outgoing interface is set using setsockopt(2). Removes the need for a
224/4route.- Make X use
/dev/wsmouseinstead of/dev/wsmouse0by default.- Add some m68k opcode aliases for GNU as(1) from recent binutils. !
- Pull the
bzero()fix insys/netinet/tcp_input.cfrom -current into 3.0-stable.- Fix the FTP relay in faithd(8).
- Fix wi(4) reassociation after an AP reboot.
- SECURITY FIX: A buffer overflow can *************** *** 143,149 ****
- Lots of
uid_tandgid_tsignedness fixes.- sshd(8) no longer calls
setsid()when run from inetd(8).- Make cvs(1)
pservertalk IPv6. !- Increment boot(8) version to help debug the new memory probe and other fixes.
- Make wi(4) less twitchy on quick inserts/ejects.
- String handling and bounds checking fixes to login_fbtab(3).
- Bump OpenSSH to version 3.3.
--- 156,162 ----- Lots of
uid_tandgid_tsignedness fixes.- sshd(8) no longer calls
setsid()when run from inetd(8).- Make cvs(1)
pservertalk IPv6. !- Increment boot(8) version to help debug the new memory probe and other fixes.
- Make wi(4) less twitchy on quick inserts/ejects.
- String handling and bounds checking fixes to login_fbtab(3).
- Bump OpenSSH to version 3.3.
*************** *** 152,158 ****- System call argument rewriting framework for systrace(4).
- Enable wi(4) on sparc64, after a lot of groundwork.
- Fix some endianness nits in wi(4). !
- Remove ifmcstat(8), the same information is available from netstat(8).
- More improvements to 4GB memory probing on i386.
- ssh(1) and sshd(8) options are now documented in their own
sshd?_config(5)manpage.- Add option for smooth scrolling to talk(1). --- 165,171 ----
- System call argument rewriting framework for systrace(4).
- Enable wi(4) on sparc64, after a lot of groundwork.
- Fix some endianness nits in wi(4). !
- Remove ifmcstat(8), the same information is available from netstat(1).
- More improvements to 4GB memory probing on i386.
- ssh(1) and sshd(8) options are now documented in their own
sshd?_config(5)manpage.- Add option for smooth scrolling to talk(1). *************** *** 196,208 ****
- Add some inlined hash functions for the kernel, in
<sys/hash.h>.- Cleanup work on conditional evaluation in make(1).
- isakmpd(8) accepts IPComp flows. !
- Drop pf(4)
scrub(fragcache)syntax in favour of thefragment ...option inscrubrules.- Teach tcpdump(8) about ipcomp(4).
- Show sparc64's X server which device it wants to
mmap().- Add ioctl to wscons(4) allowing sparc64 (other architectures later) to find out which PCI device it's using.
- Enable userland crypto(4) support for DSA. Maybe logging in using ssh2 on a 486 needn't take 20 seconds after all.
- Kernel changes and sysctl(3) switch for hardware asymmetric crypto(4) in userland. !
- Add initial Ultra Port Architecture (upa(4/SPARC64)) support. Attach creator(4) and schizo(4) using it.
- Import new vax boot code from NetBSD.
- Add umct(4) USB serial driver and .umidi(4) USB MIDI driver. Not tested, not in GENERIC.
- Add IPL_STATCLOCK and add lots of
splassert()s. --- 209,221 ----- Add some inlined hash functions for the kernel, in
<sys/hash.h>.- Cleanup work on conditional evaluation in make(1).
- isakmpd(8) accepts IPComp flows. !
- Drop pf(4)
scrub(fragcache)syntax in favour of thefragment ...option inscrubrules.- Teach tcpdump(8) about ipcomp(4).
- Show sparc64's X server which device it wants to
mmap().- Add ioctl to wscons(4) allowing sparc64 (other architectures later) to find out which PCI device it's using.
- Enable userland crypto(4) support for DSA. Maybe logging in using ssh2 on a 486 needn't take 20 seconds after all.
- Kernel changes and sysctl(3) switch for hardware asymmetric crypto(4) in userland. !
- Add initial Ultra Port Architecture (upa(4/SPARC64)) support. Attach creator(4) and schizo(4) using it.
- Import new vax boot code from NetBSD.
- Add umct(4) USB serial driver and .umidi(4) USB MIDI driver. Not tested, not in GENERIC.
- Add IPL_STATCLOCK and add lots of
splassert()s. *************** *** 210,216 ****- Much cleanup in
distrib/miniroot.- Make pfctl(8)
-s stateprint UDP and 'other' states nicely.- New
scrub(fragcache) ...syntax for pf(4). !- Add mbuf_tag(9)
PACKET_TAG_PF_FRAGCACHEto stop pf(4) misdetecting duplicate fragments.- pf(4) NAT proxy port ranges can be specified per-rule.
- Don't panic(9) if pf(4) tries to insert a duplicate key.
- pf(4) NAT and filter rules now all go in the one file (normally pf.conf(5).) New pfctl(8) file syntax. Oh yes. --- 223,229 ----
- Much cleanup in
distrib/miniroot.- Make pfctl(8)
-s stateprint UDP and 'other' states nicely.- New
scrub(fragcache) ...syntax for pf(4). !- Add mbuf_tags(9)
PACKET_TAG_PF_FRAGCACHEto stop pf(4) misdetecting duplicate fragments.- pf(4) NAT proxy port ranges can be specified per-rule.
- Don't panic(9) if pf(4) tries to insert a duplicate key.
- pf(4) NAT and filter rules now all go in the one file (normally pf.conf(5).) New pfctl(8) file syntax. Oh yes. *************** *** 228,234 ****
- Define
__weak_alias()for mvme88k.- Merge GNU TeXinfo 4.2.
- Prevent mbuf(9) leakage from bridge(4). !
- New bad144(8).
- user(8) now checks the username length against MaxUserNameLen.
- Add bio(4) device, so userland can talk to devices that don't have nodes in
/dev.- Remove KerberosIV startup code from rc(8) files. --- 241,247 ----
- Define
__weak_alias()for mvme88k.- Merge GNU TeXinfo 4.2.
- Prevent mbuf(9) leakage from bridge(4). !
- New bad144(8).
- user(8) now checks the username length against MaxUserNameLen.
- Add bio(4) device, so userland can talk to devices that don't have nodes in
/dev.- Remove KerberosIV startup code from rc(8) files. *************** *** 245,251 ****
- Fix PR2704 resuming eso(4) after standby.
- Change a lot of index(3) calls to strchr(3).
- Change "'cuz" to "because." Strewth! !
- Add another mbuf(9) flag M_AUTH_AH, changing the meaning of M_AUTH.
- Remove a bunch of '
\n's from syslog(3) and err(3) calls.- Make isakmpd(8) IKECFG support work for both SET/ACK and REQ/REPLY modes.
- Fixes for OpenSSL when talking to hardware crypto(4). --- 258,264 ----
- Fix PR2704 resuming eso(4) after standby.
- Change a lot of index(3) calls to strchr(3).
- Change "'cuz" to "because." Strewth! !
- Add another mbuf(9) flag M_AUTH_AH, changing the meaning of M_AUTH.
- Remove a bunch of '
\n's from syslog(3) and err(3) calls.- Make isakmpd(8) IKECFG support work for both SET/ACK and REQ/REPLY modes.
- Fixes for OpenSSL when talking to hardware crypto(4). *************** *** 287,297 ****
- Rule label length increased from 32 to 64 characters.
- Allow modification of TTL with pf(4)
return-rst.- Timeout handling improvements to ohci(4). !
- Make netstat(6) print RIP6 statistics.
- Allow a per-rule limit to the number of state table entries a pf.conf(5) rule can create.
- Switch pf(4) from AVL to red-black trees.
- Add Gemplus GPR400 PCMCIA smartcard reader. !
- If sending on another interface, resubmit pf(4) routed packets for filtering and NAT by
pf. Add an mbuf_tag(9) to stop loops forming.- Don't propose IDEA when negotiating SSL connections.
$srcaddr,$srcport,$dstaddr,$dstport,$protoand$nr(rule number) can now be used in pfctl(8) rule labels.- Make a kernel TCP RST and a pf(4)
return-rstlook the same, to frustrate the nmap crowd. --- 300,310 ----- Rule label length increased from 32 to 64 characters.
- Allow modification of TTL with pf(4)
return-rst.- Timeout handling improvements to ohci(4). !
- Make netstat(1) print RIP6 statistics.
- Allow a per-rule limit to the number of state table entries a pf.conf(5) rule can create.
- Switch pf(4) from AVL to red-black trees.
- Add Gemplus GPR400 PCMCIA smartcard reader. !
- If sending on another interface, resubmit pf(4) routed packets for filtering and NAT by
pf. Add an mbuf_tags(9) to stop loops forming.- Don't propose IDEA when negotiating SSL connections.
$srcaddr,$srcport,$dstaddr,$dstport,$protoand$nr(rule number) can now be used in pfctl(8) rule labels.- Make a kernel TCP RST and a pf(4)
return-rstlook the same, to frustrate the nmap crowd. *************** *** 313,320 ****- Disable XF86_SVGA drivers in old XFree that are as good or better in XFree86 4.2.0, as defined in their status page.
- bpf(4) support for kqueue(2)
- In isakmpd(8), add netmask, subnet and DHCP server request support to IKECFG. !
- Fix bktr(4) stereo. !
- Support the RNG of AMD-768 southbridge (device amdpm(4).)
- Fix DMA handing of hme(4) (SPARC and SPARC64.)
- Pull in
libcsuchange from NetBSD to allow dlopen(3) to be used much earlier.- Add
-tkey lifetime option to ssh-add(1). --- 326,333 ----- Disable XF86_SVGA drivers in old XFree that are as good or better in XFree86 4.2.0, as defined in their status page.
- bpf(4) support for kqueue(2)
- In isakmpd(8), add netmask, subnet and DHCP server request support to IKECFG. !
- Fix bktr(4) stereo. !
- Support the RNG of AMD-768 southbridge (device amdpm(4).)
- Fix DMA handing of hme(4) (SPARC and SPARC64.)
- Pull in
libcsuchange from NetBSD to allow dlopen(3) to be used much earlier.- Add
-tkey lifetime option to ssh-add(1). *************** *** 322,328 ****- Add predicate suffixes to systrace(1).
- Add
-xand-Xoptions to respectively lock and unlock ssh-agent(1).- Compatibility tweaks to
getpid(),getuid()andgetgid()under Linux emulation. !- Start work on new debugger, pmdb.
- Additional check (#ifdef DIAGNOSTIC) for duplicate uvm(9) map entries.
- If syslog(3) fails with ENOBUFS when sending to
/dev/log, it now waits a millisecond and retries.- syslogd(8) doubles the socket receive buffer size. --- 335,341 ----
- Add predicate suffixes to systrace(1).
- Add
-xand-Xoptions to respectively lock and unlock ssh-agent(1).- Compatibility tweaks to
getpid(),getuid()andgetgid()under Linux emulation. !- Start work on new debugger, pmdb.
- Additional check (#ifdef DIAGNOSTIC) for duplicate uvm(9) map entries.
- If syslog(3) fails with ENOBUFS when sending to
/dev/log, it now waits a millisecond and retries.- syslogd(8) doubles the socket receive buffer size. *************** *** 351,357 ****
- '
pfctl -s all' now prints labels as well.- Add
volatiletosig_atomic_t. Stand well back.- Use rasops instead of rcons in cgthree(4/SPARC) and cgsix(4/SPARC). !
- Simplify IPv6 link MTU code.
- Stop maintaining 2.9-stable.
- Bump 2.9-stable to OpenSSH version 3.2.3.
- Bump 3.0-stable to OpenSSH version 3.2.3. --- 364,370 ----
- '
pfctl -s all' now prints labels as well.- Add
volatiletosig_atomic_t. Stand well back.- Use rasops instead of rcons in cgthree(4/SPARC) and cgsix(4/SPARC). !
- Simplify IPv6 link MTU code.
- Stop maintaining 2.9-stable.
- Bump 2.9-stable to OpenSSH version 3.2.3.
- Bump 3.0-stable to OpenSSH version 3.2.3. *************** *** 367,375 ****
- Fix
/etc/ptmpdeletion bug that occurred if rmuser(8) was aborted.- IBSS mode for Symbol cards (firmware >= 2.5) using the wi(4) driver.
- Add leading-zero padding to RSA signatures in ssh. !
- Tweak altq(4) options(4) so the kernel compiles on i[34]86.
- Add support in the fxp(4) driver for more Intel PRO/100 VM cards. !
- For those that do metric but refuse to work in meters and kilograms, kayser conversion has been added to units(1).
- Fix signal races in ping(8).
- Now that the Dungeon Master dm(1) has gone into well-earned retirement, make those games that need to save high scores, etc. run setgid
games.- Per-socket ipsec(4) policies and options! --- 380,388 ----
- Fix
/etc/ptmpdeletion bug that occurred if rmuser(8) was aborted.- IBSS mode for Symbol cards (firmware >= 2.5) using the wi(4) driver.
- Add leading-zero padding to RSA signatures in ssh. !
- Tweak altq(9) options(4) so the kernel compiles on i[34]86.
- Add support in the fxp(4) driver for more Intel PRO/100 VM cards. !
- For those that do metric but refuse to work in meters and kilograms, kayser conversion has been added to units(1). Wow.
- Fix signal races in ping(8).
- Now that the Dungeon Master dm(1) has gone into well-earned retirement, make those games that need to save high scores, etc. run setgid
games.- Per-socket ipsec(4) policies and options! *************** *** 386,393 ****
- Add
-[46]options to ftp(1).- Warn to syslog if IPv6 neighbor discovery tries to set the link MTU too small.
- Make tip(1) query the driver with the user's baud rate setting rather than only accepting a compiled-in list. !
- Support Sun type 5 keyboards, as some keycodes are rather helpfully switched around from type 4. !
- Cleanup and small fixes to skeyaudit(8).
- Fixes to fms(4).
- Various fixes and enhancements to mg(1).
- sshd(8) no longer starts in privilege-separated mode unless the PrivSep user
sshdand chroot(2) dir/var/emptyare both present. --- 399,406 ----- Add
-[46]options to ftp(1).- Warn to syslog if IPv6 neighbor discovery tries to set the link MTU too small.
- Make tip(1) query the driver with the user's baud rate setting rather than only accepting a compiled-in list. !
- Better wscons(4) support for Sun type 5 keyboards. !
- Cleanup and small fixes to skeyaudit(1).
- Fixes to fms(4).
- Various fixes and enhancements to mg(1).
- sshd(8) no longer starts in privilege-separated mode unless the PrivSep user
sshdand chroot(2) dir/var/emptyare both present. *************** *** 401,407 ****- Use the correct string buffer size for printing port numbers in pfctl(8).
- Remove
arc4random_8().struct ifnetnow has an array of pointers to data for each address family. Move per-interface IPv6 state and neighbor discovery stuff here. !- netstat(8) cleanup.
- ping6(8) and traceroute6(8) updates from KAME.
unsigned->unsigned intcleanup.pid_ttype cleanup. --- 414,420 ----- Use the correct string buffer size for printing port numbers in pfctl(8).
- Remove
arc4random_8().struct ifnetnow has an array of pointers to data for each address family. Move per-interface IPv6 state and neighbor discovery stuff here. !- netstat(1) cleanup.
- ping6(8) and traceroute6(8) updates from KAME.
unsigned->unsigned intcleanup.pid_ttype cleanup. *************** *** 412,418 ****- vax: Add board type for VXT2000+.
- More IANA interface type values, including IFT_BRIDGE.
- Split XFree86
bsd_video.cinto architecture-specific files. !- Add sysctl(8) toggle
net.inet.icmp.tstamprepl(default: 1) for ICMP timestamp replies.- Yet more safe string function fixes.
- In XFree86 build, honour COPTS variable when building third-party apps.
- Add
LIBSoption forcrunchgenso custom libraries can be added to boot images. --- 425,431 ----- vax: Add board type for VXT2000+.
- More IANA interface type values, including IFT_BRIDGE.
- Split XFree86
bsd_video.cinto architecture-specific files. !- Add sysctl(8) toggle
net.inet.icmp.tstamprepl(default: 1) for ICMP timestamp replies.- Yet more safe string function fixes.
- In XFree86 build, honour COPTS variable when building third-party apps.
- Add
LIBSoption forcrunchgenso custom libraries can be added to boot images. *************** *** 591,597 ****
www@openbsd.org
!
$OpenBSD: plus.html,v 1.831 2002/07/05 23:32:44 deraadt Exp $ - Skip routing table lookup when {broad,multi}casting and the outgoing interface is set using setsockopt(2). Removes the need for a