We are working on OpenBSD-current.
! The following list sums up (almost) all the changes made up to February 1.
-
+
+
- Make pf(4) build without IPv6. +
- Fix an mbuf leak in the ESP code. +
- Correct a bad array index in netstat(1). + +
- Fix multicast problems with vlan(4), and also remove some unnecessary Ethernet-specificity from the driver. +
- Really fix combination of pf(4) translation and route-to/reply-to. +
- Check TCP, UDP, ICMP and ICMP6 checksums in pf(4), and make the sum isn't recalculated when the packet hits layer 4 in the kernel. Packets with invalid checksums are silently dropped, to avoid firewall detection by use of filter responses to bad packets. +
- Make pf(4)'s TCP state inspection RFC 763 compliant, and send a reset when presented with SYN-cookie schemes that send out-of-window ACKs during the TCP handshake. +
- Now that route(8) is no longer setuid root, check the effective uid instead of the real uid. +
- Fix a number of filesystem locking issues, for details see the checkin comment. +
- Fix an ICMP mbuf leak.
+ [Applied to stable] + + - Create a fake siginfo_t for pthread_kill(3). +
- Stop dhcpd(8) and dhcrelay(8) trying to use dead interfaces. +
- For ELF images, put .rodata in a separate section to the program text, so the read-only data is no longer executable. +
- New pf.conf(5) interface modifiers: <if>:network for the interface's connected network(s) and <if>:broadcast for the interface's broadcast address(es). +
- Have spamd(8) revoke privileges earlier so it can bind to a priviliged port if desired. + +
- Mirror the a.out initialise-dependent-libraries-first change for ELF. +
- For POSIX reasons, make setre[ug]id(2) real system calls again (albeit still implemented using setres[ug]id()) instead of 4.3BSD compatibility library calls. +
- authpf(8) sets the process title to '<user>@<ip>'. + +
- Add a missing ntohs in tcpdump(8) so that pf(4) actions get printed correctly. + +
- Make the resolver code in libc more thread-safe. +
- Fix an fd_set overflow in telnetd(8). +
- Improvements to pthreads signal handling. See the checkin comment for details. +
- For eg(4), el(4), ie(4/HPPA) and url(4) zero-pad frames smaller than the minimum frame length. +
- Update the termcap entry colours for wsvt25 to match reality. +
- If the -a option is given to pfctl(8) to specify an anchor, don't allow operations that have a global effect. +
- Make sure tcpdump(8) correctly exits from the loop that prints IPv6 option headers. + +
- Use record instead of play parameters to calculate the record high watermark in audio(4). +
- Don't have ftp-proxy(8) remove leading spaces, this can break multiline commands. +
- Further cleanups and shrinkage of the installer scripts. + +
- Correct operation of pf(4) rdr rules involving port ranges. Now the from- and to-range sizes can differ. +
- Stop bogus packet drops during pf(4) normalisation when an offset went negative. +
- Fix pfctl(8) -n option operation with table statements. +
- Allow pf(4) tables to be initialised from a file listed in pf.conf(5). +
- Better checking and error reporting for illegal table-related constructs in pf(4) rules. +
- Improve TCP performance by sending segments of no more than half the send buffer space limit. This means that (if enough data is available to be sent) there will always be at least two segments sent. A BSD receiver-TCP will turn off delayed ACKs with more than one un-ACK'd packet on a socket. + +
- Improvements to newsyslog(8) monitor mode. +
- Plug a potential memory leak in spamd(8). +
- Make sure xinit(1) never leaks the MIT_MAGIC_COOKIE via the command line. +
- Fix vipw(8)'s use of timestamps to detect changes to the temp file. +
- Make sure a thread's signal handlers aren't run until the thread is made current. +
- Save the fpu state when switching threads on i386 and sparc64, floating-point preemption regression tests now pass on these architectures. +
- Fix ndc(8)'s reading of the rc.conf(8) variable NAMED_FLAGS. +
- Fixes to pf(4)'s TCP window scaling support. +
- pfctl -vvsq display (altq stats) gets more useful, showing bandwidth and packet rate stats for CBQ and PRIQ. +
- Install nslookup(8) along with BIND 9, and don't print the irritating deprecation warning. + +
- ftp-proxy(8) now honours the TCP_WRAPPERS setting in mk.conf. +
- Allow cvs(1) Checkin-Prog and Update-prog to be disabled with the new CVSROOT/config option "DisableXProg" +
- Always use splimp(9) in wi(4), fixing some transmission failures. +
- Add -1 and -2 options to scp(1) to force SSH protocol 1 or 2 respectively. +
- New -l bandwidth-limiter option for scp(1). +
- New -c option to ssh-add(1), that forces ssh-agent(1) to pop up a dialog requesting confirmation of the use of a stored key. +
- Don't have pf(4) crash the kernel when translating icmp6 packets. + +
- More updates to unifdef(1). + +
- strcpy -> strlcpy in ftp(1) macro expansion. +
- pf(4) tables automatically spring into existence when referred to by pfctl(8) add or replace commands. +
- Add RFC 1323 TCP window scaling support to pf(4). +
- Improvements to wi(4) hostap timeouts. +
- Add new ssh-agent(1) -t option to set the default key lifetime. +
- Add a generic watchdog interface and sysctl(8) kern.watchdog. +
- Shrink wi(4) and save some space on the install floppies by removing hostap code when compiled with -DSMALL_KERNEL. +
- Use the right variable type when traceroute6(8) fetches the default hop limit via sysctl(3). +
- Tweak compat_linux(8) socket syscall emulation. Improves emulation of programs using UDP. +
- Fix an incorrect argument length passed to setsockopt(2) by traceroute6(8). + +
- bzero() after malloc(9) in siop(4).
+ [Applied to stable] + - Have /etc/rc generate the BIND 9 rndc(8) shared secret if it doesn't exist. +
- Add BIND 9 configuration files. +
- Skip DNSSEC programs in BIND 9. +
- Begin import of BIND 9.2.2rc1. (Local changes documented in README.OpenBSD.) +
- Fix some silly pastos in pfctl(8) table code. +
- Create /var/empty/dev/log for programs that chroot(2) to /var/empty. +
- Fix a typo in pf(4) DIOCRSETTFLAGS implmentation, so it doesn't look like changing a table flag created a table when in fact it deleted one. +
- Stop syslog(3) from reconnecting to /dev/log on an ENOBUFS as this doesn't help, and it hurts chroot(2)'ed processes. +
- Change chroot(2)'ed daemons portmap(8), rstatd(8) and rusersd(8) to use openlog(3) with LOG_NDELAY. +
- Implement sigaltstack(2) under pthreads. +
- Copy the thread sources (including CVS history) from lib/libc_r to lib/pthread, and move libc_r into the Attic. +
- Make pfctl(8) show more information with -vvs[rn] for rules containing tables. + +
- SECURITY FIX: January 20, 2003: A double free in cvs(1) could allow an attacker to execute code with the privileges of the user running cvs. This is only an issue when the cvs command is being run on a user's behalf as a different user. This means that, in most cases, the issue only exists for cvs configurations that use the pserver client/server connection method.
+ A source code patch is available.
+ [Applied to stable] + - Add an invalid ioctl sanity check to gif(4). +
- Bring perl(1)'s build into line with the libc_r -> pthread move. +
- Big improvements to a.out library dependency handling. +
- Make select(2) a thread cancellation point as per the standard. +
- Fix some locking-related raidctl(8) panics. + +
- Updates to unifdef(1). +
- Fix a null deref in pfctl(8) when processing the -k option. +
- Big cleanup of host() in the pfctl(8) parser. +
- When running pfctl(8) with insufficient privileges to open /dev/pf, make the -n option work as a syntax checker for table commands. +
- Unbreak pf(4) nat random source port assignment. Now a rule has to actually ask for static-port in order to get it.
- Enable the pfctl(8) 'static-port' keyword.
- Extensive ld(1) changes to better protect ELF executables from tampering (see the checkin comment for details.) *************** *** 71,79 ****
- Create PIC archives for a number of X libs, useful for ports that create shared libraries.
- Stop nfsstat(1) displaying info for the no-longer-supported NQNFS protocol.
- Fix nfsstat(1)'s filesystem id lookup, and a minor buffer overrun. !
- Fix some minor bugs in pf(4) radix table creation.
- Have pfctl(8) recognise the '-T load' option like it used to. !
- Plug a memory leak in the pf(4) radix table code when using PFR_FLAG_DUMMY.
- For the benefit of dhclient(8), allow outbound pings from the initial pf(4) rulebase installed by rc(8).
- Pull all the IP address parsing code of pfctl(8) into one place. --- 177,185 ----
- Create PIC archives for a number of X libs, useful for ports that create shared libraries.
- Stop nfsstat(1) displaying info for the no-longer-supported NQNFS protocol.
- Fix nfsstat(1)'s filesystem id lookup, and a minor buffer overrun. !
- Fix some minor bugs in pf(4) table creation.
- Have pfctl(8) recognise the '-T load' option like it used to. !
- Plug a memory leak in the pf(4) table code when using PFR_FLAG_DUMMY.
- For the benefit of dhclient(8), allow outbound pings from the initial pf(4) rulebase installed by rc(8).
- Pull all the IP address parsing code of pfctl(8) into one place. *************** *** 83,98 ****
- /etc/weekly is now built (by default) in /var/tmp rather than /tmp.
- Add an extra sanity check in malloc(3) to prevent size_t overflows. !
- Better input checking and error handling in the pf(4) radix tables code.
- Begin converting vmstat(8) with the -i option to use sysctl(3) instead of kvm.
- Start work on NVIDIA nForce support. !
- pf(4) radix tables now understand CIDR-notation IPv4 addresses.
- Some command-line fixes and tweaks to rusers(1).
- Stop rm(1) with the -P option from overwriting files with multiple links. !
- Fix handling of addition and subtraction of negated addresses to radix tables in pfctl(8).
- In ssh(1) only show the socket(2) error for the last address to which one tries to connect.
- Don't fill files full of holes with ftruncate(2) after a write error in rcp(1) and scp(1).
- Add a progress meter to the sftp(1) client. --- 189,204 ----
- /etc/weekly is now built (by default) in /var/tmp rather than /tmp.
- Add an extra sanity check in malloc(3) to prevent size_t overflows. !
- Better input checking and error handling in the pf(4) table code.
- Begin converting vmstat(8) with the -i option to use sysctl(3) instead of kvm.
- Start work on NVIDIA nForce support. !
- pfctl(8) now supports CIDR-notation IPv4 addresses when manipulating tables.
- Some command-line fixes and tweaks to rusers(1).
- Stop rm(1) with the -P option from overwriting files with multiple links. !
- Fix handling of addition and subtraction of negated addresses to tables in pfctl(8).
- In ssh(1) only show the socket(2) error for the last address to which one tries to connect.
- Don't fill files full of holes with ftruncate(2) after a write error in rcp(1) and scp(1).
- Add a progress meter to the sftp(1) client. *************** *** 101,108 ****
- Various strl* return value checks in pfctl(8).
- Initial support for queue statistics display for pfctl(8) (-vsq option.)
- 'Default-Phase-1-Configuration' -> 'Default-phase-1-configuration', 'Default-Phase-2-Suites' -> 'Default-phase-2-suites' in isakmpd(8). !
- New radix table manipulation syntax for pf.conf(5), and a corresponding new -Tl option for pfctl(8). !
- Add support for active/inactive pf(4) radix tablesets in the kernel
- Enable SET/ACK in isakmpd(8) when acting as an ike-mode-cfg responder.
- Improvements and fixes to batch mode sftp(1). --- 207,214 ----
- Various strl* return value checks in pfctl(8).
- Initial support for queue statistics display for pfctl(8) (-vsq option.)
- 'Default-Phase-1-Configuration' -> 'Default-phase-1-configuration', 'Default-Phase-2-Suites' -> 'Default-phase-2-suites' in isakmpd(8). !
- New table manipulation syntax for pf.conf(5), and a corresponding new -Tl option for pfctl(8). !
- Add support for active/inactive pf(4) tablesets in the kernel
- Enable SET/ACK in isakmpd(8) when acting as an ike-mode-cfg responder.
- Improvements and fixes to batch mode sftp(1). *************** *** 117,123 ****
- pfctl(8)'s string parser can handle strings beginning with an underscore, useful for all those new daemon usernames.
- Have authpf(8) clean up after failed previous incarnations of itself.
- Don't allow s[eh]mmni to be set (via the newish sysctl(8) interface) greater than 0xffff, to prevent id collisions due to wraparound. !
- pf(4) radix tables now spring into and out of existence on demand.
- Fix the sudoers(5) parser's handling of EOF not preceded by newline.
- Stop sftp(1) from always adding u+w permissions to files pulled by get -p.
- Values set in sysctl.conf(5) can contain spaces when quoted as for sh. --- 223,229 ----
- pfctl(8)'s string parser can handle strings beginning with an underscore, useful for all those new daemon usernames.
- Have authpf(8) clean up after failed previous incarnations of itself.
- Don't allow s[eh]mmni to be set (via the newish sysctl(8) interface) greater than 0xffff, to prevent id collisions due to wraparound. !
- pf(4) tables now spring into and out of existence on demand.
- Fix the sudoers(5) parser's handling of EOF not preceded by newline.
- Stop sftp(1) from always adding u+w permissions to files pulled by get -p.
- Values set in sysctl.conf(5) can contain spaces when quoted as for sh. *************** *** 139,145 ****
- Remove code in ld(1) to force linking against a specific library version.
- Add console support for Polish and Turkish keyboard layouts. !
- Add the userland support for pf(4) radix tables to pfctl(8) and authpf(8).
- Remove reference to the now obsolete screenblank from /etc/rc.
- Fix dig(1) time display on 64-bit big-endian targets.
- Do a bridge(4) routing update if the source interface is in the LEARNING state, not the destination interface. --- 245,251 ----
- Remove code in ld(1) to force linking against a specific library version.
- Add console support for Polish and Turkish keyboard layouts. !
- Add the userland support for pf(4) tables to pfctl(8) and authpf(8).
- Remove reference to the now obsolete screenblank from /etc/rc.
- Fix dig(1) time display on 64-bit big-endian targets.
- Do a bridge(4) routing update if the source interface is in the LEARNING state, not the destination interface. *************** *** 148,159 ****
- Have syslog(3) parse '%%m' correctly.
- Fix a null deref in at(1).
- Require a direction for pf(4) rules that do routing. -
- When combining (route|reply)-to and translation in pf(4) rules, make sure a state table insertion is only attempted once.
- Note (in the system copyright message) that it's now 2003.
- Update to sendmail 8.12.7.
- Have tcpdump(8) display all pf(4) rule types instead of just pass/block rules. !
- Make the pf(4) radix table code handle duplicate table names and/or duplicate addresses in a single ioctl(2) call.
- Remove the pf(4) skip-step for rule action (scrub or no-scrub.)
- Properly update pf(4) scrub rule statistics. --- 254,265 ----
- Have syslog(3) parse '%%m' correctly.
- Fix a null deref in at(1).
- Require a direction for pf(4) rules that do routing.
- When combining (route|reply)-to and translation in pf(4) rules, make sure a state table insertion is only attempted once. +
- Note (in the system copyright message) that it's now 2003.
- Update to sendmail 8.12.7.
- Have tcpdump(8) display all pf(4) rule types instead of just pass/block rules. !
- Make the pf(4) table code handle duplicate table names and/or duplicate addresses in a single ioctl(2) call.
- Remove the pf(4) skip-step for rule action (scrub or no-scrub.)
- Properly update pf(4) scrub rule statistics. *************** *** 182,188 ****
- Make 'pfctl -a name -s[rn]' show all rules or nats in all rulesets on anchor 'name'.
- In authpf(8), set the macro '$user_id' to the username.
- Fix a couple of missed semaphore counter updates. !
- Add kernel portion of radix table support for pf(4) rule source and destination addresses.
- Remove an extraneous semicolon in <sys/cdefs.h> that broke some C++ compilers.
- Fix an amusingly incorrect calloc(3) size in nc(1). --- 288,294 ----
- Make 'pfctl -a name -s[rn]' show all rules or nats in all rulesets on anchor 'name'.
- In authpf(8), set the macro '$user_id' to the username.
- Fix a couple of missed semaphore counter updates. !
- Add kernel portion of pf(4) support for efficient tables of addresses (currently implemented as radix tables similar to the kernel routing table).
- Remove an extraneous semicolon in <sys/cdefs.h> that broke some C++ compilers.
- Fix an amusingly incorrect calloc(3) size in nc(1). *************** *** 207,214 ****
- Avoid a null deref in pppd(8).
- Remove a couple of extra ntohs(3) calls in pfsync(4).
- Cleanup of atactl(8). !
- Update Perl's Safe(3p) module to 2.09, fixing a security hole.
- newsyslog(8) error messages now contain the line number.
- Have 'chroot -U' do a setlogin(2) if the caller is, or can be made into, the session leader.
- Make chroot(8) check for $SHELL defined as null as well as for undef. --- 313,323 ----
- Avoid a null deref in pppd(8).
- Remove a couple of extra ntohs(3) calls in pfsync(4).
- Cleanup of atactl(8). +
- Fix device attachment bug in siop(4).
+ [Applied to stable] ! - Update Perl's Safe(3p) module to 2.09, fixing a security hole.
! [Applied to stable] - newsyslog(8) error messages now contain the line number.
- Have 'chroot -U' do a setlogin(2) if the caller is, or can be made into, the session leader.
- Make chroot(8) check for $SHELL defined as null as well as for undef. *************** *** 389,396 ****
- Tweak pf(4)'s handling of address families in rules.
- Make pfctl(8) fetch the address properly for lo(4) with LINK1 set.
- Use 1KB = 1000B instead of 1024B when dealing with bandwidth in pf(4). !
- Fix URL CRLF injection bug in lynx(1). !
- Add a missing check for snprintf errors in identd(8).
- Protect arc4_getbyte() with an splhigh().
- Some cleanup in talkd(8). --- 498,505 ----
- Tweak pf(4)'s handling of address families in rules.
- Make pfctl(8) fetch the address properly for lo(4) with LINK1 set.
- Use 1KB = 1000B instead of 1024B when dealing with bandwidth in pf(4). !
- Fix URL CRLF injection bug in lynx(1).
! [Applied to stable] - Add a missing check for snprintf errors in identd(8).
- Protect arc4_getbyte() with an splhigh().
- Some cleanup in talkd(8). *************** *** 477,484 ****
- Allow '$' as the last character of a username, to appease Samba.
- Make sshd(8)'s -e option (log to stderr) work.
- Make the minimum file rotation size 512 bytes instead of 512Kbytes... !
- Rearrange payload length check for ESP packets so packets with NULL encryption are tested also. !
- Don't allow a simple non-existent server to crash altqstat(1).
- Solve problems static linking with -lpthread. (-static -pthread still broken.) --- 586,593 ----
- Allow '$' as the last character of a username, to appease Samba.
- Make sshd(8)'s -e option (log to stderr) work.
- Make the minimum file rotation size 512 bytes instead of 512Kbytes... !
- Rearrange payload length check for ESP packets so packets with NULL encryption are tested also.
! [Applied to stable] - Don't allow a simple non-existent server to crash altqstat(1).
- Solve problems static linking with -lpthread. (-static -pthread still broken.) *************** *** 487,493 ****
- Keep a correct reference count to the file referenced by ioctl(2) under SVR4 emulation. !
- Gracefully handle broken firewalls that block ECN-enabled TCP sessions by falling back to non-ECN.
- Some thread-safety fixes to libc.
- Add a cast to handle properly size_t larger than u_int in ssh(1).
- Fix some problems gzip(1) had displaying information on files > 2GB. --- 596,603 ----
- Keep a correct reference count to the file referenced by ioctl(2) under SVR4 emulation. !
- Gracefully handle broken firewalls that block ECN-enabled TCP sessions by falling back to non-ECN.
! [Applied to stable] - Some thread-safety fixes to libc.
- Add a cast to handle properly size_t larger than u_int in ssh(1).
- Fix some problems gzip(1) had displaying information on files > 2GB. *************** *** 516,523 ****
- To a chorus of approval, add the 'set require-order [yes|no]' option to pf.conf(5).
- Remove a bogus test in dd(1) that stopped a perfectly legal seek on a character device. !
- Merge mod_ssl 2.8.12, fixing a cross-site scripting bug and two off-by-ones. !
- Add a missing break statement in systrace(1)'s arguments parsing code.
- Add getdents64() support under Linux emulation. --- 626,633 ----
- To a chorus of approval, add the 'set require-order [yes|no]' option to pf.conf(5).
- Remove a bogus test in dd(1) that stopped a perfectly legal seek on a character device. !
- Merge mod_ssl 2.8.12, fixing a cross-site scripting bug and two off-by-ones.
! [Applied to stable] - Add a missing break statement in systrace(1)'s arguments parsing code.
- Add getdents64() support under Linux emulation. *************** *** 599,605 ****
- pf(4) can now binat a whole netblock with one rule.
- Remove a potential null pointer deref in BSD authentication code. !
- Fix a bad printf format string in ftpd(8). Non-critical because it's only ever fed by parts of the authentication system which sanitise the input first.
- Do some more unsigned checks to system call parameters, as with the setitimer(2) erratum.
[Applied to stable] --- 709,716 ---- - pf(4) can now binat a whole netblock with one rule.
- Remove a potential null pointer deref in BSD authentication code. !
- Fix a bad printf format string in ftpd(8). Non-critical because it's only ever fed by parts of the authentication system which sanitise the input first.
! [Applied to stable] - Do some more unsigned checks to system call parameters, as with the setitimer(2) erratum.
[Applied to stable] *************** *** 684,690 ****
www@openbsd.org
!
$OpenBSD: plus.html,v 1.856 2003/01/18 20:05:08 deraadt Exp $