We are working on OpenBSD-current.
! The following list sums up (almost) all the changes made up to February 7.
-
+
- Don't fully unroll kernel rijndael code to save some space. +
- Some fixes to ahc(4), mostly from FreeBSD. + +
- Additional sanity checks when probing scsi(4) luns. +
- Disable interrupts on a scsi(4) controller for polled commands, fixing a long-standing hang at attach time on i386. +
- Stop dhclient(8) burping interface information to stderr. + +
- Have libpcap(3) use the kernel default buffer size instead of setting its own size. +
- Bump the bpf(4) maximum buffer size to 2MB, and the default size to 32KB, to allow for faster networks and larger frame sizes. +
- Turn on ddb(4) logging (sysctl(3) ddb.log) by default. +
- Allow bind(2) to work in an IPv6-only (no IPv4) configuration. +
- First cut of a filtering language for bgpd(8). +
- Another pass at making dhclient(8)'s code readable. + +
- Fix a curiously familiar reference-counting bug in uvm(9). +
- SECURITY FIX: A reference-counting bug exists in the shmat(2) system call that could be used by an attacker to write to kernel memory under certain circumstances. Adapted from FreeBSD.
+ A source code patch is available.
+ [Applied to stable] + - Fix a CVS merge error in xterm(1)'s app-defaults file. +
- Make pfctl(8) -vvsq loop again (PR#3675.) +
- Unbreak the ssh(1) progress meter ETA for files larger than 4GB (OpenSSH bugzilla #791.) +
- Fix a memory leak in dhclient(8) (PR#3668.) +
- If ssh(1) is in privsep mode, pass the SIGALRM from LoginGraceTime expiry through to the child process. +
- Apply the same strict RFC 2460 interpretation used for the IPv6 MTU to the tcp MSS calculation. + +
- New parser for ifstated(8), and more features. Still more to come. +
- Fix grep(1)'s ^ and $ anchors that were broken by the recent -w fixes. +
- For programs that don't support long options, stop getopt(3) treating '--foo' the same way it treats '--', as per POSIX (PR#3666.) +
- Let pfctl(8) deal gracefully with 'modulate state' on rules with protos to which it might not apply in the same way as 'keep state', e.g. 'pass proto {tcp udp} modulate state' is now acceptable. +
- Don't use a valid user id as a flag value in ps(1). +
- Remove the earlier fix for the IPv6 MTU crash bug now that the full fix is in place. +
- SECURITY FIX: An IPv6 MTU handling problem exists that could be used by an attacker to cause a denial of service attack against hosts with reachable IPv6 TCP ports. Fix this fully by applying a strict interpretation of RFC 2460 section 5, last paragraph.
+ A source code patch is available.
+ [Applied to stable] + - Memory alignment fixes in tcpdump(8). +
- Huge amount of style(9), ANSI and other cleanup in dhclient(8). More to come. + +
- Some std:: namespace and other C++ mode fixes for flex(1). From NetBSD. +
- Fix pfctl(8) macro expansion in tags (PR#3664.) +
- Unbreak and reapply the don't-use-inet_net_pton(3)-without-a-slash fix (PR#3638.) +
- Teach libcrypto(3) how to use the VIA C3 crypto functions for (seriously) accelerated aes-{128,192,256}-cbc. + +
- Do temp file cleanup for signals as well as exits in spell(1). +
- Sanity check memory allocation when attaching wd(4) devices. +
- Have mg(1) create a buffer list window when started with more than two files, just like emacs. +
- Fix compile breakage in bridge(4) and netinet6 when pf(4) isn't present. +
- In ipsecadm(8) monitor mode, reorder memset(3) arguments so it works less like a nop. +
- For safety, only do pf(4) interface lookups (pfi_index2kif()) if the filter is enabled. +
- Remove the special-case LBL_ALIGN code in tcpdump(8) and act as if we're always on a platform that requires aligned memory access. +
- In leave(1), don't allow alarms to be set in the past as this is unlikely to be useful. Also some cleanup based on NetBSD. +
- On i386, allow userland apps to use the VIA C3 crypto instructions if they're present. + +
- Temporarily work around an MTU-related crash in IPv6 by simply enforcing a minimum link MTU of 296. Real fix to come. +
- Add as(1) support for the VIA C3 xmove-rng and xcrypt-{ecb,cbc,cfb,ofb} instructions. +
- Allow '-' as a valid character in as(1) mnemonics, as required by a few VIA C3 instructions. +
- Add a 'paper.txt' make(1) target to generate ASCII output for the documents under /usr/share/doc. +
- Sync i386 option USER_LDT code with NetBSD, fixing some ports panics. +
- In libpthread, add a simple work-around for deadlocking on recursive readlocks on a rwlock while there are writers waiting (from FreeBSD PR#24641.) +
- Add ARM support and a new port for cats boards. + +
- Rename TCP socket option from TCP_SIGNATURE_ENABLE to TCP_MD5SIG. +
- Build protoize(1) for gcc3. +
- Reverse the enable logic for TCP selective acks, so TCP_SACK_DISABLE becomes TCP_SACK_ENABLE. +
- Really commit -L (localbase) support for pkg_create(1), as well as the related -S and -B options. +
- Some types cleanup and better SIGCHLD handling in privsep tcpdump(8).
- Fix an old logic bug in nlist(3) that caused lookups for names with a leading underscore to fail on ELF systems.
- Install ex(1) documentation in doc/usd/13.ex. *************** *** 66,71 **** --- 131,137 ----
- Enable tcpmd5 on bgpd(8)'s listen socket. For peers configured with md5sig, require accept(2)ed sockets to have signatures enabled.
- New TCP_SIGNATURE_ENABLE option to getsockopt(2), allowing a process to check the tcpmd5 status of an accept(2)ed socket.
- Support ssh(1) version 2 password change. password-dead must be set to non-zero in login.conf(5) for this to work. +
- New update-moduli target in /usr/src/etc/Makefile, for regenerating /etc/moduli(5).
- Format string fixes and other cleanup for fvwm(1) in the wake of -ansi removal.
- Remove -ansi from the list of gcc(1) build options for XFree86. *************** *** 75,81 ****
- Reset the tcp keepalive timer to tcp.keepidle (normally four hours) after the three-way handshake completes. (syncache sets it to tcp.keepinittime, normally 150 seconds.)
- Allow a single listen socket to be used for connections with and without tcpmd5.
- Avoid a long scsi(4) freeze when attaching live scsibus* devices. !
- Support RFC3390 'Increasing TCP's initial window' extension, enabled using sysctl(8) net.inet.tcp.rfc3390.
- When TCP is in the SYN_SENT state, don't increase cwnd by 1*MSS on receipt of the SYN/ACK.
- Note that 'pegasos' is not quite the same as 'pegosos'.
- Clean up the output from pfctl(8) with '-s all'. --- 141,147 ----
- Reset the tcp keepalive timer to tcp.keepidle (normally four hours) after the three-way handshake completes. (syncache sets it to tcp.keepinittime, normally 150 seconds.)
- Allow a single listen socket to be used for connections with and without tcpmd5.
- Avoid a long scsi(4) freeze when attaching live scsibus* devices. !
- Support RFC 3390 'Increasing TCP's initial window' extension, enabled using sysctl(8) net.inet.tcp.rfc3390.
- When TCP is in the SYN_SENT state, don't increase cwnd by 1*MSS on receipt of the SYN/ACK.
- Note that 'pegasos' is not quite the same as 'pegosos'.
- Clean up the output from pfctl(8) with '-s all'. *************** *** 104,111 ****
- Hash tcpmd5 TDB lookups by source address instead of the spi
- Add missing case for TCP MD5 sigs in SADB_GETPROTO().
- Let ipsecadm(8) pass the spi for TCP signatures. !
- Handle tftpd(8) tsize and timeout options. From FreeBSD, as was the RFC2347 support. !
- Add RFC2347 "TFTP Option Extension" support to tftpd(8). Try to ignore trailing garbage that Apple OpenFirmware can leave where an option should be.
- Make the package tools show strerror(3) output when die()ing on filesystem errors.
- Allow pkg_delete(1) to handle removal of packages with bogus dependencies, as could be created by earlier versions of the new package tools. --- 170,177 ----
- Hash tcpmd5 TDB lookups by source address instead of the spi
- Add missing case for TCP MD5 sigs in SADB_GETPROTO().
- Let ipsecadm(8) pass the spi for TCP signatures. !
- Handle tftpd(8) tsize and timeout options. From FreeBSD, as was the RFC 2347 support. !
- Add RFC 2347 "TFTP Option Extension" support to tftpd(8). Try to ignore trailing garbage that Apple OpenFirmware can leave where an option should be.
- Make the package tools show strerror(3) output when die()ing on filesystem errors.
- Allow pkg_delete(1) to handle removal of packages with bogus dependencies, as could be created by earlier versions of the new package tools. *************** *** 238,244 ****
- Fix authpf(8) ruleset names that contain the username (PR#3627.)
- '=' != '==' in fsck(8).
- Let <ctype.h> compile on non-gcc compilers. !
- Reintroduce old TCP MD5 signature (RFC2385) code from 4.5 years ago, hopefully with a reduced likelihood of kernel borkage.
- Improvements to sftp(1) batch mode: Allow batchfile input from stdin, and remove stderr junk (OpenSSH bugzilla #754.)
- Add IPv6 loopback routes and allow connection to the carp(4) shared IPv6 address from the MASTER host, like for IPv4.
- Fix a signed buffer length variable in syslogd(8). --- 304,310 ----
- Fix authpf(8) ruleset names that contain the username (PR#3627.)
- '=' != '==' in fsck(8).
- Let <ctype.h> compile on non-gcc compilers. !
- Reintroduce old TCP MD5 signature (RFC 2385) code from 4.5 years ago, hopefully with a reduced likelihood of kernel borkage.
- Improvements to sftp(1) batch mode: Allow batchfile input from stdin, and remove stderr junk (OpenSSH bugzilla #754.)
- Add IPv6 loopback routes and allow connection to the carp(4) shared IPv6 address from the MASTER host, like for IPv4.
- Fix a signed buffer length variable in syslogd(8). *************** *** 343,349 ****
- In isakmpd(8) only allow an INITIAL-CONTACT when a main-mode SA is in place, and never delete SPIs based on it.
- gcc3 handles varargs differently, change the kernel sources to deal with it.
- Some poll(2)-related fixes to select(2) under pthreads. From FreeBSD. !
- Fix objcopy(1)'s long options list, unbreaking strip(1)'s -s option and others (PR#3623.)
- Don't create a pid file for rtsold(8).
- If the scsi(4) error code is unknown, at least show the code we didn't have a message for. --- 409,416 ----
- In isakmpd(8) only allow an INITIAL-CONTACT when a main-mode SA is in place, and never delete SPIs based on it.
- gcc3 handles varargs differently, change the kernel sources to deal with it.
- Some poll(2)-related fixes to select(2) under pthreads. From FreeBSD. !
- Fix objcopy(1)'s long options list, unbreaking strip(1)'s -s option and others (PR#3623.)
! [Applied to stable] - Don't create a pid file for rtsold(8).
- If the scsi(4) error code is unknown, at least show the code we didn't have a message for. *************** *** 863,869 ****
- Add division and modulus operator '~' to dc(1).
- Remove GNU bc and dc from the tree.
- Merge in expat 1.95.6 from XFree86 4.3.99.14. !
- Search for keys in the ssh(1) agent in reverse order to solve duplicate key problems (OpenSSH bug #684.)
- ssh(1) option ForwardX11 now has xauth(1) generate untrusted keys by default. Option ForwardX11Trusted restores the old behaviour.
- Change vnd(4) major/minor numbering to allow more devices. Requires a MAKEDEV. --- 930,936 ----
- Add division and modulus operator '~' to dc(1).
- Remove GNU bc and dc from the tree.
- Merge in expat 1.95.6 from XFree86 4.3.99.14. !
- Search for keys in the ssh(1) agent in reverse order to solve duplicate key problems (OpenSSH bugzilla #684.)
- ssh(1) option ForwardX11 now has xauth(1) generate untrusted keys by default. Option ForwardX11Trusted restores the old behaviour.
- Change vnd(4) major/minor numbering to allow more devices. Requires a MAKEDEV. *************** *** 1051,1057 ****
- Some int -> u_int paranoia in ssh(1).
- More ssh(1) buffer management fixes (CAN-2003-0682.)
- Further EDD detection improvements on i386. !
- Properly flush the ssh(1) RSA1 public key from memory when its output file cannot be opened (OpenSSH PR#662.)
- Correct a double-free in the ssh(1) buffer management code (OpenSSH PR#660.)
- Fix the ssh(1) ConnectTimeout option (OpenSSH PR#656.)
- On i386, try harder to boot from removable media by allowing for their removal and insertion. --- 1118,1124 ----
- Some int -> u_int paranoia in ssh(1).
- More ssh(1) buffer management fixes (CAN-2003-0682.)
- Further EDD detection improvements on i386. !
- Properly flush the ssh(1) RSA1 public key from memory when its output file cannot be opened (OpenSSH bugzilla #662.)
- Correct a double-free in the ssh(1) buffer management code (OpenSSH PR#660.)
- Fix the ssh(1) ConnectTimeout option (OpenSSH PR#656.)
- On i386, try harder to boot from removable media by allowing for their removal and insertion.
***************
*** 1095,1101 ****
www@openbsd.org
!
$OpenBSD: plus.html,v 1.903 2004/02/07 13:14:48 miod Exp $