We are working on OpenBSD-current.
! The following list sums up (almost) all the changes made up to March 23.
-
+
+
- Fix ssl(3) rmd160 breakage on sparc64. +
- Teach tcpdump(8) how to display the new pfsync(4) bulk updates. +
- Make pfsync(4) stop carp(4) preempting to become master until the bulk state table sync has completed. +
- Support best-efforts bulk transfers of states when a pfsync(4) syncif is first configured. This this allows pfsync+carp clusters to come up gracefully without killing active connections. +
- Have rc(8) stop carp(4) interfaces on system shutdown. +
- Add pass rules for the pfsync and carp protocols to the default pf(4) rulebase installed by /etc/rc(8). +
- Make sure pfsync(4) interfaces are initialised before carp(4) interfaces in /etc/netstart(8). + + +
- Unbreak routing change handling in carp(4). +
- Bump OpenSSH to version 3.8.1. +
- Make pfctl(8)'s '-s osfp' option work by spelling it less like OSPF. +
- Update pf.os(5) to include OpenBSD 3.5, since that's where it's now at. +
- Have tn3270(1) check errno instead of setting it. +
- Fix yet another stray semicolon, this time in aac(4). +
- Implement firmware downloading for mpt(4). + +
- Make bge(4) work on 64-bit machines even if they're not alphas. +
- Have privsep named(8) pass SIGINT to the child process. +
- Upgrade Puffy to 3.5 and lock XF4 for release. +
- Add final pieces of privilege separation for isakmpd(8) and switch it on. +
- Add pxeboot(8) for i386, derived from NetBSD. +
- Fix another stray semicolon, in tcpdump(8)'s ASN.1 printer this time. +
- More mpt(4) fixes, more to come. + +
- When initialising the new state in pf(4) DIOCADDSTATE, point to the default rule instead of NULL. +
- Merge parts of XFree86 4.4.0 Release not affected by the new license. +
- Allow a carp(4) device's state to be set explicitly with ifconfig(8). +
- Set permissions on the right files for the @owner, @group and @mode directives in pkg_add(1) when -B is in effect. +
- For wi(4) devices with Prism firmware version 1.6.3 or later, support an enhanced security mode for a hostap where the SSID can be hidden from snoopers. +
- Speed up bgpd(8) session reestablishment. +
- Fix timeout issues with eap(4) audio devices. +
- Stop the installer asking for the timezone when upgrading. + + + +
- Fix spamd(8)'s logging when the blacklist limit is hit. +
- Allow users with write access to bgpd(8)'s control socket to send queries. +
- Fix an out-of-bounds read in ssl(3) (CAN-2004-0112.) This code isn't used in OpenBSD. +
- Always read at least DEV_BSIZE (512) bytes of the disklabel, some disks have smaller block sizes. +
- RELIABILITY FIX: A missing check for a NULL-pointer dereference has been found in ssl(3). A remote attacker can use the bug to cause an OpenSSL application to crash; this may lead to a denial of service.
+ A source code patch is available.
+ [Applied to stable] + - Fix a minor memory leak in isakmpd(8). +
- Lots of pre-release documentation fixes and additions. +
- If running at securelevel 2, use the -x option to increase the chances of ntpd using slew mode, since stepping backwards is disabled at this level. +
- Some mpt(4) stability fixes. + +
- Don't signal mountd(8) from mount(8) when all that's required is a listing of mounts (PR#3695.) +
- Create bgpd(8)'s control socket later in the startup. +
- Remember to unlock USB wi(4) devices on errors. +
- Since we've allocated a cache for pax(1), let's go right ahead and use it. +
- Remove 'extern int errno' in favour of #include <errno.h> in a number of programs. +
- Have diff(1) in directory mode skip over anything that's not a regular file or directory, for POSIX reasons. + +
- Yet another stray semicolon removed, pax(1) is the lucky program. +
- Prevent blacklist connections we're tarpitting from maxing out spamd(8)'s available connections. Controllable with the new -B option. +
- Have wi(4) hostap send an error response if a station sends a bogus challenge instead of just ignoring it. +
- Make software WEP work on wi(4) devices. Only in BSS (station) and hostap modes for now. +
- Fix another bug caused by a stray semicolon, this time in tcpdump(8). +
- daemon(3)ise ifstated(8) earlier. +
- Some logic fixes and additional error checks in USB wi(4). +
- Have sensorsd(8) deal gracefully with attempts to initialise unsupported sensor types. +
- Fix memory leak caused by a stray semicolon in arla. +
- panic(9) if an attempt is made to initialise the kernel arc4random generator too early. +
- Fix occasional locate.updatedb(8) failures due to a bug in sort(1). +
- Check chdir(2) return code after chroot(2) in bgpd(8) and isakmpd(8). +
- Fix a memory leak and a missing break in pf(4) ioctl processing error paths. +
- Clear struct sockaddr_un before use in syslogc(8). + +
- In spamd(8), only shrink the window once we're in the DATA mode. This way, greylisted connections don't get held up by the tiny window but spam bodies are still sent. Very. Slowly. +
- Restore scsi(4) bus scans to full speed by not checking LUNs that will be skipped anyway. +
- Fix fd and another memory leak in routed(8). +
- Make the sane_install() tests in the installer match more useful reality. +
- Check the return code of chdir(2) after the privsep chroot(2) in pflogd(8), syslogd(8) and tcpdump(8). +
- Disable crypto(9) MAC functions for now, no current hardware can use them. +
- Some oosiop(4) cleanup based on osiop(4). +
- In wskbd(4), make the caps lock key do caps lock instead of shift lock (PR#2555.) + +
- Make it easier to kill spamd(8) greylister processes. +
- Do pfsync(4) interface setup last in /etc/netstart(8), so that hopefully the syncif gets set up beforehand. + +
- Make bgpctl(8)'s empty-as keyword work. +
- Extra free-then-NULL paranoia in spamd(8). +
- Fix wi(4) software WEP on big-endian machines. +
- Unbreak tail(1) -f mode for filesystems not blessed with kqueue(2) support. +
- Implement privilege separation for named(8). And there was much rejoicing. +
- Plug a rtentry leak when TCP gives up on a cached route (in_pcb.c:in_losing().) +
- Fix (guess what?) a memory leak in the yacc(1) skeleton code. +
- Check the payload size more carefully when printing IKE messages in tcpdump(8). +
- Plug a memory leak in the error path of execve(2). +
- Preliminary port of the NetBSD oosiop(4) driver, supporting really old NCR SCSI chips on hppa machines. + +
- Unbreak pkg_add(1)'s handling of packages from stdin. +
- Fix a bug in spamd(8) that stopped custom 450 messages being displayed. +
- Some apm(4) fixes on i386. +
- Sync the spamd(8) greylist database after each db operation, to minimise the likelihood of corruption. +
- Add basic community support to bgpd(8). +
- Correct a missing malloc(3) error check in bgpctl(8). +
- Fix byte-ordering problems in routed(8) (PR#3704.) Based on NetBSD. + + +
- RELIABILITY FIX: Defects in the payload validation and processing functions of isakmpd(8) have been discovered. An attacker could send malformed ISAKMP messages and cause isakmpd to crash or to loop endlessly.
+ A source code patch is available.
+ [Applied to stable] + - Obey the user's 'boot reboot' command at the ddb(4) prompt, even if the system is starting up. +
- Some signedness paranoia when handling carp(4) sysctls. +
- Fix missing checks for NULL returned from getpass(3) in login_*(8). +
- Make bgpd(8) work harder to clean up after itself on exit. +
- More work on capability announcements in bgpd(8). +
- Fix an isakmpd(8) crash when deleting an ESP SA with no authentication (PR#2429.) +
- Symlink-hanlding improvements in pkg_add(1) etc.'s virtual filesystem code. +
- Simplify the new scsi(4) LUN scanning logic, and print better diagnostics. +
- New -b option to spamd(8), used to set the local bind address. + +
- Allow the wsdisplay(4) screen blanker to be turned off again (PR#3123.) +
- 3.5-beta -> 3.5. +
- Increase the ssh(1) X11 cookie lifetime from two to twenty minutes. +
- Plug some memory leaks in error paths of isakmpd(8). +
- Fix multicast for recent sk(4) chipsets. From FreeBSD lists. +
- Be more thorough when URL-encoding usernames and passwords in the installer. + +
- Prevent the user specifying an interface name longer than IFNAMSIZ in ifconfig(8). +
- Many, many more memory leak fixes in pfctl(8)'s parser. +
- Fix a few missing initialisations in ssh-keyscan(1).
- Have pkg_add(1)'s dependency lookup check against local directory listings.
- New -A (pretend to be another architecture) and -P (limit distribution type) options to pkg_add(1).
- More memory leak fixes to ifstated(8)'s parser.
- Fix a null deref in ifstated(8).
- Have nc(1) print an error message if connect(2) fails. +
- Plug well-hidden memory leaks in bgpd(8), ifstated(8) and pfctl(8)'s parsers.
- Signal-handling tweaks to syslogd(8).
- Add mpt(4), a driver for LSI Fusion-MPT SCSI and Fibre Channel devices. *************** *** 125,131 ****
- Cleanup and paranoia in spamdb(8).
- Support 'tagged <name>' specifiers on pf(4) anchor rules.
- Better IPv4 address validation in spamd(8). !
- Process NOTE_TRUNCATE messages in tail(1) and unbreak file truncation handling (PR#3689.)
- Allow bgpd(8) to run in route-collector mode, i.e. disable the decision process.
- Build libf2c for GCC3 architectures.
- New -d option for nc(1), which disables reading from stdin (PR#3694.) --- 252,258 ----
- Cleanup and paranoia in spamdb(8).
- Support 'tagged <name>' specifiers on pf(4) anchor rules.
- Better IPv4 address validation in spamd(8). !
- Process NOTE_TRUNCATE messages in tail(1) and unbreak file truncation handling in -f mode (PR#3689.)
- Allow bgpd(8) to run in route-collector mode, i.e. disable the decision process.
- Build libf2c for GCC3 architectures.
- New -d option for nc(1), which disables reading from stdin (PR#3694.) *************** *** 241,252 ****
- Stop bc(1) modifying argv and optind while inside the getopt(3) loop.
- In gcc3, add a few missing open(2) third options when used with O_CREAT. !
- Revoke procmap(1)'s privileges immediately after kvm_openfiles(3). !
- Make sure procmap(1) doesn't call strtoul(3) on non-numbers. !
- In procmap(1), print the names of missing symbols instead of '(null)'.
- Extra bzero(3) paranoia for data coming out of the scsi(4) xfer pool. !
- Memory and string cleanup in procmap(1).
- Implement kevent(2) and kqueue(2) under FreeBSD emulation, using the native calls.
- Fix mishandling of numeric options in sed(1) (PR#3677.)
- Add -i option to pfctl(8), restricting operations to the given interface. Only -sI implemented for now. --- 368,379 ----
- Stop bc(1) modifying argv and optind while inside the getopt(3) loop.
- In gcc3, add a few missing open(2) third options when used with O_CREAT. !
- Revoke procmap(1)'s privileges immediately after kvm_openfiles(3). !
- Make sure doesn't call strtoul(3) on non-numbers. !
- In procmap(1), print the names of missing symbols instead of '(null)'.
- Extra bzero(3) paranoia for data coming out of the scsi(4) xfer pool. !
- Memory and string cleanup in procmap(1).
- Implement kevent(2) and kqueue(2) under FreeBSD emulation, using the native calls.
- Fix mishandling of numeric options in sed(1) (PR#3677.)
- Add -i option to pfctl(8), restricting operations to the given interface. Only -sI implemented for now. *************** *** 262,268 ****
- Add a missing realloc(3) failure check in asn1_compile.
- Generate the MAKEDEV(8) manpages automagically based on the same information as the MAKEDEV scripts themselves.
- gcc(1) propolice fixes on i386. !
- First cut at procmap(1) from NetBSD (where it's called pmap.) Not yet built by default.
- New 'split' option in iostat(8) for the newly-separated disk read/write stats.
- Check for TDB entries marked as invalid when looking up tcpmd5 connections. --- 389,395 ----
- Add a missing realloc(3) failure check in asn1_compile.
- Generate the MAKEDEV(8) manpages automagically based on the same information as the MAKEDEV scripts themselves.
- gcc(1) propolice fixes on i386. !
- First cut at procmap(1) from NetBSD (where it's called pmap.) Not yet built by default.
- New 'split' option in iostat(8) for the newly-separated disk read/write stats.
- Check for TDB entries marked as invalid when looking up tcpmd5 connections. *************** *** 956,962 ****
- Also give cmp(1) and patch(1) the madvise(2) sequential treatment.
- Speed up install(1) by using madvise(2) with the MADV_SEQUENTIAL flag. !
- Fix httpd(8) mod_access IP address tests on sparc64.
- New -o option to kvm_mkdb(8), to put the database somewhere other than /var/db.
- Fix return code from diff(1) when the -i option is in use. --- 1083,1092 ----
- Also give cmp(1) and patch(1) the madvise(2) sequential treatment.
- Speed up install(1) by using madvise(2) with the MADV_SEQUENTIAL flag. ! !
- SECURITY FIX: Due to a bug in the parsing of Allow/Deny rules for httpd(8)'s access module, using IP addresses without a netmask on big endian 64-bit platforms causes the rules to fail to match. This only affects sparc64.
! A source code patch is available.
! [Applied to stable] - New -o option to kvm_mkdb(8), to put the database somewhere other than /var/db.
- Fix return code from diff(1) when the -i option is in use. *************** *** 1303,1309 ****
- Fix several kernel networking off-by-ones w.r.t. PRC_NCMDS.
- Better error checking for new bc(1) and dc(1).
- Make new bc(1) compile on sparc64. !
- PCI support for hppa through dino(4) bridge driver.
- Further realloc(3) cleanup. --- 1433,1439 ----
- Fix several kernel networking off-by-ones w.r.t. PRC_NCMDS.
- Better error checking for new bc(1) and dc(1).
- Make new bc(1) compile on sparc64. !
- PCI support for hppa through dino(4) bridge driver.
- Further realloc(3) cleanup. *************** *** 1401,1407 ****
- Correct a double-free in the ssh(1) buffer management code (OpenSSH PR#660.)
- Fix the ssh(1) ConnectTimeout option (OpenSSH PR#656.)
- On i386, try harder to boot from removable media by allowing for their removal and insertion. !
- Updated and better-commented openbsd-proto.mc for sendmail(8).
- Upgrade sendmail(8) to version 8.12.10. The address parsing security fix went into 3.4 and -stable, but not the full version update. --- 1531,1537 ----
- Correct a double-free in the ssh(1) buffer management code (OpenSSH PR#660.)
- Fix the ssh(1) ConnectTimeout option (OpenSSH PR#656.)
- On i386, try harder to boot from removable media by allowing for their removal and insertion. !
- Updated and better-commented openbsd-proto.mc for sendmail(8).
- Upgrade sendmail(8) to version 8.12.10. The address parsing security fix went into 3.4 and -stable, but not the full version update.
***************
*** 1441,1447 ****
www@openbsd.org
!
$OpenBSD: plus.html,v 1.908 2004/03/22 23:05:59 miod Exp $