===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/plus.html,v
retrieving revision 1.1367
retrieving revision 1.1368
diff -u -r1.1367 -r1.1368
--- www/plus.html 2015/05/24 16:33:25 1.1367
+++ www/plus.html 2015/05/25 17:07:36 1.1368
@@ -77,8 +77,189 @@
-
-Looking for a maintainer of this file.
+
+- In httpd(8), zero the tls cert/key length variables when inheriting a server configuration for multiple listen statements in a server block. Otherwise httpd(8) will crash when a listen statement with tls is followed by a listen statement without tls.
+
- Prevent ssh(1) from warning about SSH1 keys present when compiled without SSH1 support. Also identify SSH1 keys when scanning, even when compiled without SSH1 support.
+
- Fix an fd leak in ssh(1).
+
- Let sort(1) ignore $TMPDIR if setuid or setgid.
+
- Don't make the -m and -c options of sort(1) mutually exclusive.
+
- Let the vlan(4) mtu be limited by the parent's hard mtu, not the current mtu. This makes it possible to have networks on the "native" (untagged) vlan on an interface at 1500, while setting a child vlan interface's mtu to jumbos.
+
- In sort(1):
+
+- Call atexit() to clean up temporary files on error.
+
- Use mkstemp() to create the temporary file when the output file equals one of the input files.
+
- Preserve the original file mode on the temporary file.
+
- Check for write access on the original file before creating the temporary one.
+
+ - In ssh-keygen(1), if a user tries to add a comment to a non-RSA1 key and has entered their passphrase, explicitly clear it before exit.
+
- Tell the firmware to shut down the fan management thread on the last generation of G5s. Without this mpi@'s PowerMac11,2 hang when smu(4) attaches.
+
- Move the default font path from /usr/local/lib/X11/fonts to /usr/local/share/fonts to match XDG_DATA_DIR (where Desktop tools will look for by default).
+
+
- Fix the repeating keys/delay problem that occurs on newer ThinkPads when touching the trackpad/trackstick while typing during the installer in a less invasive way.
+
- Update to xkeyboard-config 2.14.
+
- Some work on macppc G5 interrupts.
+
- Allow syslogd(8) to read configuration files with arbitrary line lengths. Also ensure the configuration file has been read in full in order to prevent syslogd(8) from running with incomplete configuration.
+
- Update to xcb-util-cursor 0.1.2.
+
+
- Fix an uninitialised memory read in ssh(1) when parsing a config file consisting of a single nul byte.
+
- In mandoc(1), handle special punctuation modes for -Tpdf.
+
- Restore user-loaded vga fonts upon switching from X11 to VT and upon resume.
+
- Let esp(4) correctly match SUNW,fas in the boot path.
+
- In tcpdump(8), remove an extra line when printing AH and RIP packets.
+
- Let vnet(4) reject packets that are too large.
+
- Revert r1.29 of src/usr.bin/telnet/sys_bsd.c (don't clear ICRNL when editing mode is off, so that character local echo mode don't echo ^M locally) as this causes problems sending CR to some Cisco equipment.
+
- Make sure that pkg_add(1) checks specialfiles.
+
+
- Initial support for the SABRE SD board.
+
- Fix a memory leak in cwm(1).
+
- Match rtsx(4) on the RTS5249 found on the Dell XPS 13 and treat it as an RTS5229.
+
+
- In ntpd(8), avoid overflow on 32-bit time_t systems when converting timeval to NTP time.
+
- For ancient pre-v8 sparc, expand kva.
+
- Move man.conf(5) from /etc/ to /etc/examples.
+
- Add the "output" directive to man.conf(5).
+
- Let security(8) handle lines in mount(8) output that end with "on" (which can happen for NFS mounts).
+
- Let security(8) handle incomplete lines in /etc/passwd that end before the home directory field.
+
+
- Add the "manpath" directive to man.conf(5) to override the default search path.
+
- In pkg_add(1), backout -DSHORTENED semantics by default for now.
+
- Add initial support for RFC 7427 signatures to iked(8).
+
- Allow input/printing/conversion of terabyte sizes in fdisk(8).
+
- Fix configuring MPLS routes on mpe(4).
+
- Let httpd(8) translate CGI environment variables in accordance with RFCs 7230 and 3875.
+
- Ban all-zero curve25519 keys in ssh, as recommended by the latest CFRG curves draft.
+
- Update to libdrm 2.4.60.
+
+
- Determine if the trackstick buttons are wired to the trackpad and need to be re-routed to the trackstick. Without this change the buttons on 2015 Thinkpads get picked up as extended buttons that show up as scroll up/down. Remove the X1 Carbon 2015 (LEN0048) and X250 (LEN0046) from the top button area/soft buttons quirks list. Also avoid using the quirk list entirely if the capability bit is set.
+
- Save/restore AVX registers and other XSAVE-managed state information when entering/leaving a signal handler like we already do the the FPU and SSE state. This should make it possible to use AVX instructions in signal handlers.
+
- Ignore v1 errors on ssh-add -D; only try v2 keys on -l/-L (unless compiled with SSH1 support).
+
- With a per interface IPv6 stateless adress auto configuration flag it is possible to allow IPv6 forwarding and SLAAC at the same time. This is needed for RFC 7084.
+
- In ksh(1), bind the Delete key (ESC[3~) to delete-char-forward.
+
+
- Fix a memory leak in ssh(1).
+
- Work around broken device-tree in PowerMac7,2 and PowerMac7,3 (K2 systems) and get the correct offsets from the "i2s" node.
+
- Remove lmc(4) and san(4).
+
- Use chacha20-poly1305@openssh.com as the default cipher in ssh.
+
+
- Disable SSH protocol 1 in ssh.
+
- Fix a memory leak in relayd(8).
+
- Don't let rcmdsh(3) fail if it is passed a non resolvable hostname. Instead, silently ignore the fact and instead let the underlying ssh (or $RSH) command handle it.
+
- Fix memory leaks in tempnam(3) error paths.
+
- Fix NFS boot on macppc.
+
- In ping6(8), bump the size of the time types on the wire to 64 bit (port of r1.116 of src/sbin/ping/ping.c).
+
- In ping(8) and ping6(8), obfuscate the monotonic clock values put on the wire by offsetting them with a random value.
+
- Don't let ssh-keygen -A try (and fail) to generate ssh v.1 keys when compiled without SSH1 support RSA/DSA/ECDSA keys when compiled without OpenSSL (bz#2369).
+
+
- Make setting 11a rates and scanning on iwm(4) conditional on the 5GHz support bit in the nvm.
- Make be(4) work on sun4c.
+
+
- Add sysconf() extensions PHYS_PAGES, AVPHYS_PAGES, NPROCESSORS_CONF
+and NPROCESSORS_ONLN to getconf(1).
+
- On amd64, add support for saving/restoring FPU state using the XSAVE/XRSTOR. Limit support to the X87, SSE and AVX state. This gives us (almost) full AVX support.
+
- On sparc, abort attach of iommu requiring boards on non-iommu systems.
+
- Don't let ldpd(8) try to send address withdraws to neighbors that are unreachable after an address removal in the system.
+
- Let ldpd(8) remove attached adjacencies whenever an interface is disabled for whatever reason. This will speed up the convergence process.
+
- Don't let ldpd(8) assign labels for BGP routes. This would be very resource consuming in some scenarios and unnecessary.
+
- In vnet(4), considerably improve the reliability of re-establishing network connections between domains after some sort of hickup.
+
- Let man(1) fall back to /usr/share/man:/usr/X11R6/man:/usr/local/man as default search path if no path is given via -m, -M, $MANPATH and /etc/man.conf.
+
- Fix a memory leak in libtls with repeated use of tls_connect().
+
- In sort(1), use the hw.usermem sysctl to determine the amount user (non-kernel) memory instead of sysconf(_SC_PHYS_PAGES) (which also counts pages wired by the kernel). Don't try to use a memory buffer larger than the datasize hard resource limit.
+
+
- Work around buggy AML trying to access PCI config space using PCI function number FFFF.
+
- In renice(8), when mixing historic BSD syntax (where the priority is absolute) with the -n flag (where the priority, according to POSIX, is an increment), the increment specified via -n will only affect the entries that follow it.
+
- Support jumbo frames on re(4).
+
- Rather than disabling checksum offload in re(4) for all packets, let it advertise checksum offload to the stack for small (normal-sized) packets and do the checksum itself in software for large packets.
+
- Reintroduce r1.173 of src/sys/kern/subr_pool.c (try and place at least 8 items on a page if we're able to use large page allocators). This was backed out because of fallout on landisk which has since been fixed.
+
- Unbreak WEP/WPA on AR5211 ath(4) devices by setting hardware WEP keytable entry types to NULL, as done for AR5212 devices. ath(4) uses software crypto.
+
- Re-apply r1.115 of src/sys/dev/pci/if_ix.c (when setting up advanced TX descriptor, use m_getptr to locate the IP or IPv6 header instead of assuming contiguousness of the target buffer across Ethernet and IP/IPv6 headers) that got accidentally reverted.
+
+
- Fix a memory leak in an error path in LibreSSL (from OpenSSL commit 5e5d53d341fd9a9b9cc0a58eb3690832ca7a511f).
+
- Fix a small memory leak in sort(1).
+
- Fix CVE-2015-0209, CVE-2015-0286, CVE-2015-0287 and CVE-2015-0289 in LibreSSL.
+
- Deal with half-configured control pipes in dwc2, using the same workaround as in ehci(4) and ohci(4).
+
+
- Use struct timespec internally in pax(1). This gives nanosecond precision to the -rw option and a basis for support of mtime and atime values in pax-format extended header records.
+
- In route(8), instead of embedding interface names in a sockaddr, use their indexes when adding route entries with the -link option. This prevent the ARP layer to take the name of your interface for an Ethernet address.
+
- Rework the virtual memory layout on SRMMU systems (sun4d/sun4m) to use a much lower VM_MIN_KERNEL_ADDRESS, since these systems are not crippled by the Sun-4 MMU hole and have the real 4GB of address space. Kernels running on Sun-4 MMU are not affected and will still be restricted to the existing 128MB of kernel space, with 1GB - 128MB of user space.
+
- Make init(8) static PIE.
+
- Revert r1.52 of src/sys/arch/sparc/dev/zs.c. This reduces the number of spurious zs interrupts seen on sun4c, albeit not completely.
+
- Speed up large directory reading with opendir(3).
+
- Fix mpii(4) on i386.
+
+
- Reenable the pa1.1 fallback code for sha256 on hppa.
+
- "Handle" wccp2 packets if net.inet.gre.wccp is set to 2 by truncating skipping the wccp 2 header.
+
- Update to libXfont 1.5.1 which contains fixes for CVE-2015-1802, CVE-2015-1803 and CVE-2015-1804.
+
- Fix swap auto-allocation in disklabel(8) for machines with very little memory.
+
- Replace sort(1) with the implementation from FreeBSD.
+
- In the installer, don't ask about xdm if the answer to the X question was "no" (restores previous behaviour that got lost in r1.780 of src/distrib/miniroot/install.sub).
+
- Prevent a race in ehci(4) resulting in an infinite loop printing "ehci_idone" messages.
+
- Fix erratic behaviour of dig(1) and nslookup(1) when no (valid) nameserver is configured in resolv.conf.
+
- Explicitly handle SIGPIPE in mandoc(1). This prevents a "Broken pipe" message from csh(1).
+
+
- Repair a missing state insert in pf(4).
+
- Try a third approach for handling pms and pckbd interrupt storms, when there is no pms driver in the kernel.
+
- Update to sqlite3 3.8.7.4.
+- Avoid a NULL pointer dereference in LibreSSL. A NULL pointer could be dereferenced when X509_REQ_set_pubkey() calls X509_PUBKEY_set() with pktmp. According to OpenSSL, this is the fix for CVE-2015-0288.
+
- Prevent a use-after-free in httpd(8).
+
- Allow the xdm(1) greeter to set the background color of the input fields. The "inpColor" resource is used for that.
+
- In mandoc(1), avoid off-by-one read access to the termacts array, which could
+sometimes result in missing line breaks before subsection headers.
+
+
- In the installer, eliminate the question "Which cd?" and just show the available cd's in the "Location of sets?" prompt.
+
- Allow for multiple concurrent devopen() calls, and fill the .readdir member
+of fs_ops. This makes the "ls" command finally work in the macppc bootloader.
+
- In last(1), use ctime_r to avoid a re-entrancy signal race.
+
- Check for the size of the supposed destination address when constructing the Ethernet frame. This prevents an overflow.
+
- The RTL8411 is supported by rtsx(4).
+
- Rewrite the sh(1) manual page and confine it to document features supported by POSIX-compliant shells.
+
+
- In ospfd(8), wen removing interfaces in the RDE, also remove all the RDE neighbors that are part of that interface. This prevents use-after-free situations.
+
- Make wi(4) on PCMCIA work on luna88k.
+
+
- In makewhatis(8), fix hardlink detection on platforms having padding in struct inodev, typically 64-bit platforms.
+
- Use the shorter ofwbootfd (without softraid support) on the miniroot. This fixes booting of cdNN.iso and installNN.iso on the Blade 150.
+
- Make "boot -c" support work on a variety of newer machines. This is not expected to harm older machines.
+
- Handle the way some BIOSes initialize newer-style nubbins/touchpads into strange (advanced) modes, which can muddle up the pckbc pipe. This is experienced as 10-second typing pauses and strange repeat behaviour on the RAMDISK (and is caused by "lightly brushing" the touchpad).
+
- Automatic parent interface selection no longer works in ifconfig(8) (see r1.245 of src/sys/netinet/ip_carp.c); carpdev is a required argument now.
+
- Escape ! characters for tab completion in ksh(1). This is necessary if using "set -o csh-history".
+
+
- In pax(1)/tar(1), try to recognize a few well-known compression formats, and report them to the user.
+
- Remove setgid kmem support from systat(1). As a result, the netstat view of systat is slightly different.
+
- In ping(8), bump the size of the time types on the wire to 64 bit.
+
- Remove tcopy(1).
+
- Remove setgid kmem support from eeprom(8). As a result, groot privileges are generally needed to run this.
+
- Remove setgid kmem support from pstat(8). As a result, root privileges are needed to use the -d and -v options.
+
- In man(1), when interpreting the -O argument as a macro name fails, fall back to showing Nd rather than not showing anything.
+
- The 3160 should work with iwm(4).
+
+
- Make ping(8), ping6(8), traceroute(8) and traceroute6(8) resistant to local wall clock changes which can skew the intervals reported or make them go negative.
+
- Add back r1.206 of src/usr.bin/ssh/packet.c that fixed some leaks in error paths and was reverted by mistake.
+
- Set verbosity to 1 (the default is 0) in nsd.conf(5) so that incoming notifies and zone xfers are logged.
+
- Improve locking in amd64 pmap using mutexes.
+
- Disable the database file by default in nsd.conf(5). It is believed to be a saner default for the common use case and there is a problem with missing records on shutdown.
+
+
- Fix a regression in man(1) where the first manual shown is not properly displayed in the pager if that manual is compressed.
+
- In vi(1), display "Search wrapped" even when searching from the end of the file.
+
- In wdc(4), do not attempt to read the status register unless WDCF_IRQ_WAIT is not set; this used to be the case but got broken in r1.113. This fixes the Acard ATP865-R.
+
- In worm(6), make the worm grow faster on larger terminals. This is more fun than starting with an enormous pile of worm at the start.
+
- Don't do IPv6 SLAAC for prefixes with a preferred lifetime of zero, per RFC 4941.
+
- In mandoc(1):
+
+- Fix vertical spacing at the beginning of tables: man(7) always prints a blank line; mdoc(7) doesn't.
+
- Don't mistreat negative .sp arguments in mdoc(7) as large positive ones.
+Instead, use the same logic as for man(7).
+
- Flush the line preceding a table before clearing the right margin, so that that line isn't output with unlimited width.
+
+ - Make httpd(8) and relayd(8) TLSv1.2-only by default.
+
- Make -DSHORTENED the default in pkg_add(1).
+
- Move i386 pvlists to pool backed, and improve the locking using mutexes.
+
+
- Various fixes for pax(1)/tar(1):
+
+- Prevent an archive from escaping the current directory by itself.
+
- For tar without -P, if a path in the archive has any ".." components, then strip everything up to and including the last of them (if it ends in ".." then it becomes ".").
+
- For directories whose times or mode will be fixed up in the clean-up pass, record their dev+ino and then use open(O_DIRECTORY)+fstat() to verify that we're updating the correct directory before using futimens() and fchmod().
+
- Correct buffer overflow in handling of pax extension headers, caught by the memcpy() overlap check.
+