===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/plus32.html,v
retrieving revision 1.12
retrieving revision 1.13
diff -c -r1.12 -r1.13
*** www/plus32.html 2004/03/25 02:41:50 1.12
--- www/plus32.html 2004/03/28 09:44:05 1.13
***************
*** 114,120 ****
Fix newsyslog(8)'s handling of empty lines.
Remove the obsolete access.conf and srm.conf files from httpd(8).
! Make sure ssh(1) ProxyCommand programs get killed on exit (portable OpenSSH bug #223.)
Fix a potential FREE() of an uninitialised pointer in the kernel (sys/exec_script.c)
Rewrite tcpdump(8)'s GRE decoder.
Fix signal trampoline problems with non-exec stack.
--- 114,120 ----
Fix newsyslog(8)'s handling of empty lines.
Remove the obsolete access.conf and srm.conf files from httpd(8).
! Make sure ssh(1) ProxyCommand programs get killed on exit (portable OpenSSH bug #223).
Fix a potential FREE() of an uninitialised pointer in the kernel (sys/exec_script.c)
Rewrite tcpdump(8)'s GRE decoder.
Fix signal trampoline problems with non-exec stack.
***************
*** 128,134 ****
Fix DMA-related panics in the twe(4) driver.
In ssh(1), try harder to create the X11 forwarding listener socket.
! Fix a potential buffer overrun in setlocale(3) (NetBSD-SA2002-012.)
Don't chdir to / when systrace(1) goes daemon.
Add __syslog__ string formatting attribute to gcc(1).
--- 128,134 ----
Fix DMA-related panics in the twe(4) driver.
In ssh(1), try harder to create the X11 forwarding listener socket.
! Fix a potential buffer overrun in setlocale(3) (NetBSD-SA2002-012).
Don't chdir to / when systrace(1) goes daemon.
Add __syslog__ string formatting attribute to gcc(1).
***************
*** 166,179 ****
sshd(8) now supports Kerberos authentication in PrivSep mode.
pf(4)'s parser takes more care parsing address families in NAT rules.
! Add leap second support to rdate(8) running in RFC868 mode (it already supports this in NTP mode with the -N option.)
Correct altq(9)'s representation of positive infinity.
Signal handler fixes in bootpd(8), rtadvd(8) and rtsold(8).
faithd(8) dies on FD_SET overruns.
Fix a couple of off-by-ones in mopd(8).
! Make fsck(8) work properly with long block device filenames (handle MAXPATHLEN chars instead of 32.)
Don't build the somewhat less than ubiquitous photurisd(8) by default any more.
Lots and lots of ANSIfication.
Lots of int -> socklen_t.
--- 166,179 ----
sshd(8) now supports Kerberos authentication in PrivSep mode.
pf(4)'s parser takes more care parsing address families in NAT rules.
! Add leap second support to rdate(8) running in RFC868 mode (it already supports this in NTP mode with the -N option).
Correct altq(9)'s representation of positive infinity.
Signal handler fixes in bootpd(8), rtadvd(8) and rtsold(8).
faithd(8) dies on FD_SET overruns.
Fix a couple of off-by-ones in mopd(8).
! Make fsck(8) work properly with long block device filenames (handle MAXPATHLEN chars instead of 32).
Don't build the somewhat less than ubiquitous photurisd(8) by default any more.
Lots and lots of ANSIfication.
Lots of int -> socklen_t.
***************
*** 182,200 ****
Fix ahc(4)'s interrupt sharing.
libusbhid(3) now available in the shared variety.
! Don't allow data to be appended to the receive buffer of a socket that's been shut down (see NetBSD PR#18185.)
Merge in OpenSSL 0.9.7beta1. To be continued.
isakmpd(8) interoperability fixes for FreeS/WAN and SSH Sentinel.
Make rwalld(8) revoke its group privileges as well as user privs.
Don't install safe_finger any more.
! Add support for the SCSI Reduced Block Command Set (RBC.)
Bump sshd(8)'s LoginGraceTime from one minute to two.
Various compatibility fixes and additions to ubsec(4).
ifconfig(8) can now set whether or not use of IPv6 deprecated addresses are allowed.
_x11 user and group added for xdm(1) to use.
! Pull in XFree86's fix for a serious Xlib security bug (which didn't affect OpenBSD.)
Fix parsing of NAT port ranges.
Check the interface specified with route-to/dup-to/fastroute actually exists. If it does, null terminate its name before moving on.
--- 182,200 ----
Fix ahc(4)'s interrupt sharing.
libusbhid(3) now available in the shared variety.
! Don't allow data to be appended to the receive buffer of a socket that's been shut down (see NetBSD PR#18185).
Merge in OpenSSL 0.9.7beta1. To be continued.
isakmpd(8) interoperability fixes for FreeS/WAN and SSH Sentinel.
Make rwalld(8) revoke its group privileges as well as user privs.
Don't install safe_finger any more.
! Add support for the SCSI Reduced Block Command Set (RBC).
Bump sshd(8)'s LoginGraceTime from one minute to two.
Various compatibility fixes and additions to ubsec(4).
ifconfig(8) can now set whether or not use of IPv6 deprecated addresses are allowed.
_x11 user and group added for xdm(1) to use.
! Pull in XFree86's fix for a serious Xlib security bug (which didn't affect OpenBSD).
Fix parsing of NAT port ranges.
Check the interface specified with route-to/dup-to/fastroute actually exists. If it does, null terminate its name before moving on.
***************
*** 217,223 ****
Fixes to gem(4).
Properly limit EDNS0 size to 0xffff.
Fix a signedness problem in SSH so that RSA_public_decrypt(3) errors can be detected.
! Make X's module loader set PROT_EXEC using mprotect(2) on malloc'd pages containing code (needed since the heap is now mapped without PROT_EXEC.)
DNS responses from getaddrinfo(3), gethostby*() and getnetby*() now get a 64K receive buffer.
[Applied to stable]
--- 217,223 ----
Fixes to gem(4).
Properly limit EDNS0 size to 0xffff.
Fix a signedness problem in SSH so that RSA_public_decrypt(3) errors can be detected.
! Make X's module loader set PROT_EXEC using mprotect(2) on malloc'd pages containing code (needed since the heap is now mapped without PROT_EXEC).
DNS responses from getaddrinfo(3), gethostby*() and getnetby*() now get a 64K receive buffer.
[Applied to stable]
***************
*** 286,292 ****
Fix raw socket translation for Linux compatibility mode.
Properly clear the argument list in pmdb.
! Die on fd_set overrun in mtrace(8), map-mbone(8) and mrouted(8) (not built by default.)
When emulating Linux, don't have accept()ed sockets inherit flags from the listen socket.
[Applied to 3.1-stable]
Fix snprintf length in syslogd(8).
--- 286,292 ----
Fix raw socket translation for Linux compatibility mode.
Properly clear the argument list in pmdb.
! Die on fd_set overrun in mtrace(8), map-mbone(8) and mrouted(8) (not built by default).
When emulating Linux, don't have accept()ed sockets inherit flags from the listen socket.
[Applied to 3.1-stable]
Fix snprintf length in syslogd(8).
***************
*** 299,315 ****
Add a couple of missing open(2) mode args in afsd(8) and msgs(1).
Improve TX interrupt handing in be(4/SPARC,4/SPARC64).
! Fixes to mrinfo(8) (this isn't built by default.)
Improve systrace(1)'s handling of interrupted system calls.
Fix a free-in-caught-alloc-failure-block (!) in ohci(4).
Rewrite the CRL support in isakmpd(8). Check for OpenSSL >= 0.9.7, the earliest supported version for now.
Retrofit the new early privilege revocation code to the old X servers.
! xlock(1) defaults to blank mode (rather than random mode.) Also remove bomb mode altogether, to the annoyance of noone.
Several fixes to the hme(4/SPARC, 4/SPARC64) driver.
Restore struct link_map ABI compatibility between ld.so and gdb, broken by the split of link.h into separate MI, ELF and a.out files.
! Move AGP chipset support out of machine-independent section (AGP support is per-arch.)
REVISED SECURITY FIX for the OpenSSL ASN.1 buffer overflows, see the erratum.
[Applied to stable]
--- 299,315 ----
Add a couple of missing open(2) mode args in afsd(8) and msgs(1).
Improve TX interrupt handing in be(4/SPARC,4/SPARC64).
! Fixes to mrinfo(8) (this isn't built by default).
Improve systrace(1)'s handling of interrupted system calls.
Fix a free-in-caught-alloc-failure-block (!) in ohci(4).
Rewrite the CRL support in isakmpd(8). Check for OpenSSL >= 0.9.7, the earliest supported version for now.
Retrofit the new early privilege revocation code to the old X servers.
! xlock(1) defaults to blank mode (rather than random mode). Also remove bomb mode altogether, to the annoyance of noone.
Several fixes to the hme(4/SPARC, 4/SPARC64) driver.
Restore struct link_map ABI compatibility between ld.so and gdb, broken by the split of link.h into separate MI, ELF and a.out files.
! Move AGP chipset support out of machine-independent section (AGP support is per-arch).
REVISED SECURITY FIX for the OpenSSL ASN.1 buffer overflows, see the erratum.
[Applied to stable]
***************
*** 319,331 ****
systrace(1) can log matching rules to syslog.
write(1) drops privileges after opening the tty.
! Refactor vmstat(8) slightly so kvm(3) is only ever opened once (it could be opened a second time by dkstats.c before.)
Open the kvm(3) library earlier in fstat(1) and systat(1), and so drop privs earlier.
Test for a previously unchecked malloc() return value in the RPC library, and die unceremoniously on failure.
Catch file read errors in rdate(8)'s leapsecond handler.
Cleanup of amd(8).
! Remove Kerberos support from the default login.conf (and its hardwired defaults for when login.conf is absent.) See the log for why.
No more RPC by default. Expect a lot of 'NFS is broken' email to misc@ when 3.2 is released.
Rework some aspects of crontab(1)'s file checks.
Provide our own RSA_verify(3) implementation for OpenSSH.
--- 319,331 ----
systrace(1) can log matching rules to syslog.
write(1) drops privileges after opening the tty.
! Refactor vmstat(8) slightly so kvm(3) is only ever opened once (it could be opened a second time by dkstats.c before).
Open the kvm(3) library earlier in fstat(1) and systat(1), and so drop privs earlier.
Test for a previously unchecked malloc() return value in the RPC library, and die unceremoniously on failure.
Catch file read errors in rdate(8)'s leapsecond handler.
Cleanup of amd(8).
! Remove Kerberos support from the default login.conf (and its hardwired defaults for when login.conf is absent). See the log for why.
No more RPC by default. Expect a lot of 'NFS is broken' email to misc@ when 3.2 is released.
Rework some aspects of crontab(1)'s file checks.
Provide our own RSA_verify(3) implementation for OpenSSH.
***************
*** 355,361 ****
Fix some more potential null pointer dereferences, this time in pfkey and netiso.
Plug a kqueue(2) file descriptor leak in the X server.
Have libc opendir(3) and scandir(3) check for size_t overflows like the new calloc().
! Like in libc, fix the calloc() implementation in named(8) (only used by a feature disabled in OpenBSD.)
Lots of work on the sparc and sparc64 console drivers.
Kernel IPsec was only doing ESP integrity checks on NICs that had already done so in hardware...
Fix a typo that caused a potential null pointer dereference in kernel NFS.
--- 355,361 ----
Fix some more potential null pointer dereferences, this time in pfkey and netiso.
Plug a kqueue(2) file descriptor leak in the X server.
Have libc opendir(3) and scandir(3) check for size_t overflows like the new calloc().
! Like in libc, fix the calloc() implementation in named(8) (only used by a feature disabled in OpenBSD).
Lots of work on the sparc and sparc64 console drivers.
Kernel IPsec was only doing ESP integrity checks on NICs that had already done so in hardware...
Fix a typo that caused a potential null pointer dereference in kernel NFS.
***************
*** 365,371 ****
SECURITY FIX: Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the ssl(8) library, as in the ASN.1 parser code in the crypto(3) library, all of them being potentially remotely exploitable.
A source code patch is available.
[Applied to stable]
! In pf(4), allow TCP flags to be specified in all rules that include TCP (before the rules had to be exclusively TCP.)
Fix a buffer overflow in backgammon(6), and replace its gameplay algorithm.
Kill a kernel tty memory leak.
--- 365,371 ----
SECURITY FIX: Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the ssl(8) library, as in the ASN.1 parser code in the crypto(3) library, all of them being potentially remotely exploitable.
A source code patch is available.
[Applied to stable]
! In pf(4), allow TCP flags to be specified in all rules that include TCP (before the rules had to be exclusively TCP).
Fix a buffer overflow in backgammon(6), and replace its gameplay algorithm.
Kill a kernel tty memory leak.
***************
*** 427,433 ****
Fix a systrace(1) double free().
Cardbus support for macppc.
Fix dc(4) cardbus reads.
! Remove a signedness bug in sshd(8)'s handling of utmp_len (-u option.)
Fix some bugs in pool(9).
More additions to GNU as(1), this time to make Ogle compile.
--- 427,433 ----
Fix a systrace(1) double free().
Cardbus support for macppc.
Fix dc(4) cardbus reads.
! Remove a signedness bug in sshd(8)'s handling of utmp_len (-u option).
Fix some bugs in pool(9).
More additions to GNU as(1), this time to make Ogle compile.
***************
*** 472,482 ****
Make atrun(8) part of cron(8), removing the need for the atrun cronjob.
More pf(4): accept !<interface> syntax. Oh yes.
top(1) now has a BSD license.
! pf(4) parser spots more silly combinations (return-rst on non-TCP rules, keep-state on block rules.)
Fix a double free in BSD authentication.
! Make ftpd(8) always use high port numbers for passive data connections (no more -h option.)
Add SIGALRM to the list of signals that can be sent (after uid/euid checks) to set[ug]id child processes.
Enable list expansion for pf(4) NAT rules, broken since the pf.conf/nat.conf merge.
--- 472,482 ----
Make atrun(8) part of cron(8), removing the need for the atrun cronjob.
More pf(4): accept !<interface> syntax. Oh yes.
top(1) now has a BSD license.
! pf(4) parser spots more silly combinations (return-rst on non-TCP rules, keep-state on block rules).
Fix a double free in BSD authentication.
! Make ftpd(8) always use high port numbers for passive data connections (no more -h option).
Add SIGALRM to the list of signals that can be sent (after uid/euid checks) to set[ug]id child processes.
Enable list expansion for pf(4) NAT rules, broken since the pf.conf/nat.conf merge.
***************
*** 489,495 ****
Add radio(4) device attachment for bktr(4) and fms(4).
Have pcibios(4) detect and ignore a too-short PCI IRQ routing table header.
Changes to ld.so(1): Search order now always looks like a.out, destructors are called on dlclose(), move some libc-like functions into private namespace.
! Add support for AGP GART on some i386 AGP chipsets (see vga(4) and options(4).)
Remove '\\' -> '\' translation in crontabs to keep the shell happy.
Make xterm(1) revoke its root privileges.
Remove a race and some other bugs from the mountpoint locking code.
--- 489,495 ----
Add radio(4) device attachment for bktr(4) and fms(4).
Have pcibios(4) detect and ignore a too-short PCI IRQ routing table header.
Changes to ld.so(1): Search order now always looks like a.out, destructors are called on dlclose(), move some libc-like functions into private namespace.
! Add support for AGP GART on some i386 AGP chipsets (see vga(4) and options(4)).
Remove '\\' -> '\' translation in crontabs to keep the shell happy.
Make xterm(1) revoke its root privileges.
Remove a race and some other bugs from the mountpoint locking code.
***************
*** 511,522 ****
Fix ni6_nametodns() pointer bug in icmp6; NetBSD PR17540.
Add support in uftdi(4) for FT8U232AM-based USB serial adapters, likewise add more devices to uplcom(4).
Fix miniroot typo that was breaking FTP installs.
! Fix sed(1)'s r command (PR2755.)
Add a daemon mode to systrace(1).
udbsr(4) driver for D-Link radio cards added.
Add a timeout value to USB I/O calls, rather than having a systemwide timeout.
Make httpd(8) chroot() and drop root privileges by default. A lot module chroot fixes to come.
! Add syscall aliasing to systrace(1) (e.g. stat/fstat/readlink/access/... become 'fsread'.)
Some fixes to umidi(4) and uscanner(4).
Add SMC 2206 support to aue(4).
Fix a potential off-by-five error in systrace(1).
--- 511,522 ----
Fix ni6_nametodns() pointer bug in icmp6; NetBSD PR17540.
Add support in uftdi(4) for FT8U232AM-based USB serial adapters, likewise add more devices to uplcom(4).
Fix miniroot typo that was breaking FTP installs.
! Fix sed(1)'s r command (PR2755).
Add a daemon mode to systrace(1).
udbsr(4) driver for D-Link radio cards added.
Add a timeout value to USB I/O calls, rather than having a systemwide timeout.
Make httpd(8) chroot() and drop root privileges by default. A lot module chroot fixes to come.
! Add syscall aliasing to systrace(1) (e.g. stat/fstat/readlink/access/... become 'fsread').
Some fixes to umidi(4) and uscanner(4).
Add SMC 2206 support to aue(4).
Fix a potential off-by-five error in systrace(1).
***************
*** 672,678 ****
Enable DMA on xl(4).
Allow transparent (statically keyed) ipsec(4) processing on a bridge(4).
Help ppp(8) to cope with yet more Microsoft PPP attributes.
! Extend ssh-agent(1) key lifetime constraints more flexible (i.e. more than just key lifetime.)
Teach ECN attributes to isakmpd(8).
Add eui64 option to ifconfig(8) for configuring the IPv6 interface index.
Add a sysctl(3) to get the CPU type on sparc and sparc64.
--- 672,678 ----
Enable DMA on xl(4).
Allow transparent (statically keyed) ipsec(4) processing on a bridge(4).
Help ppp(8) to cope with yet more Microsoft PPP attributes.
! Extend ssh-agent(1) key lifetime constraints more flexible (i.e. more than just key lifetime).
Teach ECN attributes to isakmpd(8).
Add eui64 option to ifconfig(8) for configuring the IPv6 interface index.
Add a sysctl(3) to get the CPU type on sparc and sparc64.
***************
*** 698,707 ****
New scrub(fragcache) ... syntax for pf(4).
pf(4) NAT proxy port ranges can be specified per-rule.
Don't panic(9) if pf(4) tries to insert a duplicate key.
! pf(4) NAT and filter rules now all go in the one file (normally pf.conf(5).) New pfctl(8) file syntax. Oh yes.
Clean up semantics of gre(4) a bit.
ifconfig(8) prints the Ethernet address. Yippee!
! route(8) now accepts DNS names (and naturally enough treats them as host routes.)
Stop isakmpd(8) using the same range for SPIs and CPIs.
Ports can now be specified in pf(4) NAT rules.
Allow systrace(4) to attach to a running process.
--- 698,707 ----
New scrub(fragcache) ... syntax for pf(4).
pf(4) NAT proxy port ranges can be specified per-rule.
Don't panic(9) if pf(4) tries to insert a duplicate key.
! pf(4) NAT and filter rules now all go in the one file (normally pf.conf(5)). New pfctl(8) file syntax. Oh yes.
Clean up semantics of gre(4) a bit.
ifconfig(8) prints the Ethernet address. Yippee!
! route(8) now accepts DNS names (and naturally enough treats them as host routes).
Stop isakmpd(8) using the same range for SPIs and CPIs.
Ports can now be specified in pf(4) NAT rules.
Allow systrace(4) to attach to a running process.
***************
*** 719,726 ****
Remove KerberosIV startup code from rc(8) files.
Make pf(4) NAT rules work more like normal filter rules.
Add SIO*PHYADDR to gif(4) so ifconfig(8) can set the outer address.
! Make published arp(8) entries work again (PR2635.)
! Make dhcp(8) build faster (PR2715.)
Start converting netstat(1) and systat(1) to sysctl(3) instead of kvm.
Set FDDI link MTU the same as IPv4 MTU, fixes PR2714.
Allow numeric group IDs in systrace(1).
--- 719,726 ----
Remove KerberosIV startup code from rc(8) files.
Make pf(4) NAT rules work more like normal filter rules.
Add SIO*PHYADDR to gif(4) so ifconfig(8) can set the outer address.
! Make published arp(8) entries work again (PR2635).
! Make dhcp(8) build faster (PR2715).
Start converting netstat(1) and systat(1) to sysctl(3) instead of kvm.
Set FDDI link MTU the same as IPv4 MTU, fixes PR2714.
Allow numeric group IDs in systrace(1).
***************
*** 751,757 ****
Make more use of splsoftnet() (instead of splnet()) in IPv6 code.
lo0 now only gets ::1 when it's brought up.
Merge kth-krb 1.1.1.
! Enable weak aliases in libc for powerpc, sparc and alpha (already enabled on i386.)
Add new splusb() to prevent USB initialisation lossage.
Improve SMART support in atactl(8).
Silently ignore deprecated options to ssh(1) since they may be passed in for a remote scp command.
--- 751,757 ----
Make more use of splsoftnet() (instead of splnet()) in IPv6 code.
lo0 now only gets ::1 when it's brought up.
Merge kth-krb 1.1.1.
! Enable weak aliases in libc for powerpc, sparc and alpha (already enabled on i386).
Add new splusb() to prevent USB initialisation lossage.
Improve SMART support in atactl(8).
Silently ignore deprecated options to ssh(1) since they may be passed in for a remote scp command.
***************
*** 798,805 ****
bpf(4) support for kqueue(2)
In isakmpd(8), add netmask, subnet and DHCP server request support to IKECFG.
Fix bktr(4) stereo.
! Support the RNG of AMD-768 southbridge (device amdpm(4).)
! Fix DMA handing of hme(4) (SPARC and SPARC64.)
Pull in libcsu change from NetBSD to allow dlopen(3) to be used much earlier.
Add -t key lifetime option to ssh-add(1).
Use IPv4/IPv6 addresses in /etc/inetd.conf instead of 'localhost' to avoid DNS lookups.
--- 798,805 ----
bpf(4) support for kqueue(2)
In isakmpd(8), add netmask, subnet and DHCP server request support to IKECFG.
Fix bktr(4) stereo.
! Support the RNG of AMD-768 southbridge (device amdpm(4)).
! Fix DMA handing of hme(4) (SPARC and SPARC64).
Pull in libcsu change from NetBSD to allow dlopen(3) to be used much earlier.
Add -t key lifetime option to ssh-add(1).
Use IPv4/IPv6 addresses in /etc/inetd.conf instead of 'localhost' to avoid DNS lookups.
***************
*** 820,826 ****
Don't automagically set -prefixlen 128 on IPv6 host route.
rasops instead of rcons for vgafb(4/SPARC64).
Add xsystrace(1) [no manpage yet] UI for systrace(4).
! Add sbus bwtwo(4) mono framebuffer support (untested.)
PrivSep'd ssh monitor processes check each authentication method is enabled before use.
systrace(1) userland import.
Use arc4random(3) for rtadvd(8).
--- 820,826 ----
Don't automagically set -prefixlen 128 on IPv6 host route.
rasops instead of rcons for vgafb(4/SPARC64).
Add xsystrace(1) [no manpage yet] UI for systrace(4).
! Add sbus bwtwo(4) mono framebuffer support (untested).
PrivSep'd ssh monitor processes check each authentication method is enabled before use.
systrace(1) userland import.
Use arc4random(3) for rtadvd(8).
***************
*** 1078,1084 ****
www@openbsd.org
!
$OpenBSD: plus32.html,v 1.12 2004/03/25 02:41:50 jcs Exp $