Changes made between OpenBSD versions.

The OpenBSD project was spawned from NetBSD (a member of the 4.4BSD family) in the summer of 1996 and is now developed completely separately. As well as developments by our development group, good changes from the other free operating systems are evaluated and merged into OpenBSD. We track bug reports and source tree changes from the NetBSD and FreeBSD projects fairly closely. Even pieces of code from the Linux projects have been used.

In the early days of OpenBSD, it was possible to be able to say "OpenBSD is NetBSD PLUS MORE STUFF". Now, after the substantial work the group members have done, OpenBSD is very much is it's own thing. Too much stuff has been added and fixed to easily compare it to something else. OpenBSD is OpenBSD.

This is a partial list of the major machine independent changes (ie. these are the changes people ask about most often). Port specific changes have also been made, and are sometimes mentioned in the pages for the specific ports if you are interested in for further port-specific details. Many ports have had architecture-specific enhancements relative to NetBSD, but when they do not they certainly have plenty of platform-independent changes, starting with those listed below..

Note: Problems for which patches exist are marked in red.

To go straight to the changes since OpenBSD 2.1, click here.
To go straight to the changes since OpenBSD 2.2, click here.
To go straight to the changes since OpenBSD 2.3, click here.
To go straight to the end of the list, click here.

Life for the OpenBSD project begins...

• Many many NetBSD PR's fixed (which NetBSD has not yet fixed)
• New curses library, including libform, libpanel and libmenu.
• a termlib library which understands termcap.db, needed for new curses.
• The FreeBSD ports subsystem was integrated and is usable by you!
• ipfilter for filtering dangerous packets and Network Address Translation for IP masquerading.
• better ELF support
• nlist() that understands ELF, ECOFF, and a.out, allowing non-a.out ports to use kvm utilies
• Verbatim integration of the GNU tools (using a wrapper Makefile)
• All the pieces needed for cross compilation are in the source tree.
• Some LKM support in the tree.
• ATAPI support (should work on all ISA busses)
• new scsi, md5, pkg_* commands
• Numerous security related fixes
• Kerberos and other crypto in the source tree that is exportable
• Solid YP master, server, and client capabilities.
• /dev/*random -- a device driver providing some kinds of random data
• In-kernel update(8) with an adaptive algorithm
• Some ddb improvements and extensions
• Numerous scsi fixes
• ncheck utility for ffs
• /sbin/init now deals with non-existant ttys, no longer spins gettys madly.
• new system calls: rfork(), minherit(), poll().
• select() that can handle any amount of file descriptors.
• kernfs extensions
• ATM support (support for one company's sparc & i386 cards available)
• Boot kernels with "-c" to edit/enable/disable device configuration tables
• pax as tar, gnutar is toast
• using AT&T awk, gawk is toast
• Even more security fixes.
• Accepts FreeBSD MD5 passwords in password maps, soon will be able to generate them too
• Linux ext2fs and BSD4.4 LFS support being worked on.
• Working ATAPI audio support for multiple architectures.
• terminfo database support.
• Fortran in the tree.
• The most secure rdist support anywhere.
• randomized port allocation in bind(), bindresvport(), and rresvport() -- security via unpredictability.
• Protection from the udp spamming and ftp bounce attacks.
• Significantly improved ftp daemon.
• Numerous more security policy and implementation improvements (OpenBSD defaults to installing in a very secure mode)
• zlib (non-GPL'd gzip-compatible library)
• Newest version of pppd.
• _POSIX_SAVED_IDS behaviour with permitted BSD extensions.
• Fixed long-standing vm swap-leak.
• FreeBSD malloc() that uses mmap() and is able to free unused memory.
• Numerous FreeBSD userland fixes and improvements incorporated.
• new rdisc Router Discovery daemon
• generic protection against the bind() takeover problem.
• at -f security fix.
• 20 or so more security fixes
• install now supports -C, -p, and -S flags.
• a real adduser program, which can even be used uninteractively.
• POSIX & C2 requirement; lose setuid/setgid bits if owner/group changed by chown(). This can be turned off with sysctl.
• partial protection against tcp SYN attacks.
• added /etc/fbtab support to login & init.
• RCS version 5.7
• much newer join command (4.4lite2 with other fixes)
• scsi subsystem security fix
• Kerberos is much more silent if not configured
• arc4-based random support in kernel
• ncr53cXXX scsi scripts assembler
• Numerous ftpd improvements and fixes, including multihomed and skey support.
• `lsof'-style features in fstat.
• rudimentary support for ISA Plug-and-Play cards
• Fixed timeout support in RPC library, and also fixed it to support more than FD_SETSIZE file descriptors.
• improved locate command
• a good start at NETIPX support
• vim version 4.5
• gcc 2.7.2.1 (to get closer to native alpha support ar gcc bugs).
• latest version of perl, and a lndir command.
• Even more security fixes.
• cdio command for using CD audio.
• Kernel warns if /dev/console does not exist; nice warning for booting with an unpopulated /dev directory.
• libgnumalloc is gone; our malloc() is better.
• FreeBSD pipe() system call; quite a bit faster.
• Some serial driver support for /dev/cuaXX devices to support transparent out+dial
• DDB can now access symbol tables from LKM modules
• Say goodbye to dump, restore, and mt security holes: They are no longer setuid.
• *Hobbit*'s netcat utility. The crackers use it, so should you.
• New routed from SGI.
• Complete in-tree development for MIPS/Alpha systems (ie. binutils).
• ftp command modified for easily scripted ftp & http downloads.
• And of course... more security related bugfixes... (ie. dump, restore, mt).
• vim is replacing nvi, since nvi does not have a pure BSD license, and vim also works better.
• 16 partitions working on sparc and i386 (yipee!)
• Nice sample files in /etc
• sendmail gecos hole fixed (in a number of ways; other programs in the source tree were also vulnerable.)
• secure multicast tools against possible security problems.
• latest GNU groff, incorporated in a clean wrapperized form.
• mopd for networking booting Digital machines
• less version 2.90
• deal with the SYN bomb problem (denial of service attack) as well known.
• Another kerberos security fix.
• Almost a hundred more security fixes, including /tmp races because of strncpy.
• Compile time option to compile the source tree almost completely dynamic.
• A 7% reduction in size of static binaries.
• FreeBSD's adduser(8) command. Also an rmuser(8) command.
• We have completed security reviews of almost all userland programs and libraries except for the gnu stuff (where, based on preliminary inspection there is poor handling of temp files).
• Working Linux ext2fs.
• Added sudo (which is maintained by one of our developers)
• CTM is now a supported way of obtaining OpenBSD source code.

OpenBSD 2.0 released.

• The NIST Posix test suite became free. As a result we have been correcting numerous problems in the source tree, and expect to be completely POSIX compliant very soon.
• upgrade to CVS version 1.9.
• A number of security fixes to the way coredumping works.
• The /dev/*random devices are now default on all architectures.
• Add stack tracebacks to Arc port's kernel debugger.
• Skey revamped into full OTP (RFC1938) support, including sha1 and md5 support.
• GPL i387 emulator added.
• Crank kvm space on the i386 port, also limit buffer cache useage so that 512MB machines may work (untested :-)
• Numerous fixes to the lpr suite, including security.
• More ftpd raging paranoia security fixes.
• The NIST suite showed numerous errors in libraries and the kernel. Only a few small errors remain now, mostly regarding serial ports.
• In numerous utilities: prefer $LOGNAME, but also accept $USER.
• OLF binary type added. This is like ELF, but includes an OS-dependent tag. elf2olf(1) converts an elf binary to a tagged OLF binary which the kernel can recognize correctly.
• Beware $HOME overflows throughout the source tree.
• Integration of the pmax port.
• Import of ctm.
• Various repairs to the scsi scanner support.
• Numerous more difficult-to-exploit-but-possible-if-someone-really-wanted-to buffer overflows found in system utilities..
• Memory leak paranoia in cron.
• Make login get more consistantly upset about failed logins, and tell user about these failures at the next successful login.
• pdksh version is now 5.2.11
• New bsd.*.mk feature: DEBUG=-g. Try it, you'll like it.
• The Arc port family has a new member: The rPC44 works!
• lpt driver is now bus-independent.
• com driver is now bus-independent.
• Numerous small security fixes again...
• Use pdksh as our /bin/sh. This provides excellent POSIX compliance.
• Prevent generic users from mounting filesystems by default.
• Added -C option to pax/tar. Also made -z support compressed files too.
• Increased compatibility in the pccons driver with BSDi features.
• Imported FreeBSD's calendar.
• GNU gdb works on the mips-based platforms.
• Add FreeBSD md5 diffs to mtree(8). This can be used to implement a tripwire-like system.
• Some YP and bootparamd security changes.
• Hundreds of little fixes all over the place.
• Multiple updates for GNU software
• Add disklabels to the floppy device drivers.
• At boottime, have (*mountroot)() look at the root device's disklabel to determine which filesystem type is to be mounted.
• If disklabel reading code discovers an ISOFS filesystem underlying, spoof a nice disklabel (enough to fool mountroot).
• tcpdump 3.3
• Fix information gathering attack in ping(8).
• Add NetBSD's "route show" implementation, and at the same time fix the new buffer overflows that this provided.
• Fix a few setgroups() related security holes.
• sendmail 8.8.4
• texinfo 3.9
• f77 0.5.19
• Repair some more KerberosIV buffer overflows. Hard to believe this is supposed to be security software.
• Add XCASE/IUCLC/OLCUC/OCRNL/ONOCR/ONLRET tty subsystem flags for backwards compatibility.
• Permit NFS attribute cache to be configured on a per-mount basis.
• Properly split fsck, mount, and newfs into multiple pieces. Use disklabel information if it is available.
• Add disklabels to the vnd device driver.
• Change the games to be run setgid games, not setuid games. This closes a whole slew of fascinating security holes.
• Import of the powerpc port.
• Properly use _POSIX_SAVED_IDS throughout the source tree.
• Permit building of kernels without a.out support.
• ppp 2.3b3
• libcrypt goes away. We do not need this stub library anymore. Do not link against it on OpenBSD, all the pieces you need are in libc.
• new aucat command.
• Fix a fairly nasty security hole in all of the games.
• Support for the hp300 added.
• Upgrade of awk(1), integration of BSD tsort(1), getopt fixes.
• Sendmail upgraded to version 8.8.5.
• Added lchown(2) for compatibility with SVR4 implementations.
• New gnu cpio 2.4.2
• Support lchown(2) in dump(8), cp(1), pax(1), cpio(1), chown(8), and restore(8).
• No buffer lengths in fmt(1).
• various adjtime() corrections inside the kernel.
• Prevent stat() from disclosing inode generation numbers to non-root userland.
• pax in tar mode will understand multiple -v options to generate ls-like output.
• Repair many uses of the SIOCGIFCONF code for machines with an outrageous number of network interfaces.
• More kerberosIV security patches.
• A working fsirand.
• Completely in-tree PowerPC port for non-Apple hardware. This port requires nothing outside the in-tree development environment to build (except mkisofs for building distributions).
• Some ypbind(8) tightening up, includes a method to specify a list of valid servers
• Bug fixed that prevented bufpages/nbuf > 1 setups. This allows large buffer caches even when available kvm space is low, like for i386 & sparc.
• Changed netinet IP_HDRINCL option to require ip_len and ip_off in network byte order. This is a compatibility/portability fix and we expect other BSD systems to eventually follow suit.
• amd (the automounter) is now 64-bit and working on the alpha.
• The Alpha port and all it's utilities now compiles using in-tree versions of all tools. Yipee!
• A SA_SIGINFO implementation for sigaction() and signal handlers. This is a small part of POSIX 1003.1b and permits the signal handler to figure out the exact cause of a signal; such as fault address information for SIGSEGV or more detailed information for SIGFPE.
• config.old(8) has been removed from the tree, as the hp300 port switches to config(8).
• /sbin/dump -a saves you from needing to deal with finicky tape length options (from FreeBSD)
• Added RFC-1812 ICMP unreachable codes to ip_icmp.h, traceroute, and ping.
• Be more careful if some fool decides to enable source routing ;-)
• Support for gzip'd kernels in some bootblocks.
• New wgrisc port for Willowglen embedded r3081-based machine with ISA slots.
• Add cdev and partition support to the ramdisk driver.
• Merge new ftp(1) changes from NetBSD.
• Change mktemp(3) and family to generate more random filenames, yet still as collision free as possible.
• Have libc/rpc save you from yourself if you do enable source routing.
• The hp300 joins many other ports in supporting 16 disk partitions.
• IPF 3.1.7 which includes fully working NAT support (ie. IP masquerading).
• Use lots more XXXX characters in calls to the few remaining mktemp() calls in the source tree. This cuts out a whole class of races.
• Improved NFS filehandle creation.
• Make dd(1) work fine with our 64-bit off_t types, now you can copy very large disks using it.
• add RPC service name generation to netstat -a
• Fix pax & tar to be POSIX compliant.
• Fix a few netinet kernel crash problems.
• Fix so that stack limits which are not a multiple of the pagesize work.
• fix some more memory and file descriptor leaks in libc/rpc
• New scalable BLOWFISH-based crypt algorithm for passwd file entries. It uses a very large strong-random `salt' and the number of rotor runs is configurable. Hence if you have faster machines you can slow the crypt routine down and make harder keys.
• Add support for /etc/passwd.conf which controls the format and strength of passwd entries for the next time a user changes their password. These options can be set per-user.
• Working kadmind for kerberosIV.
• IPSEC package from John Ioannidis and Angelos D. Keromytis.
• cvs 1.9.2
• Fix weak symbol support in ld.
• libg++ pulls in libcurses automatically.
• Replace which(1) with a C program.
• newfs(8) now has an inline fsirand(8) with no noticable speed decrease.
• settimeofday(2) won't roll back the date if securelevel > 0 (from lite2).
• deroff(1) 1.0 from Debian (a Linux).
• BIND 4.9.5-P1.
• Add support for FreeBSD md5 to /etc/passwd.conf.
• Import of the mvme88k kernel port.
• Import of libwrap and tcpd (tcp wrappers).
• Numerous improvements to pax, including full support for cpio and a lot of fixes to tar mode.
• Let fsck and fsirand automatically work on very large filesystems.
• Various fixes to the fsck tools.
• ipsecadm as an initial cut at controlling IPSEC sessions.
• Fix pcmcia on the i386.
• Merged changes from at 2.9 into our own at.
• pccon(1) to control the pccons driver.
• Bye bye tahoe bits.
• noaccesstime option for filesystems (saves batteries on laptops)
• Substantial changes and fixes to the scsi scanner support.
• Support for "secure" YP password maps.
• Various atm fixes.
• The NE2000 if_ed driver now works on the alpha, too.
• ddb improvements for 64 bit machines.
• Fixes to fts(3).
• A few ypbind fixes.
• sysctl kern.osrevision gives OpenBSD date.
• gcc no longer defines -D__NetBSD__, only -D__OpenBSD__ now!
• Implement NOFILE_MAX--hard limit on max descriptors per process.
• Be more careful about modes of lost+found directories.
• New termcap and terminfo database files.
• Change mail.local -H behaviour slightly, and convince mail(1) to use it for correct locking!
• 64 bit clean in.rarpd.
• cvs 1.9.6
• 16 partition support for the alpha port.
• Add ./.message support to ftpd
• Numerous more pax/tar fixes.
• Add md5 & blowfish passwd support to adduser(8).
• Add support for YP v1 to ypserv.
• Fixed some more mktemp races (sigh, will this ever end!)
• More buffer overflows, but none in sensitive programs.
• getnetent() and friends now work a lot more like gethostent().
• Use 10 X characters in many remaining mktemp() calls which are hard to excise.
• Solve a few resolver problems after the recent 4.9.5-P1 integration, not all our fault.
• Fix patch to honour Index lines better.
• A whole bunch of 64 bit fixes in the source tree (hint: alpha).
• Once again, really correct the various source routing pieces of the userland source tree.
• Make real i386 cpu's work again. In case noone noticed, they didn't work for about 5 months. The bug was very hard to find...
• For config(8), if any kernel options get added/deleted/changed since the previous commit, warn that the compile tree needs 'make clean'.
• Use in_addr_t and in_port_t all over the place.
• Correct DEV_BSIZE and lp->d_secsize confusion throughout the source tree. CD9660 is much happier now.
• Fix AFS string-to-key handling in kerberos.
• NAT now gets started from /etc/netstart.
• Various man page fixes.
• For the first time ever, an obj@ populated /usr/src tree compiles cleanly when mounted read-only.
• The df(1) utility now has a human-readable "-h" option.
• Always skip the first 8KB of all swap partitions (hint: disklabels & bootblocks)
• Repair some bugs in mail(1), especially regarding signal handling.
• Support .group entries in /etc/passwd.conf
• PCI aic7860 scsi support improved.
• Support /etc/rc.shutdown from halt(8).
• Support extended partitions in fdisk(8).
• Various fixes to the YP utilities.
• Signal handling fix to crontab(1).
• Unify naming of architecture names between gcc & binutils.
• Some more userland 64 bit fixes.
• Support for PCI NE2000 clones.
• libpthread works on the m68k.
• Significantly improved the unpredictability of the DNS packet id's in the resolver and named.
• newfs_msdos(8) can has enough brains to find the partition size itself.
• Split rc.local, creating rc.securelevel. (Securelevels look like a worse and worse idea every month).
• A bit more man page cleanup starting to happen...
• GNU Groff 1.10 with (improved) Makefile wrapper.
• sleep(3) and usleep(3) now call nanosleep(2) for significantly less overhead.
• The vnd(4) device has a new safer mode of operation called svnd where you can trust a disk-image right after it's unmounted, i.e. cache-coherency.
• Repaired install stuff for most architectures significantly, improving ftp/http installs, single bootable install floppies, and in some cases CDROM booting. Most floppies contain vi, too.
• Support crunch on arc (for bootable installs).
• Added gzip and cdrom support to the sparc and alpha bootblocks.
• Fix keyboard and delay timing in i386 bootfloppy bootblocks. Whee!

OpenBSD 2.1 released (July 2, 1997).

• Few quirky changes to the way ISO9660 disklabel spoofing works in some ports.
• Fix a few more libc functions to generate very large fd_set's properly for select(2).
• Import newer version of vax port.
• Newer version of ext2fs that is reliable for read/write operation. This is essentially FULLY OPERATIONAL.
• Make adduser understand /etc/passwd.conf
• Support SIGINFO in ping; also add more complete icmp reporting capabilities.
• New named root.cache from Internic.
• Lots of man page fixes.
• Fix more overflows and other bugs in mail(1).
• tail(1) can now notice if the file been replaced or truncated.
• getpgid(2) from XPG3(?)
• In ar(1), truncate uid & gid if too large.
• Add some more malloc options to malloc(3)
• tcp wrappers 7.6
• Fix lots more NetBSD PR's.
• Few more fixes to pax(1).
• kill process timers if execve'ing a setuid/setgid executable.
• fix sendsmg() credential passing on 64 bit machines.
• Kernel now generates random pid values in fork().
• A few netinet fixes.
• Some more security and robustness changes to traceroute and ping.
• Add -P proto support to traceroute.
• fix SO_SNDTIMEO.
• add sysctl net.inet.tcp.{keepidle,keepintvl,slowhz}
• fix disklabel support in vnd/svnd.
• Ensure TCP RST is within window.
• Use /etc/namedb/tmp/ to avoid /var/tmp race conditions.
• Use dynamic fd_set allocation in more places, particularly setuid programs.
• tftpd -c flag.
• document the ddb hangman.
• Move named tmp files to /etc/named/tmp/ to avoid localhost race attacks.
• Addition of readlink(1).
• Implement hex/octal offsets in cmp(1), as documented.
• Repair many cross-references and other documentation problems in the section 2 and 3 man pages, and also fix a few minor other bugs discovered by analysis of recent changes in FreeBSD's and NetBSD's libc.
• Add tsearch(3) and friends to libc, as required by XPG3(?).
• Fixed a few netinet bugs as pointed out by TCP/IP Illustrated Vol.2.
• Improved performance in /dev/*random.
• Deal with atapi drives that cannot lock their doors.
• Fix /tmp races in make(1).
• Add tsearch(3) to libc.
• In newfs(8), fix -o and -m to work better.
• Correct -n behaviour in sort(1).
• Better support for unmounted filesystems in df(1).
• add per-interface bindings to inetd(8).
• Fix some more /tmp races in various programs.
• Support "-d dir" in rpc.yppasswdd(8).
• Make ifconfig(8) print full information about the full set of interface aliases.
• add -insecure flag to ypbind(8) so that it can bind to very old ypserv's.
• More ipsec changes!
• Change mount(2) to return EFTYPE for invalid filesystem.
• Some NLS improvements, notably some more language catalogs.
• Add ELOOP error handling to realpath(3).
• More paranoia in procfs.
• Slightly improve ftpd log file.
• Added automatic power down framework at halt(8) time, currently only supported on sun4m machines with the power device.
• IPF 3.1.11 + Darren's patches + 64-bit cleanup.
• Fix a minor problem in popen().
• Use O_EXLOCK for passwd locking to avoid a class of localhost denial of service attacks.
• Clip setsockopt SO_SND*/SO_RCV parameters.
• Repaired hundreds of long != int problems (in a bunch of programs) that affect the alpha.
• Y2K enhancement to date(1).
• Race fix to amd(8).
• Support IP option handling in IPSEC packets.
• Import of the gnu multi-precision math library, libgmp. This will be used by an IPSEC key daemon soon.
• Modify inetd to accept a "hostname,[hostname,...]:" token to added to the front of any line in /etc/inetd.conf. This permits services to be supplied only on certain interfaces.
• A few more minor netinet problems fixed.
• Import of cvs-1.9.10.
• Fix readlink(1).
• Permit tftpd to provide files over 32K blocks in size.
• New kprop/kpropd man pages.
• Make sleep(1) handle fractions of seconds. This is a nice extension.
• Move libdes out of the kerberos tree so that it can be used by other parts of the system too.
• Many more 64 bit fixes for the alpha, in about 20 more programs.
• libedit update with lots of fixes.
• Fixed all(?) Makefile wrappers for GNU software to not build and install manpages when NOMAN is set.
• Fixed highscore handling in battlestar(6).
• Repaired nfs handling in tcpdump.
• split ifconfig -a into -a/-A: -A prints ifaliases, -a does not.
• Fix a number of rtld dynamic loading problems.
• More IPSEC changes. IPSEC is almost fully useable now.
• Intel EtherExpress Pro/100B PCI driver.
• ATAPI devices may now reside in a kernel without wd (disk) devices.
• Amended issetugid(2) man page to be quite a bit more clear.
• Fix ruptime output for machines up > 99 days.
• Maintain process size stats in forkstat struct for "vmstat -f".
• make compress(1) do gzip support too.
• Make ed(1) work properly on a non-tty.
• Fix passive buffer overflow in rusers.
• Replace libc sha1 code with another version that is better in some respects.
• Repair symbolic link handling during coredumps (correctly, this time).
• Lots more IPSEC improvements.
• Add sha1 support to md5(1).
• Add sha1 digest support to mtree(8).
• More mail(1) fixes, particularly regarding long lines.
• cua devices, new MAKEDEV script in the hp300 port.
• Updated Sendmail to 8.8.6.
• man page cleanups.
• lpd security fixes.
• Add rmd160 hash support throughout the source tree.
• Import of the IPSEC photuris daemon.
• Add -d date support to last(1).
• make ctags operate a bit better in the presence of extra spacing.
• IPSEC Photuris daemon is integrated into the source tree.
• mail(1) behaves correctly when interrupted while getting headers from the user.
• mail(1) supports "inc" command.
• S/Key keyfile is now readable only by root. skeyinfo(1) and skeyaudit(1) have been enhanced and rewritten as C programs.
• Appletalk networking support.
• permit ftp(1) to download http pages without Content-Length.
• Some cribbage(6) fixes.
• All Makefile.bsd-wrapper files can now strip GNU binaries during install (pr 188.)
• Do not use tempnam(3) in mail(1).
• make amd(8) use /tmp_mnt by default.
• Implement IFF_NOARP handling in netinet.
• Fix pax to not need getcwd(3).
• Add -T support to last(1).
• -d flag for shutdown(8).
• Support lpc(8) "all" keyword option.
• Support YP map mail.aliases set of maps.
• Hardcode a list of reserved ports that random port allocation should not reuse.
• Use sendmail -t instead of other invocation forms inside lots of programs in the source tree.
• mremap(2) support for Linux emulation.
• Switch back to nvi; vim has copyright licensing issues.
• stime(2) support for SunOS emulation.
• More mail(1) fixes.... It's amazing Todd hasn't broken it.
• Support -H flag in who(1).
• Allocate reserved ports for NFS inside the kernel randomly.
• Man page improvements in many areas.
• Fix systat manpage.
• An ugly identd race fixed.
• More buffer overflow fixes in mail(1).
• Various fixes and improvements to the 3cXXX ethernet drivers.
• routed(8) is now disabled by default.
• Support fpx cards with i82555 PHY.
• Todd Miller is on a rampage, and making every single buffer inside mail(1) dynamically allocated...
• Radius support in tcpdump.
• More fixes to the alpha vga driver. Curses-based programs now work on it.
• FSF GNU texinfo 3.11.
• Attempt to cleanup identd. A long road left.
• Deal nicer with rfork/execve interactions.
• Make if_tun to prefix address family as a host byte order u_int32_t instead of a u_char, so that bpf can deal with the interface.
• Fix a kernel bug regarding double m_freem()..
• Sendmail 8.8.7.
• Fixed getnetbyaddr() 'always tried DNS' resolution problem from 2.1.
• Cyclades driver fixed. Works on alpha, too.
• More mdoc pages.
• save errno in most of the tree's SIGCHLD handlers, just in case.
• Make 127.0.0.1 assumed OK if /var/yp/securenet is in use.
• Fix pdksh bugs: closed too many fd's on exec, fix handling of (( )) to be compatible with POSIX sh spec without breaking $((, and explain how IFS works when splitting text after a substitution.
• Fix another race condition in identd.
• Work has started to fix the remainder of the signal handlers in the source tree with respect to errno clobbering.
• Seriously rework the identd daemon even further, to avoid even more input parsing problems and race conditions.
• Fix a memory leak in grep(1).
• Fix vacation(1) properly.
• Make bsd.doc.mk use DOCDIR.
• Support -n better in pstat(8).
• Change the bounds_check_with_label() API to handle a cpu_disklabel too.
• Optional TCP syn cookie support enabled via TCPCOOKIE kernel option.
• Import ypserv performance.
• Make bad random allocation ports settable via sysctl(8).
• Make gzexe(1) use mktemp to avoid races.
• Fix pcap_inject(3) in libpcap.
• In mountd(8), handle ext2fs specially, like most exported filesystems.
• Be even more paranoid (if it can be believed) in mail.local(8).
• Add top(1) to the source tree. Fix some problems.
• Fix another procfs security hole.
• ATAPI quirk for MATSHITA CR-574.
• Attempt to deal with archive timestamp and filemode problems in texinfo...
• Put hostname in root crontab mailout subjects.
• We are starting to pay attention to good things found in the XPG4 standard. We hope to never be compliant, because XPG4 goes way too far.
• More 1003.2 conformance: cal, cksum, sleep, compress, expr, etc.
• Support simple add/delete operations on ports in the baddynamic masks via sysctl(8)
• Be more careful about YP groups in getgrouplist().
• New PCMCIA Wavelan driver.
• More user-friendly error messages from mount_* when the filesystem is not in the kernel.
• Changed realloc(foo,0) semantics to be like malloc(0), not free(foo).
• Fixed a bug in cp(1) when the -r option is used and the source dir ends in a '/'.
• Verbose SCSI warnings are now available and on by default.
• Added basename(3) and dirname(3) for XPG4. dirname(1) is now trivial.
• XPG4 compatibility for ps(1) format options.
• Buffer overflow fixes in tip(1).
• Fixed err(3)/warn(3) argument usage in the tree.
• shutdown(8) now gets its own session as it deserves.
• Fixed a bug where the kernel could lie about how many file descriptors are available and cause a panic.
• ash is gone gone gone.
• The group vector could end up with duplicates esp. with YP. Now it won't.
• Document a64l(3) and l64a(3).
• basename(1) and dirname(1) no longer give an error for paths starting with '-'.
• Don't print duplicate fields in ps(1) when called with silly arguments.
• Few more 64 bit fixes in userland, in some rarely used system tools.
• Various fixes to battlestar(6).
• A few fixes to tip(1).
• In join(1), require compat options start with '-'.
• In dump(8), do not consider tape changing time in the timing estimates.
• Correct 'sync' option to dd(1).
• Lucent Technologies (formerly AT&T) awk version 970821.
• Handle setgid lossage in tip(1).
• Fix a crash in systat(8).
• Further IPSEC enhancement (but still no man pages for it though).
• In calendar(1), support "-t date" to let you see the calendar for other days.
• More SysVR4 emulation: sockets, NTP, POSIX time functions, pread(2)/pwrite(2).
• Kill "union wait" in a few more places.
• Handle SIGCHLD better in rlogin.
• Correct some remaining small inetd bugs.
• Do permission checking at delivery time for pgid's derived from TIOCSPGRP, F_SETOWN, or FIOSETOWN.
• Some FreeBSD m4(1) fixes.
• Fix first directory handling in "find -execdir"
• make glob(3) XPG4.2 compliant, which means use GLOB_ABORT.
• ppp 2.3.1...
• Another tip(1) overflow fix.
• New COMPAT_BSDOS binary compatibility subsystem.
• Print system call emulation in ps(1) output. Try "ps -axO emul".
• Update ftp(1) to new NetBSD changes.
• make mail(1) be permissive about pairs in mailbox files.
• Cleaned up verbose scsi error reporting.
• make bpfread() return ENXIO for uninitialized descriptors.
• Extend buffer lengths in patch(1).
• Fix a coredumping problem in tip(1).
• Preliminary manual pages for the IPSEC utils.
• Fix a long-standing and minor problem with ld.so on m68k.
• Ignore trailing spaces on priority in /etc/syslogd.conf.
• Make ddb not think 'h' means hangman.
• Some setlogin() and getlogin() fixes in the tree.
• Fixed small pathname buffer in man(1).
• Made indent(1) handle unlimited number of -T options.
• Some fsck_msdos(8) fixes.
• Make popen(3) safe if vfork(2) does real parent address space borrowing.
• Always set the SCSI-1 LUN field correctly in all transfers.
• Added ex (EtherExpress Pro/10) driver ported from FreeBSD
• Fix a ksh(1) bug.
• Permit a longer path buffer in tgetent(3).
• Some syslogd fixes.
• Fix SA_* sigaction(2) fields in the OS compat code.
• Don't error out of MDTM fails.
• Add sigaction(2) SA_NOCLDWAIT support.
• Add mkisofs(8).
• Run calendar -a in the background. (Points to whoever figures out why).
• Another important disk-full check in pwd_mkdb(8).
• Fix ftime(3).
• Fixed various MAKEDEV bugs on lots of architectures.
• Deal with some possible buffer overflows in sup.
• Make top(1) work better on very small screens.
• Fix tar to deal better with one more kind of strange tar file.
• Shrink most of the install floppies ;-)
• Fix a few small problems in rarpd(8).
• Make ls -d sort directories with files.
• Do not init pgid in /dev/log's logopen().
• Fixed a pstat -s related bug in pcvt.
• Ignore SIGPIPE in inetd(8).
• In struct sigaction, split sa_handler and the new sa_sigaction function pointers as is being done on newer POSIX systems. This permits proper prototyping of signal handlers.
• Fix an ifconfig bug related to interfaces that do not exist.
• Make execle() use alloca() instead of malloc(); to ensure execle() can be safely called in a signal hander.
• Fix the : and . support in chown so that usernames can have . in them.
• Fix a network performance problem introduced with IPSEC.
• Add support for FNM_LEADING_DIR, FNM_CASEFOLD, FNM_IGNORECASE to fnmatch(3).
• Fix a bug in libform.
• Add -f option to readlink which does a realpath(3).
• More IPSEC improvements after the Interop ANX bakeoff.
• A few pppd fixes.
• The random(6) tool (game?) now uses arc4random(3).
• Fix prompting code in pw_edit(3)
• Ignore bogus hostnames in the /etc/exports file.
• Make /etc/security handle blowfish-a passwd entries.
• Rewrite of fdisk(8).
• Handle a potential crash in the bpf driver.
• Quirks for two kinds of hitachi dk515 scsi drives and the Cipher ST150S tape drive.
• Handle creation of /var/tmp/vi.recover more securely.
• Implementation of the new disklabel -E mode.
• Support 'q' modifier in kernel vsprintf/kprintf
• In fmt(1), support backslashed whitespace inside words better.
• Make disklabel -E always succeed at writing a label. Now you can load a fictitious label, edit it, and write it out.
• Repair the msdosfs timestamping code so that NT/Win95 do not complain.
• Another lpd security fix.
• Some minor tftpd bug fixes.
• Fix one last little problem case in the fts(3) library routine. This is a very complicated piece of code...
• Fix a memory leak in libdes.
• Fix mktemp() to work correctly when specified against non-existant directories.
• Make ac(8) use the correct timestamp if the user specifies a different wtmp file.
• Fix a select/read race in identd(8) which would make it spin wildly.
• Make the ncr scsi driver work on big-endian machines too.
• Add per-host locking support to supfilesrv.
• Make clri(8) mark the filesystem dirty.
• Addition of 'kbus' port for the Solbourne Series5 sparc-based machines.
• The new afterboot(8) man page. Everyone should look at this.
• Prevent open(2) with wrong flag modes.

• Add svr4 jioctl() compat interface.
• Make kdump(1) handle the newer emulations.
• a buffer underrun in ctags(1).
• In tftpd(8), permit syslog() to work when running chroot(2)'d.
• Add blowfish and cast encryption to IPSEC.
• SIGWINCH handling in systat(1).
• If a non-existant user logs in and asks for s/key authentication, fake a proper s/key prompt.
• Make disklabel -E deal with multiple partitions which overlap.
• Replace kernel printf with Torek's libc printf.
• Be more careful with getpwent() information inside rcp(1).
• Handle C++ and other languages in yacc(1) far better.
• Fix an as(1) parsing bug relating to the .ascii directive.
• Fix some memory leaks in the RPC code.
• Document how crypt(3) handles blowfish and MD5 passwords.
• Truncate large uid and gid values in ranlib(1), in the same way as this is handled in ar(1).
• Fix rpc.rquotad support if the quotas file resides on another filesystem.
• makewhatis(8) manpage added.
• Fixed ps(1) LIM and STAT columns.
• usleep(3) returns int, and add useconds_t type as required by XPG4.2
• 4.4BSD lite2 vfs integration.
• Support execution sections in syslog.conf.
• Start named(8) earlier in /etc/rc.
• add uu_lock(), uu_unlock() and uu_lockerr() to libutil.
• sendmail 8.8.8
• double MAX_KMAPENT and MAX_KMAP
• Fix tty suspend during sh -c "less file".
• Add more things to afterboot(8).
• Correct TCP's handling of RST.
• Fix EXTPROC in pty code.
• Update getNAME(8) and fix makewhatis(8) to use it more optimally.
• Some compat_svr4 fixes.
• Flesh out compat_freebsd a fair bit more.
• Some minor fixes for the libc/db/btree code.
• Add getsid(2) system call as mandated by XPG4.2.
• Make dumpfs(8) report if soft updates are requested by the superblock.
• Make "expr a : /" work.
• Support an "object" keyword in config(8).
• Support -mmin, -amin, and -cmin in find(1).
• Fix a ONLCR + FLUSHO situation in tty.c
• Make msync(2) POSIX compliant.
• Make the if_de driver support more cards.
• Clear CLOCAL mode in pppd if modem is set but modem_chat is not.
• Add inetd(8) -R rate flag, and crank default rate to 256.
• Fix a line continuation bug in sed(1).
• Change various system calls to take void * instead of caddr_t.
• Range-check the "how" argument for shutdown(2).
• Make the -Ss flag in rpcgen(1) work right.
• Add SHUT_RD, SHUT_WR, and SHUT_RDWR values for shutdown(2) as specified by XPG4.2.
• in chat(8), replace Mini Getopt from hell with real getopt().
• Minor logging feature changes in fingerd(8).
• Fix some Y2K problems in the nroff tmac macros.
• Added mode rangecheck in chmod(2) and fchmod(2).
• Consider only the 0177777 bits of the umask(2) value, as documented.
• Implement FIONBIO in ibcs2 emulation code.
• Make fstat(2) on AF_UNIX socket return proper st_[acm]time field values.
• make readlink(1) terminate it's buffer correctly. This affects CDROM builds so a patch is available for 2.2.
• Clean /var earlier in the /etc/rc script.
• Fix the internals of open(2) when O_TRUNC and either O_SHLOCK or O_EXLOCK are set. (That was a nasty kernel bug).
• Fixed bug in 'systat vm' output.
• Update sudo(8).
• Import of FreeBSD's ppp(8) program.
• Fix a memory leak in the kernel process group manipulation code.
• Some man page cleanups.
• add -t option to disklabel(8).
• Fix a mget prompting error in ftp(1).
• Update to ncurses 4.1.
• Work around stupid linux emulation behaviour involving non-blocking connect(2).
• Massive performance optimization of the ccd device (RAID-like striping disk driver).
• Fix arp(8) ethernet address parsing for the illegal cases.
• Fix -amin option in find(1).
• Moving towards KTH kerberos 4-0.9.7.
• Fix /etc/rc scripts to require IPF if NAT is requested.
• Add asprintf(3) and vasprintf(3).
• Add hosts.equiv(3) and .rhosts(3) man page.
• Import perl 5.004_04.
• Add some more XPG4.2 *_t types.
• Fix SunOS emulation of TIOCGPGRP.
• Newer ncr device driver.
• On the i386, handle the nasty problem with distinguishing SVR4 and Linux binaries. A patch is available for 2.2.
• Update to ncurses-4.1-971129
• Fix a deadlock on cd9660.
• Fix an overflow in top(1).
• Prevent ipf/ipnnat configuration changes when securelevel > 1.
• Fix scsi CDIOCREADSUBCHANNEL.
• Indicate connect direction for tcp sockets in fstat(1).
• In linux compat, handle the CDROM ioctl() calls.
• Flesh out scsi(8) a tiny bit more.
• Use cp -R instead of cp -r for local copies in rcp(1).
• Enhance the performance of pwd_mkdb(8) by expanding the db(3) cache based on input filesize.
• Add a kern.nosuidcoredump sysctl.
• Fix minor numbers for /dev/ch* in the MAKEDEV scripts.
• A workaround for the Intel P5 F00F lockup problem. A patch is available for 2.2.
• Fix numerous problems with new KTH kerberos.
• Fix a problem in -current regarding open() of O_TRUNC and O_SHLOCK.
• Correct an XPG violation in stdlib.h.
• Handle the cdrom ejecting ioctl in linux emulation.
• Handle SIOCGIFHWADDR ioctl in linux emulation.
• Use recursive vnode locks to solve a page-in panic reported by chuck & chuck.
• Handle nanosleep() in linux emulation.
• Handle SIOCGIFMETRIC and SIOCGIFMTU in linux emulation.
• Handle the controlling tty ioctl in linux emulation.
• Repair a number of retry operation problems in the wdc driver that mostly affected sleeping laptops.
• Fixed a panic problem in the i386 apm driver. A patch is available for 2.2.
• Enable new FreeBSD ppp(8) daemon. There are now two ppp daemons in the source tree, they have quite different feature sets.
• Do not clear the setuid/setgid file mode bits for a call to {,f,l}chmod(-1, -1).
• Due to timing constraints, mac68k X11 binaries did not make it onto the 2.2 CDROM. But it is now available for ftp.
• Addition of Obtuse smtpd(8) and smtpfwd(8) v2.0.
• In ftpd, default to RFC non-conforming behaviour for the PORT command, but provide a runtime switch for those who like holes.
• Make route(8) non-setuid.
• Honour TMPDIR in the locate(8) tools.
• Update the pkg_* tools a bit.
• Support IP_HDRINCL in Linux emulation.
• Fix a kernel bug related to "route change ...".
• Fix MAKEDEV script regarding /dev/fd/* for some architectures.
• In numerous programs, avoid fd_set overflows.
• Fix Linux accept/recvmsg if kernel is compiled with other compat options.
• Implement fcntl() of F_FREESP in SVR4 emulation. Does this belong in ibcs2 also?
• Provide workaround for the Cyrix 6x86 COMA bug. (A workaround for 2.2 is not available).
• Change ftp(1) so that tries to use passive mode, and falls back to active mode. Provide environment variables to fall back. This is incredibly cool.
• Fail better for over-long usernames.
• Check the values of the ftp PORT command even more carefully.
• Fix a bug in make(1) regarding SYSV style : substitution on null variables.
• Support fcntl() GETLK,SETLK,UNLK variants in SunOS emulation.
• If mountd(8) discovers getfh(2) not supported, it now aborts nicely.
• The new KTH KerberosIV integration (and security audit) is almost complete.
• IBCS2 emulation also requires fcntl() F_FREESP support.
• Handle DST changeovers automatically in cron.
• lockf() implimentation.
• Correct exit code of nohup(1).
• Swap quit and exit commands in fdisk.
• Add sysctl ddb.panic_ddb; indicates whether to drop into ddb on a panic.
• Correct an splx botch in the tunnel driver.
• Fix some gzip buf oflows.
• Make mmap() return void * instead of caddr_t, and add the MAP_FAILED define required by new standards.
• Make {f,}chflags(.., -1) return error EINVAL.
• Make md5(1), rmd160(1), and sha1(1) use getopt().
• Some slight changes to the PCI device subsystem to make it probe devices nicer (mostly dmesg printing).
• Some more manpage cleanups.
• Workaround a problem that happens if a TCP socket is shutdown(2)'d more than once.
• Some fixes to fdisk(8) and disklabel(8).
• Add sysctl net.inet.icmp.bmcastecho to block the smurf problem.
• Make sure it is clear that so_linger is in seconds.
• New rc.conf(7) manpage.
• Fix some problems regaring transfer of secure yp maps.
• Permit extra / terminators in some path-based system calls.
• Do not permit dumping corefiles over symbolic links. (We have wanted this changed for a long time, but it required Lite2 vfs).
• Fix a output error in finger(1).
• Fix a vnode creation race.
• For scsi tape drives, be silent in the presence of ILI errors.
• Support for FAT32 partitions.
• Support all kinds of keyboards in pcvt, like pccons does.
• In disklabel(8), make IDE drive type handling more obvious and intuitive.
• Bring gethostent() back to life, even though it is a bad interface.
• Merge some slight standardization fixes for *printf(3) from FreeBSD (some unlikely cases get handled better).
• sudo version 1.5.4.
• Make pkg_install(1) feed a -p option to tar.
• In w(1), handle processes that set argv[0] to NULL, by printing p_pcomm.
• ncurses 4.1-980103
• Handle unparseable ulimit specifications as an error, not as the value 0.
• pppd 2.3.3
• Support -h host flag to ypwhich(1).
• Use new ypwhich(1) flag in ypinit(8) script to get maps from the real master server.
• Import of tzcode1998b and tzdata1998b.
• Properly ignore whitespace between a conversion and %n in *scanf(3).
• Groff 1.11a
• Properly error out if yp_match() or yp_first() is asked to lookup long keys.
• Start at bus_dma support.
• Much more complete KerberosIV documentation.
• Repaired the expansion of the kernel panic string.
• If tar(1) extracts as root, preserve uid/gid as is traditional.
• Fix argument handling in expand(1).
• In termcap databases, map the keyboard backspace key to DEL instead of BS as that is how it really is.
• Fix select(2) use in sudo(8) so that it can handle large fd_set sizes.
• More cdrom ioctl's in Linux emulation.
• Fix a race in mkdir(1).
• IPF 3.2.3. When you upgrade to this version, you must also upgrade the userland utilities (ipf, ipnat, etc.). You also need to get the latest MAKEDEV and run "sh MAKEDEV ipl" in /dev to create new device entries.
• On binutils platforms, make ldd(1) work on static executables.
• Add -a flag to which(1).
• Check both old and new shells in rpc.yppasswdd(8).
• Cleanups in wump(6).
• Glob extensions for XPG4.
• Require commands started from in /etc/rc to be executable -- not just readable.
• In rc.local, bail on starting cfsd(8) if mountd(8) is not running.
• Self-extending kernel maps in the vm subsystem.
• Low-memory bug fix in setenv(3).
• Some man page fixes so that man -k is happier.
• Workaround a race condition in syslogd's handling of SIGHUP.
• Teach the kernel about newer PCI device types.
• Be more careful about sourcerouted packets, including never forwarding them. This is a security problem in OpenBSD 2.2, and is described and fixed with a patch.
• Two bugs existed in the the 2.2 pmax release which all users should be aware of. Patches are now available.
• Fix the __{CTOR,DTOR}_LIST__ declarations in c++rt0.c
• Avoid DNS lookup timing effects in ping -R.
• Buffer overflow fix in the MIPS ld.so. Replacement binaries for the pmax and arc platforms are available.
• Add strptime(3).
• Add scan_ffs(8), a very useful tool for reconstructing disks.
• Create two new sysctl options: ddb.panic decides whether the kernel should enter ddb when it panics, and ddb.console controls if it is possible to enter ddb from the console via a hot-key.
• Fix a free page count bug in the vm system.
• Add /etc/sysctl.conf which specifies sysctl variables to change at boottime.
• Add FS_CCD partition type so that the ccd driver can ensure it has the right components.
• In the 2.2 release, the sparc scsi driver caused problems for the Sun 4/300 machines. Patches are now available.
• Fix /etc/yp/domainname support in ypbind(8).
• Fix some bugs in vacation(1).
• Emulate that disgusting linux connect() braindamage even better.
• smtpd(8) integration spiffied up. Everything you need is now in the system.
• A start at full lint library support.
• Fix rarpd(8) to work properly in the presence of massive routing traffic.
• New compat_ibcs2(8) manpage.
• The web pages now have a new section on security advisories.
• Make MIPS ldconfig emulate the -m flag better.
• Permit restore(8) to work on a filesystem that has a basic blocksize smaller than the blocksize of the filesystem that was dumped.
• New -a logdev argument for syslogd(8), useful for setting up additional /dev/log devices in various chroot spaces.
• raise IPPORT_USERRESERVED significantly. Random port numbers will now look much more random than they did before.
• Make ruserok() significantly more paranoid when parsing the .rhosts file. This along with another issue is a security problem in OpenBSD 2.2, and is described and fixed with a patch.
• In compress(1), if the st_flags is 0, do not attempt a chflags(2) call.
• Make stty(1) recognize STRIPDISC.
• Fix a map corruption bug in ypxfr(8).
• In the sparc 2.2 release, the SS4/SS5 kernel was not very reliable. A simple reliability patch is now available.
• Place seperate so_ruid and so_euid fields in struct socket, so that in_pcb.c can still do it's job, but also so that identd(8) can be fast and return the proper uid.
• If link0 is set on a loopback interface (ie. lo1) make the address/netmask sets on it make supernets instead of subnets.
• Various fixes to some of the games, ie. rain, worms, wump.
• Fixed "%c" in strftime(3).
• Support the WINBOND pci ethernet cards.
• Make lpd(8) use keepalives so that it can detect dead network printers.
• The mac68k 2.2 CD release had a few problems. These problems have been resolved in the FTP release. For more details...
• Fix another signal handler bug in mail(1).
• New quirk for another Archive VIPER scsi tape drive.
• Support -[width] option in fmt(1).
• Add XPG4 -r option to du(1).
• New fancy OpenBSD logo for your use.
• Change chflags(2) and fchflags(2) to take a u_int for the second parameter.
• Fix two bugs in adduser(8).
• Pull in all the NetBSD changes to the old version of gas over the last year or so.
• Remove the ftp(1) `stdout redirection' hack and replace it with a -o filename option (which also understands a filename of "-" to mean stdout).
• On the i386, move XFree86 aperature driver into the kernel. The new sysctl(8) variable machdep.allowaperture decides if this driver is active or not. (This variable can only be modified at high securelevel).
• Add kerberos kauthd(8).
• Rename /etc/nat.rules to /etc/ipnat.rules.
• Do not permit a read+write mmap() operation on a read-only file descriptor open on a device. This is a security problem in OpenBSD 2.2, and is described and fixed with a patch.
• Make the kernel compile properly (with full warnings) under gcc 2.8.
• For OLF/ELF binaries, remember the OS tag in execve(), so that emulation code can reference it later.
• CVS version 1.9.24
• Support -rpath dir, -shared, -soname, --whole-archive, and --no-whole-archive in the old ld used on many of our platforms.
• Some more repair in the games.
• Do not copy from off the end of an nfs boot mbuf.
• Support for the ST16650 32-byte FIFO uart.
• Add -p option to uname(1), to display detailed CPU information.
• In mail.local(8), document how to use quotas on a mail spool.
• Convert the xdr(3) and rpc(3) manpages to mandoc format.
• Permit the disabling of skey system-wide.
• Do not let a user set their password to "s/key".
• Do not permit TCP connections to any of the broadcast addresses.
• Clarify crypt(3) manpage as to how many characters each transform actually considers in its calculation.
• In the RPC code, ensure that __svc_fdsetsize is always manipulated as a bitcount.
• Add a clarifying statement to all the Kerberos code that explains how it came to be that this code was released from the USA's crypto stranglehold.
• Add a command to ddb that reports out the extent tables.
• The 3rd revision of the patch for the mmap() security problem is available, and has been placed on top of the 2nd revision.
• Fix some bugs in the 3c[59]xx device driver.
• Make netstat -r report better information about non-standard netmasks.
• In libpcap and tcpdump, use our system ethers(5) parsing routines.
• Fix a configuration file parsing bug in ipf(8).
• In old gas, move to late resolution of symbols because gcc 2.8 will require this.
• Add XDM-AUTHORIZATION to X11.
• Inside the kernel, change struct file's members f_count and f_msgcount to longs, and then add checking for overflows as well.
• Handle unknown hostnames in mountd(8) better.
• Improve blowfish performance by a factor of 2, and hence increase the rounds by 1 in passwd.conf.
• Remove one of the two copies of math.h in the source tree.
• Correct behaviour -x and -p flags in tar(1) to be traditional.
• Make ping(8) work with very large packet sizes on all types of interfaces.
• Upgrade to libg++ 2.8.0
• Upgrade to gcc 2.8.0
• Fix a few more mktemp(3) problems in f77 libraries, and other assorted GNU software.
• Fix a race bug in mkstemp(3) itself that would make mkstemp(3) have occasionally fail strangely.
• New photurisd(8) that complies with draft-simpson-photuris-18.txt.
• Add support for TIOCM* family of ioctl(2) values to the sparc serial driver.
• Fix syslog(3) sockaddr initialization.
• Spend almost a week finding and fixing minor goobers discovered by gcc 2.8 throughout the source tree.
• Use a p_os field to sub-divide operating system emulation capabilities (like for SVR4 binaries).
• Add another missing ntohl() in ipnat(8).
• XFree86 3.3.2 is now in our X11 source tree.
• Add many new machine-dependent man4 man pages.
• Improve IPSEC performance.
• Rename 2.2 to 2.3 tree-wide, for the upcoming release.
• Upgrade to gcc 2.8.1
• Significant efforts made at fleshing out the device driver man page tree better.
• Fix passwd(1) so that YP passwords do not get edited in the local password file.
• On the sparc, print hotfix information at the right place in the dmesg log.
• On the sparc, support 128KB lebuffer devices.
• Fix KerberosIV password changing.
• Change the configuration of man(1) so that man4 is read much later; this makes it easier to see pages in man8 with similar names.
• Add support for -s section and -S subsection to man(1).
• Add -s and -c options to last(1).
• Fix a crash case in compress(1).
• Fix vnd and ccd drivers to work properly with soft updates.
• Fix tmpfile(3) to fchown() the file after unlink() (taking umask() into consideration, too). This is required by standards.
• Add support for 82553 and 82555B PHY in the fxp driver.
• Add lynx 2.8 to the system.
• Configure cc(1) to pass the -R flag on to ld(1).
• Fix an interaction bug in inetd(8) due to SIGPIPE blocking; caused a bad effect in rlogind(8) or other inetd(8) children.
• Fix mktemp(3) problems in two more YP tools.
• CVS version 1.9.26
• Fixes to a few more games.
• Fully working KerberosIV encryption in telnet(1) and telnetd(8).
• Flesh out the man pages and explain the security problems behind mktemp(3) and other similar functions, plus explain how to handle these problems better.
• Merge Kirk McKusick's soft update code. This code is still experimental and under a non-commercial license. It will be included in the next release as an optional compile flag; we cannot ship it enabled by default.
• Fix %m, %I, %S, %y, %C, and %j conversions in strptime(3).
• Fix a NULL deference bug in make(1) when using the -j flag.
• In strptime(3), make %C influence %y regardless of ordering.
• Add options(4). This manpage describes what all the kernel options do. If you spot an error in it, notify us immediately.
• In get*ent() family of routines in libc, use fgetln(3) instead of fgets(3) so that parsing of overly long lines is more correct.
• Fix support for VFS loadable kernel modules.
• Make the functions described in ethers(3) more careful.
• Add support for atalk to ifconfig(8).
• Make %Y override an earlier %y in strptime(3).
• Add support for more PCI NE2000 cards.
• In the ksh(1) manpage, clarify the behaviour of the CDPATH variable.
• Make -R path work a well as -Rpath in cc(1).
• In telnet(1), fix connecting to IP addresses; this was recently broken by the new KTH kerberos telnet integration.
• In mktemp(1), document why this should be used for temporary filename generation.
• Add (complete?) support for KerberosIV to our X11R6.
• Change SIOCGIFNETMASK, SIOCGIFDSTADDR, and SIOCGIFBRDADDR to return information for named/addressed mappings rather than simply named mappings, so that these calls can work on interface aliases.
• Add ISAPNP driver for the 3c509 cards.
• On the sparc, switch to an alternate font if the console is < 800*600 resolution.
• Fix ch(4) operation on ncr(4) scsi controllers.
• Add UID_MAX and GID_MAX to on each architecture.
• Make edquota(8) handle numeric names as uid's only after checking that an account named so does not exist.
• Remove libtelnet.so.* from the distribution. People compiling kerberos into their system were generating significantly different shared libraries; thus it is wrong to make this a shared library.
• Fix rarpd(8) interaction with routed(8); too much routing information would pile up un-read on the AF_ROUTE socket and rarpd(8) would get too grumpy.
• Emulate SunOS otimes(2) system call so that Netscape doesn't explode.
• Fix rmd160(3) (and also the IPSEC algorithm) to properly handle data beyond it's block boundary.
• Support QLogic PCI scsi controllers (at least on the i386).
• Import xpm into our X11 source tree.
• Add httpd(8) to the OpenBSD tree. It is apache 1.2.6.
• Add a SIOCGIFDATA ifreq-style ioctl which will get the ifdata informational structure attached to each interface.
• Import kx into our X11 source tree.
• In utimes(2) and futimes(2), handle tv_sec values of -1 more carefully, as they are really illegal cases.
• In ftp(1), for HTTP requests pass the hostname so that virtual hosts work.
• In login(1), handle cleanup of environment variables correctly.
• Add AFS token fetching capability to various parts of the source tree.
• Fix ru_majflt counting in the VM system.
• Add xlockmore(1) to the X11 tree.
• Add disklabel spoofing to the hp300 port.
• Significantly improve the system install scripts.
• Switch a.out ports in the tree (sparc, m68k, i386) to use the newer version of gdb that is part of the binutils tree.
• Fixes for various (minor) Y2K problems.
• In the le ethernet driver, if the detected ethernet address is ff:ff:ff:ff:ff ... fail.
• Fix DNS fake-iquery bug.
• Do not prepend /usr/local/bin to the PATH in zdiff(1), zforce(1), zgrep(1), zmore(1), znew(1), or rcsfreeze(1).
• sudo version 1.5.5
• In tar(1), only preserve the uid/gid if the -p flag is given.
• Fix bug oflow in ping(8) -R option.
• Remove KTH Kerberos "eavesdropping" message from telnet(1) and telnetd(8).
• Modify i386 PS/2 driver to be read/write; this permits new XFree86 source to put mice into advanced modes of operation.
• Support 3c905B.
• Fix backtraces in gdb on m68k platforms.
• Disable console ddb by default. sysctl can re-enable it.
• mkisofs 1.11.2
• Add support for the XR16850 serial chip (128 byte fifos).
• Fix a race condition in unmount(2).
• Repair the pkg_add(1) sufficiently for the 2.3 release...
• Fix 'u'ndo support in disklabel(8)'s -E mode, and also add a new 'r' command.
• Configure xdm(8) and the fwvm window manager sensibly enough for default users to not feel utterly lost.
• Fix ipsec encap notifies.
• When root logs in for the first time, let him find that he has an interesting piece of mail about how the system works.
• Make install procedure prompt & set the initial root password.
• For the i386, have the install procedure ask if the xf86 driver should be enabled by default.
• Make disklabel(8) mentions IDE (which is an alias for ESDI).
• Fix /etc/fbtab handling in init(8).
• Various other install script fixes.
• In mktemp(3), repair a bug in the filename incrementing loop.
• In disklabel(8)'s -E mode, set the bootblock sizes so that the hp300 install does not freak out.
• Fix installboot(8) on the sparc Sun4 models.
• Support lots of file descriptors in named(8), for when many virtual interfaces exist.
• On the i386, fix installboot(8) so it works reliably on various filesystem layouts that did not work before.
• A security problem due to a buffer overflow exists in uucpd(8) (which is not enabled by default in our releases). A patch exists.
• A security problem due to buffer mismanagement exists in lprm(1). A patch exists.

• Ignore SIGPIPE in reboot(8).
• Do not do gethostbyname(3) on "*" in pppd(8).
• Set d_bbsize and d_sbsize to defaults in the disk drivers.
• Make last(1) report on the year.
• Improve numerous manpages.
• Change tset(1) and /root/.cshrc behaviour so that ^C at the prompt does not result in noglob remaining set.
• Add dev command to cdio(1) so that user can change device.
• Use mkdtemp(3) in pkg_add(8) and friends.
• Fix relative tags in vi(1).
• Fix gcc on the m68k to correctly invalidate cached condition codes when only a-registers are involved.
• Add /var/run/rarpd.pid and syslogging support to rarpd(8).
• Handle truncated reads in dumpfs(8).
• Let fdisk(8) and disklabel(8) compile if NOMAN= is defined.
• Change 3rd parameter to be size_t as required by XPG.
• Make strptime(3) handling of month and weekday names case insensitive.
• Fix the i386 versions of libm's scalb*() functions.
• Run rc.shutdown even if -h or -r was not specified.
• Completely rewritten fmt(1) with more features.
• Make hp300 use new m68k kcore format.
• Fix a very strange bug in backgammon by using -ltermlib instead of -ltermcap.
• 64 bit cleanups to the uucp subsystem.
• Correct utimes(2) emulation in Linux compat.
• Make ps(1) look at the kernel physmem variable instead of the far uglier thing it did before this change.
• Delete old gdb; we use modern binutils everywhere now.
• Fix a coredumping problem in oldrdist(1).
• Change ld(1) to accept the first matching shared library it finds.
• Teach dump(8) that ENOSPC on remote or local media means end of tape.
• Merge OSS-like audio code into i386, sparc, amiga, and other architectures.
• Add audioctl(1) and mixerctl(1).
• Permit socketpair(2) to accept PF_LOCAL.
• In oldrdist(8), avoid attempting to create hardlinks between devices.
• talk(1) cannot distinguish the host a reply comes from. If it is suspicious, it now prints that hostname in the connection banner.
• Fix a bug in h2ph(1).
• For 3c9xx drivers, fix a bug where bpf attach caused a change to 10Mb mode.
• Make ctype macros dealing with unsigned characters properly index into their respective tables.
• Make 'y' command in sed(1) 8-bit clean.
• Fix iommu flushing on the sparc Microsparc-1 based machines.
• Our c++ compiler is called c++, not g++.
• Use inet_ntoa() in a diagnostic in rwhod(8).
• Fix a timeout bug in ping(8). (What a troublesome program it is...)
• Fix ZIP drive use on the hp300.
• msdosfs in FAT32 mode would hang during a write.
• Permit relative adjustments in mixerctl(1) using +/- prefixes.
• xterm(1) and libXaw contain security issues due to buffer mismanagement. A patch exists which solves the problem .
• In mail(1), do not attempt to remove a mail spool since directory write permission may not exist. Instead, simply truncate it.