OpenBSD
-current Changelog
This selection is intended to include all important
and all user-visible changes.
For a complete record of all changes, please see the "source-changes"
mailing list, called "OpenBSD CVS"
in the archives,
or use CVS.
For changes in other releases, click below:
2.0,
2.1,
2.2,
2.3,
2.4,
2.5,
2.6,
2.7,
2.8,
2.9,
3.0,
3.1,
3.2,
3.3,
3.4,
3.5,
3.6,
3.7,
3.8,
3.9,
4.0,
4.1,
4.2,
4.3,
4.4,
4.5,
4.6,
4.7,
4.8,
4.9,
5.0,
5.1,
5.2,
5.3,
5.4,
5.5,
5.6,
5.7,
5.8,
5.9,
6.0,
6.1,
6.2,
6.3,
6.4,
6.5,
6.6,
6.7,
6.8,
6.9,
7.0,
7.1,
7.2,
7.3,
7.4,
7.5,
7.6.
Changes made between OpenBSD 7.5 and -current
- Moved to openssh-9.8.
- Retired dhclient(8). dchpleased(8) now handles IPv4 DHCP lease acquisition.
- Added rge(4) support for the Realtek RTL8126 chip.
- Disabled unwind(8) shared cache between resolvers to prevent segfault after libunbound update.
- Pushed socket re-lock to the vnode(9) release path within unp_detach().
- Implemented RSA key exchange in constant time.
- Implemented sleep button and EC events as wakeup events in acpi(4).
- Added tmux(1) "refresh-client -r" for control mode clients to provide OSC 10 and 11 responses to tmux so they can set the default foreground and background colors.
- Made acpibat(4) forward AC change notifications to acpiac(4), giving access to programs like apm(8).
- Added AMD SEV-related information provided by cpuid to dmesg(8).
- Add support for ACPI firmware that provides the base address of individual GIC redistributors in the per-CPU GIC MADT table entries.
- Added RK3588 support to rkusbphy(4).
- Enabled EPAN when available on arm64.
- Allowed the EFI devicetree fixup protocol to specify the amount of space needed.
- Stopped sending ICMP redirect when IP forwarding is IPsec-only.
- Protected global vm and vcpu state in vmd(8) with mutex.
- Enabled uvm percpu caches on luna88k.
- Used BUILDINFO to make sure sysupgrade(1) doesn't install an older snapshot over a newer one.
- Ensured loading a device tree using the "mach dtb" command gives firmware a chance to make modifications by using the EFI devicetree fixup protocol.
- Disabled the DSA signature algorithm by default.
- Added a "log" option to relayd.conf(5) rules.
- Made relayd(8) host handle disable/enable commands from relayctl(8) correctly in case multiple redirect instances use the same host in relayd(8) tables.
- Switched AF_ROUTE sockets to the new locking scheme.
- Ignored universal ctags extended metadata in tagaddress, making mg(1) search patterns work again.
- Made arc4random() depend on fewer subsystems by decoupling extract_entropy() from the enqueue_randomness() logic.
- Made ssh-keyscan(1) host/banner comments go to stderr instead of stdout and added a -q flag to silence them.
- Updated unbound to 1.20.0.
- Enabled uvm percpu caches on sparc64.
- Split ssh PerSourcePenalties address tracking to use separate tables and optionally different overflow policies, preventing misbehavior from IPv6 addresses from affecting IPv4 connections.
- Added support for the AMD Platform Security Processor (PSP) to ccp(4).
- Added RK3588 support to rktemp(4).
- Avoided powering down PCI devices when rebooting (satisfying some machines).
- Enabled UVM percpu cache on riscv64.
- Clamped CPU clock frequencies to [min,max] range when determining the initial perflevel for arm, arm64 and riscv64.
- Added RK3588 TSADC clocks and resets to rkclock(4).
- Enabled TCP Large Receive Offload in vio(4) and introduced the guest offload feature to turn LRO off/on.
- Allowed multiple EKU OIDs for BGPsec certs in rpki-client(8).
- Fixed a bug in rpki-client(8) for BGPsec Router certs where key usage was ignored.
- Introduced IFCAP_VLAN_HWOFFLOAD for vio(4) to signal handware can handle checksum or TSO offloading with inline VLAN tags.
- Introduced a new smtpd(8) K_AUTH service to allow offloading the credentials to a table for non-crypt(3) authentication.
- Included BUILDINFO file in the iso/img files and installed it in the miniroot if available.
- Made security(8) silently ignore setuid changes in relinked binaries to reduce false positives.
- Improved rpki-client(8) x509_get_purpose() to recognize TA and EE certs in addition to differentiating between CA and BGPsec Router certs.
- Stopped sysupgrade(8) from enforcing the next version key if installing a snapshot.
- Ensured the deepest possible C-state is selected during suspend-to-idle on amd64 and i386.
- Enabled TCP Large Receive Offload in vmx(4).
- Reworked rpki-client(8) trust anchor handling to prevent replay attacks where a man in the middle could supply valid TA certificates with outdated internet number resources.
- Enabled PerSourcePenalties by default in sshd(8).
- Added ssh(1) ability to penalize problematic client behavior with penalties of increasing duration against the client'by enabling sshd_config(5) option PerSourcePenalties. PerSourcePenaltyExemptList can be used to specify certain address ranges to exempt from penalties.
- Added support for VLAN tag offloading to dwqe(4).
- Enabled -fret-clean on amd64 for libc, libcrypto, ld.so, kernel, and all the ssh tools.
- Added hibernation support for ufshci(4).
- Enabled hibernate/resume to nvme(4) disks with 4096 byte sectors.
- Ensured concurrent calls to dequeue_randomness() will use some different events.
- Added -fret-clean option (amd64 and i386 only at first) to the compiler, defaulting to off. This causes the caller to clean the return address off the stack after a callq completes.
- Changed pledge, MAP_STACK and pinsyscall failures to use uprintf(9) rather than writing into dmesg(8).
- Introduced dhcp6leased(8), a daemon to manage IPv6 prefix delegations.
- Updated to xorgproto 2024.1.
- Fixed sndiod(8) server.device entries disappearing when usb devices are unplugged while in use.
- Made rad(8) honor prefixes delegated by DHCPv6.
- Added a warning when the deprecated sshd(8) -r option is passed.
- Ensured pmap_create() waits in the case of kernel virtual space shortage.
- Fixed WEP on athn(4) USB hostap, preventing potential "key not installed for sw crypto" panic.
- Added an implementation of "suspend-to-idle" on amd64, enabling suspend on machines that don't support S3.
- Converted SCHED_LOCK from a recursive kernel lock to a mutex.
- Reworked the pmap ASID handling to not require the SCHED_LOCK.
- Added a reset attempt for qwx(4) devices when firmware crashes.
- Made qwx(4) offload TKIP and CCMP crypto to hardware, fixing ARP and IPv6 multicast with WPA2.
- Fixed suspend/resume for ums(4) and umt(4).
- Prevented rkpmic4 power down after resume initiated by pressing the power button.
- Added rkpmic(4) support for configuring sleep voltage settings based on device tree settings for the RK809.
- Implemented wakeup interrupts on amd64.
- Added "N" to search backwards in tmux(1) tree modes.
- Added support for NVMe passthrough commands to allow software to get information about nvme(4) disks.
- Added ufshci(4) support for suspend/resume.
- Fixed pfsync(4) TCP-state not being updated for destination connection peer and reduced excessive pfsync traffic.
- Enabled UFS "Auto-Hibernation" in ufshci(4).
- Added support for Quectel EM060K to umb(4).
- Added mwx(4) support for MT7922.
- Fixed in-place decryption for EVP_chacha20_poly1305(), fixing hangs during the QUIC handshake with HAProxy using TLS_CHACHA20_POLY1305_SHA256.
- Mapped MSI-X in addition to MSI and INTx on rge(4).
- Switched AF_KEY sockets to the new locking scheme.
- Used pathconfat(2) to compare mtimes for the pax(1) -u and -Z options when the target is "too old."
- Turned sblock() to sb_lock rwlock(9) wrapper for all sockets. With this unification, sblock() should always be taken before solock() in all involved paths.
- Added pathconfat(2): pathconf(2) but with at-fd and flags arguments, the latter supporting the ability to get timestamp resolution of symlinks.
- Made rad(8) send source link-layer address option in router advertisements, preventing Apple devices from installing an unusable default route.
- Fixed signal handling and locking in vio(4) sysctl path.
- Created a new style relink-kit for sshd-sesion(8).
- Fixed IPsec in use with IP forwarding 2 logic.
- Added CH9102 support to uchcom(4).
- Updated to perl-5.38.2.
- Ensured giving UTF-8 command line arguments to apropos(1) allows searching in UTF-8 and ISO-Latin-1 encoded manual pages if the mandoc.db(5) was built makewhatis -T utf8.
- Ignored button events for the first ten seconds after resume to prevent some ACPI implementations from initiating a power down.
- Updated libpciaccess to 0.18.1.
- Added bio(4) support to nvme(4).
- Implemented hardware masking for MSI and MSI-X on amd64.
- Added support for using the power button function of the RK809 to rkpmic(4).
- Made installboot(8) run again after fw_update(8) on Apple silicon to pick up Apple boot firmware.
- Used %b to format amd64 cpu flag info in dmesg(8) to include raw values and streamlined display of flag information.
- Fixed a problem in pax(1) where the file list output was fully-buffered when used as part of a pipeline.
- Unlocked sigsuspend(2) and __thrsigdivert syscalls.
- Enabled ufshci(4) on amd64.
- Added missing error checks to all calls under libexec and sbin in case of ctime(3) and ctime_r(3) failures when timestamps are far off.
- Suppressed cache-info dmesg(8) lines when they are identical to the previous CPU (amd64).
- Forced MSS of TSO packets in hardware supported range in ixl(4).
- Fixed iwx(4) monitor mode after firmware update.
- Prevented firmware panic when iwx(4) runs in monitor mode with addresses configured on the interface and leaving 11n/11ac mode directly for monitor mode.
- Added smtpd-tables(7), an API to implement table(5) for smtpd(8).
- Added support for Tx checksum offloading to dwqe(4).
- Exposed igc(4) hardware counters to kstat(1).
- Updated awk(1) to the May 4, 2024 version.
- Added TSO capabilities to igc(4).
- Pushed solock() down to sosend() and removed it from soreceive() paths for unix(4) sockets.
- Fixed qwx(4) display in ifconfig(8) showing a mix of 802.11 modes after switching APs.
- Made witness(4) display lock cycles longer than two locks.
- Made "show witness" display witness(4) lock subtypes.
- Added support for Rx checksum offloading to dwqe(4).
- Made sndiod(8) discover new devices on SIGHUP and switch if a new device is higher priority (greater -F option number) than the current device.
- Aligned CRL and CSR version printing with certs.
- Fixed smtpd(8) IPv6 address parsing in file-backed table(5).
- Added vmctl(8) "status -r" to limit the output of "vmctl status" to only running VMs.
- Added per-CPU caches to the pmemrange allocator.
- Pushed solock() down to sosend() for SOCK_RAW sockets.
- Fixed sftp-server(8) home-directory extension implementation.
- Enabled em(4) on powerpc64.
- Dropped the vmm(4) and vmd(8) "continue" flag to simplify running a vcpu.
- Allowed writing buffers larger than BUFSIZ or st_blksize, vastly improving write performance.
- Updated libxkbfile to 1.1.3.
- Updated libXvMC to 1.0.14.
- Updated libfontenc to 1.1.8.
- Updated util-macros to 1.20.1.
- Updated makedepend to 1.0.9.
- Updated gccmakedep to 1.0.4.
- Updated font-util to 1.4.1.
- Updated encodings to 1.1.0.
- Updated xorg-docs to 1.7.3.
- Updated xsm to 1.0.6.
- Updated xrefresh to 1.1.0.
- Updated xprop to 1.2.7.
- Updated xpr to 1.2.0.
- Updated xmore to 1.0.4.
- Updated xmessage to 1.0.7.
- Updated xlsfonts to 1.0.8.
- Updated xload to 1.2.0.
- Updated xkbutils to 1.0.6.
- Updated xfontsel to 1.1.1.
- Updated xev to 1.2.6.
- Updated xedit to 1.2.4.
- Updated mkfontscale to 1.2.3.
- Updated xauth to 1.1.3.
- Updated listres to 1.0.6.
- Updated iceauth to 1.0.10.
- Updated editres to 1.0.9.
- Updated bitmap to 1.1.1.
- Updated xserver to 21.1.13.
- Updated awk(1) to the Apr 22, 2024 version.
- Added boot.conf(8) "machine idle [secs]" to halt at idle passphrase prompts for efi(4) systems.
- Masked off MAC management counter interrupts to prevent an interrupt storm in dwqe(4).
- Used -mno-fpu when compiling sparc64 with clang.
- Added display of the current line number as percentage of the total lines in vi(1) ruler.
- Removed bgpd(8) 'announce capabilities' as neighbor config stanza.
- Implemented RFC 4191 Default Router Preferences in rad(8).
- Made ftp(1) send Host: headers with CONNECT requests when tunneling TLS over an HTTP proxy.
- Allowed the newsyslog(8) -F flag to be used on its own.
- Added display of pf(4) fragment reassembly counters to pfctl(8) and systat(1).
- Stopped bgpd(8) from falling back to no capabilities when there is an OPEN/optional attribute error.
- Changed rpki-client(8) to require -x to enable P-256 support.
- Implemented rule 5.5 of RFC 6724 (Default Address Selection for IPv6) to prefer addresses in a prefix advertised by the next-hop.
- Mandated presence of CMS signing-time and disallowed binary-signing-time in rpki-client(8)-client8.
- Fixed ufshci(4) alignment issue where a DMA transfer scheduled on an odd slot would fail.
- Permitted null requests (aka server pings) from non-reserved ports in nfs.
- Provided crypto constant time operations for uint8_t.
- Synced RPKI Trust Anchor constraints to nro-delegated-stats.
- Set rpki-client(8) to Accept: */* HTTP header.
- Made ftp(1) send 'Accept */*' header.
- Switched tar(1) write default format to 'pax'.
- Fixed reading large pax(1) extended records.
- Added tar(1) -F option to select write format.
- Corrected detection of 'pax' format archives in pax(1) append mode.
- Updated Spleen kernel fonts to version 2.1.0.
- Fixed key share negotiation in HRR case.
- Prevented toctu issues in httpd(8) static file serving and auto index generation.
- Use route cache function in IP input.
- Made raw IPv4 and IPv6 sockets handle input in parallel.
- Switched pax(1) to write archives using the 'pax' format by default. Ramdisk versions will keep using ustar for writing.
- Added scandirat(3) from FreeBSD.
- Prevented a hang when the nvme controller has disconnected from the pcie bus.
- Removed support for the less(1) LESSOPEN and LESSCLOSE environment variables.
- Implemented support for AVX-512.
- Escaped newlines in file names in less(1).
- Protected vmm(4) activation with the vmm_softc rwlock.
- Updated nsd to 4.9.1.
- Updated unbound to 1.19.3.
- Split single TCP inpcb table into IPv4 and IPv6 parts.
- Added uchcom(4) support for the CH343 uart.
- Prevented userland change of the interface loopback flag, preventing a potential kernel crash.
- Added mcx(4) support for media types from the extended ethernet capabilities fields, fixing a gigabit SFP in the ConnectX-6 Lx.
- Made TCP debug code MP safe.
- Implemented TCP segmentation offload for vio(4).
- Fixed incorrect scaling when converting disk images in vmctl(8).
- Added tmux(1) option allow-set-title to forbid applications from changing the pane title.
- Prevented a crash if focusing a pane in tmux(1) that is exiting.
- Allowed operators to enforce the presence of certain capabilities in bgpd(8) sessions.
- Added PCI support for ufshci(4).
- Increased RTR PDU limit to 48k and limited number of SPAS to 10,000 in bgpd(8).
- Removed the armv7 "cubie" miniroot.
- Updated xserver to 21.1.12.
- Communicated cache-coherent DMA status on RISC-V via flags.
- Restricted use of direct mapping following support of RISC-V CPUs with MMUs with memory cacheability attributes.
- Prevented IP multicast sysctl(2) mrtmfc(2) from writing outside of allocation.
- Used pinsyscalls(2) to ensure libc.so is still treated as xonly with the removal of msyscall(2).
- Removed msyscall(2).
- Stopped grabbing the kernel lock in kbind(2).
- Enabled PAC in addition to BTI on arm64 such that JIT code matches the default branch protection provided by our base compiler.
- Implemented and enabled TSO in vmx(4).
- Implemented SO_ACCEPTCONN in getsockopt(2).
- Deleted the msyscall mechanism, now replaced by the stricter mimmutable+pinsyscalls.
- Updated Mesa to 23.3.6.
- Made spamd(8) advertise SMTPUTF8 and 8BITMIME extensions in EHLO, fixing potential interoperability issues when the real MTA supports those extensions.
- Fixed a crash in sndiod(8) when the device is disconnected and the clients are not migrated to another device.
- Created new-style relink kits for sshd(8) and ssh-agent(1).
- Updated libexpat to 2.6.2.
- Enforced the pinsyscalls(2) rules on non-static/ld.so/libc.so text segments.
- Added clocks for the RK3588 PWM controller to rkclock(4).
- Restricted listen(2) to sockets of type SOCK_STREAM or SOCK_SEQPACKET.
- Marked 'so_rcv' sockbuf of udp(4) sockets as SB_OWNLOCK.
- Prevented recursion inside wakeup(9) when scheduler tracepoints are enabled.
- Repaired malloc operation on systems where the malloc(3) page size is larger than the mmu page size.
- Stopped building the objective-C compiler.
- Used SBI calls to reboot or power down riscv64 machine when supported by firmware.
- Implemented Ed25519 signatures for CMS (RFC 8419).
- Fixed access to Alder Lake-N and Elkhart Lake eMMC.
- Removed pinsyscall(2) now that it has been replaced by pinsyscalls(2).
- Ensured the Milk-V Pioneer serial console is found.
- Introduced SB_OWNLOCK to mark sockets which 'so_rcv' buffer modified outside socket lock.
- Added support to have bcmpcie(4) as both PCIe bus and simplebus to enable use of the Raspberry Pi 5's RP1 I/O controller.
- Fixed a crash in ls(1) -l for files with bogus timestamp values.
- Fixed memory detection on the Milk-V Pioneer board.
- Implemented support for the RISC-V UEFI Boot Protocol.
- Implemented the chmod a-x bsd.upgrade trick in the sparc64 ofwboot bootloader.
- Rejected setting invalid versions for certs, CRLs and CSRs.
- Used 'sb_mtx' to protect 'so_rcv' buffer of unix4 sockets.
- Added error code support to libtls.
- Added VLAN_HWTAGGING capability to igc(4).
- Unlocked shutdown(2).
- Introduced rpigpio(4), a driver for the RP1 GPIO controller on the Raspberry Pi 5.
- Implemented resetting the PHY via a GPIO pin in cad(4), helping to enable the PHY on the Raspberry Pi 5.
- Removed obsolete whois(1) handle support.
- Converted libressl to use the BoringSSL style time conversions.
- Added Meinberg PCI510 to mbg(4).
- Made local ports bound during connect(2) unique per laddr rather than globally unique.
- Added patch(1) "-V none" to prevent making any backups.
- Fixed chroot(2) call in the lpd(8) control process.
- Limited NFS connections to originate from a reserved port.
- Allowed any device sample encoding in aucat(1).
- Reduced tmux(1) escape-time default to 10 milliseconds (from 500).
- Added display-menu -M to tmux(1) to always turn mouse on in a menu.
- Added AUDIO_GETDEV ioctl to "audio" pledge(2).
- Added generic channel mapping in place of aucat(1) -j and -c options.
- Reduced dmesg(8) spam by only printing about PCI resource conflicts for resources that are enabled.
- Implemented Spectre-V4 mitigations for arm64.
- Exposed aggr(4) per port information via kstat(1).
- Mitigated the RFDS (Register File Data Sampling) vulnerability present in Intel Atom CPUs (requires updated firmware).
- Made the LEDs work on the SolidRun ClearFog CN9130 Base.
- Fixed signed integer overflow in bnrand().
- Trimmed output of whois(1) to suppress some uninformative output by default, still accessible verbatim by using whois -S.
- Set ORIGINAL_RECIPIENT in the environment of MDA scripts for smtpd(8) postfix compatibility.
- Prevented potential firmware errors in Intel wifi drivers when APs send an ADDBA request early.
- Extended Spectre-BHB mitigation support to Cortex-A57.
- Cherry-picked libexpat fix for CVE-2024-28757, billion laughs attack.
- Exposed arm64 BTI support to userland.
- Enforced same-origin policy for HTTP redirects in rpki-client(8).