https://www.openbsd.org/70.html
OpenBSD 7.0
Released Oct 14, 2021. (51st OpenBSD release)
Copyright 1997-2021, Theo de Raadt.
7.0 Song: "The Style Hymn".
Artwork by Natasha Allegri.
* See the information on the FTP page for a list of mirror
machines.
* Go to the pub/OpenBSD/7.0/ directory on one of the mirror sites.
* Have a look at the 7.0 errata page for a list of bugs and
Starry workarounds.
Pointers * See a detailed log of changes between the 6.9 and 7.0 releases.
* signify(1) pubkeys for this release:
openbsd-70-base.pub: RWR3KL+gSr4QZ5mOvKhcOOgGe61ogHp5PyBOj2RrmyCpqchk9A7NVPzh
openbsd-70-fw.pub: RWS8nd7vy+I+fRHtnpxVBeX+P+9rBqJMPvSU6z8LYyAv5p73WcdFXs3B
openbsd-70-pkg.pub: RWR3iauEtA8/bLN/zfIQhOc5ramL/fARX72S6xw8BwAUebxik7KioCvL
openbsd-70-syspatch.pub: RWSD33kMDKsQH8j0Q8FzfYk+vsgTKiP8Q5DcrkQQtrZoWg48yxUQgLxU
All applicable copyrights and credits are in the src.tar.gz,
sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the files
fetched via ports.tar.gz.
---------------------------------------------------------------------
What's New
This is a partial list of new features and systems included in
OpenBSD 7.0. For a comprehensive list, see the changelog leading to
7.0.
* New/extended platforms:
+ Added new riscv64 platform for 64-bit RISC-V systems.
+ The arm64 platform support was improved with the following
changes:
o Support for Apple Silicon Macs has improved but is not
ready for general use yet:
# Added support for installing on a disk with a GPT.
# Added apldart(4) support for a DART with two sets of
registers, needed to support the Synopsis DesignWare
USB 3 controller.
# Added apldwusb(4), a glue driver for the Synopsys
DesignWare USB 3 controllers found on the Apple M1
SoC.
# Added aplns(4) to provide support for Apple NVME
storage as found in Apple M1 devices.
# Added aplpinctrl(4), a driver for the Apple GPIO
controller found on the M1 SoCs.
# Added aplpmu(4), a driver for the Apple "sera" SPMI
power management unit that contains the RTC on Apple
M1 systems.
# Added aplspmi(4), a driver for the Apple SPMI
controller.
o Enabled LEDs for the mue(4) LAN7800 chip as found on the
Raspberry Pi 3 Model B+.
o Added rktcphy(4), a driver for the Type-C PHY controller
found on the Rockchip RK3399.
o Implemented multicast support in mvpp(4).
+ Changes on other architectures:
o Switched macppc to use ld.lld(1).
o Fixed an issue preventing applications from selecting the
non-ALTIVEC code path on macppc.
o Made amd64 hw.setperf percentages proportional to the
enhanced speed step frequencies on Intel processors. The
default hw.setperf=99 corresponds to the maximum ordinary
speed, and setting it to 100 enables turbo mode.
o Enabled cy(4) on amd64.
o Disabled base-gcc on amd64.
o Prevented crashes on amd64 when TLB entries which should
have been invalidated were used.
o Prevented a kernel panic in sparc64 due to page boundary
misalignment.
o Forced luna88k to use the serial console when no graphics
board is found.
o Made additional free inodes on luna88k bsd.rd by
specifying density=4096.
o Fixed strchr() and strrchr() on mips64.
o Prevented watchdog resets on some i.MX 64-bit machines
with a recent U-Boot and watchdog enabled on boot in
imxdog(8).
o Created audio devices on armv7.
o Retired OpenBSD/sgi platform.
o Enabled MSI-X support for powerpc64.
o Fixed __ppc_lock for page faults that recursively grab
the lock on powerpc.
o Increased the maximum data size on powerpc64 to 32GB.
o Disabled global page table mappings when using PCID to
prevent crashes when not flushed from TLB on amd64.
o Added cduart(4) driver for Cadence Universal Asynchronous
Receiver/Transmitter on armv7.
o Added zqclock(4) driver for Xilinx Zynq-7000 clock
controller on armv7.
o Added zqreset(4) driver for Xilinx Zynq-7000 reset
controller on armv7.
* Various kernel improvements:
+ Unlocked the top part of the VM fault handler on i386.
+ Enabled dt(4) for GENERIC kernels on amd64, arm64, i386,
sparc64, and powerpc64.
+ Added kprobes provider for dt(4).
+ Implemented < and > operators in btrace(8) filters.
+ Added btrace(8) display of time spent in userland when
analyzing the kernel stack in the flame graph tool and fixed
a parsing bug.
+ Introduced /etc/bsd.re-config(5), which can be used to
configure the kernel using config(8), allowing use of KARL
while making changes to the GENERIC kernel.
+ Identify TPM 2.0 devices and perform the 2.0-specific suspend
command, allowing the ThinkPad X1 Carbon Gen 9 and ThinkPad
X1 Nano with the latest BIOS (which added S3) to resume.
+ Changed the printing of the hibernate image size from bytes
to megabytes.
+ Increased hibernate writeout speed.
+ Added "machine sysregs" command to ddb(4) on amd64.
+ Prevented interleaved stack traces in ddb(4) from multiple
CPUs.
+ Delayed installation of sensors until a device with battery
support is connected, allowing sensorsd(8) to pick up
hotplugged uhidpp(4) devices.
+ Prevented a kernel panic after VFS shutdown.
+ Increased the setitimer(2) timer limit to UINT_MAX seconds.
+ Serialized the internals of kqueue(2) with a mutex.
+ Enabled pool cache on knote(9) pool.
+ Fixed futex(2) errno handling to match what Mesa expects and
prevent failure to properly report timeouts.
+ Fixed a kernel crash in tty(4).
+ Increased the default buffer space on PF_UNIX sockets to 8k
and made the values tuneable via sysctl(2).
+ Made kqueue(2) timer re-addition reset an existing timer to
use the new timeout period.
+ In the build system, pass make flags to kernel and lib
builds, making hacking on ramdisks/the installer much faster.
* SMP Improvements
+ Made pmap_extract() mpsafe on hppa and amd64.
+ Introduced CPU_IS_RUNNING() and used it in scheduler-related
code to prevent waiting on non-running CPUs.
+ Made anonymous object reference counting independent from the
KERNEL_LOCK().
+ Unlocked connect(2).
+ Unlocked setrtable(2).
+ Introduced per-CPU panic(9) message buffers.
+ Used so_lock to protect key management (PF_KEY) sockets.
+ Used so_lock to protect routing (PF_ROUTE) sockets.
+ Unlocked lseek(2).
+ Unlocked the top part of the fault handler.
* Direct Rendering Manager
+ Updated drm(4) to Linux 5.10.65
+ inteldrm(4): better support for Tiger Lake
+ amdgpu(4): support for Navi 12, Navi 21 "Sienna Cichlid",
Arcturus
+ amdgpu(4): support for Cezanne "Green Sardine" Ryzen 5000 APU
* VMM/VMD improvements
+ Added a theoretical limit of 512 to the number of allocated
vcpus in vmm(4).
+ Fixed vmm(4) vcpu locking issues.
+ Added vmd(8) support for variable length vionet rx descriptor
chains.
+ Prevented stack overflow in vmd(8) due to large DHCP packets
on local interfaces.
+ Allowed locking of a randomly assigned lladdr in vmd(8).
+ Skipped inspecting non-udp packets on local interfaces for
vmd(8).
+ Prevented guest virtio drivers from causing stack and buffer
overflows in vmd(8).
+ Fixed a race condition in vmm(4) relating to incorrect
physical cpu tracking.
+ Fixed vmctl(8) client "wait" state corruption in vmd(8) when
a wait is canceled and restarted, allowing multiple waiting
clients.
+ Added protections against guests with bad virtio drivers to
vmd(8)
+ Unlocked the kernel in vmm(4) ioctl handlers and introduced
vcpu locks
* Various new userland features:
+ Imported timeout(1) utility from NetBSD. timeout(1) can be
used to run commands with a time limit.
+ Added include and exclude options to openrsync(1).
+ Implemented reporting of supplemental groups in ps(1).
+ Added indication of whether an mg(1) function is unsuitable
for a startup file.
+ Added "dired-jump" command to mg(1) to open a dired buffer
containing the current buffer's directory location.
* Various bugfixes and tweaks in userland:
+ Modified doas(1) to retry up to 3 times on password
authentication failure.
+ Made all vi(1) signal handler functions async-signal-safe.
+ Changed diff(1) to consider two files sharing the same inode
identical.
+ Allowed xenodm(1) login when ~/.Xauthority does not exist.
+ Disabled building all of the non-unicode fonts in Xenocara
except for ISO8859-1.
+ Altered passwd(1) to use stderr for printer error and
informational messages. This allows easier parsing of what
passwd(1) is doing if spawned from a GUI.
+ Fixed iostat(8) per-device values when systat(1) is in boot
time mode ('b'), not normalizing based on the sleep interval.
+ Made jot(1) -b, -c and -w mutually exclusive.
+ Made cdio(1) discard the current input line when Ctrl-C is
used during line editing and provide a fresh prompt rather
than exiting the program.
+ Let el_gets(3) honour the first Ctrl-C typed by the user
rather than ignoring it.
+ Corrected awk(1) -F null string behavior to ensure -F ''
behaves consistently with -v FS="".
+ Avoided a potential buffer overflow in backslash escaping in
awk(1).
+ Disallowed the use of an empty list between "while" and "do"
in ksh(1).
+ Changed cwm(1) maximization and full-screen mode toggling to
keep the cursor within the window, preventing focus loss.
+ Made rc(8) quietly attempt an early mount of /var/log in case
someone has created it as a separate filesystem to avoid /var
overflow issues.
+ Improved fdisk(8) to retain essential partitions on various
platforms.
+ Improved fdisk(8) for disks with 4K sectors.
+ Cleaned up the fdisk(8) MBR/GPT initialization code, making
-g independent of -i, leaving four mutually exclusive
initialization options (-i, -g, -u and -A) with the last
option specified executed (allowing the existing -i -g to
work as intended).
+ Relaxed criteria for recognizing GPT formatted media,
allowing GPT disk images added with dd(1) onto larger
physical media to be recognized by fdisk(8) and the kernel.
+ Added the ability for fdisk(8) to recognize "BIOS Boot",
"APFS", "APFS ISC", "APFS Recovry" (sic), "HiFive FSBL" and
"HiFive BBL" GPT partitions.
+ Ensured the values for fdisk(8) -b and -l are treated as
512-byte block counts.
+ Added an fdisk(8) -A option to initialize a GPT without
removing special boot partitions.
+ Made fdisk(8) -b option available to architectures other than
amd64 and i386 and extended the syntax to allow specification
of the boot partition type and offset.
+ Adjusted density for partitions on a 4k disk in newfs(8) when
fragsize and density are not passed on the command line to
ensure sufficient inodes to hold a src tree on a 2G fs.
+ Fixed disklabel(8) generation on sparc64.
+ Fixed overlap check in disklabel(1) autoalloc code.
+ Corrected various min/max cluster numbers for FAT12/16/32 in
newfs_msdos(8).
+ Added libexecinfo, a library providing backtrace functions.
+ Updated C library support for character classification to
Unicode 13.0.
+ Let wcwidth(3) treat all characters in Unicode private use
areas as single-width, even those in planes 15 and 16.
+ Limited the printf(1) \x escape sequence to two characters.
+ Corrected the output of date(1) -f %s which was wrongly
affected by the local timezone.
+ Turn printing additional information into toggles for systat
(1).
* Improved hardware support and driver bugfixes, including:
+ Added a workaround to amdgpu(4) for machines where the
framebuffer size reported by the hardware is incorrect.
+ In pchgpio(4), worked around a BIOS bug on Lenovo ThinkPads
based on Intel's Tiger Lake platform to properly restore the
GPIO pin used for the touchpad interrupt upon resume.
+ Stopped setting the highspeed bit on bcm2835-sdhci sdhc(4)
controllers, fixing bwfm(4) wifi on the Raspberry Pi 3 Model
B+.
+ Added support for obtaining sense status and source slot of a
media to chio(1) and ch(4).
+ Fixed dwiic(4) timeouts requesting data from at least one
touchpad.
+ Added ucc(4), a driver for USB HID Consumer Control
keyboards. Often used to expose volume, audio and application
launch keys. Volume keys are handled by the kernel and all
other keys are propagated to X11 and the console through
wscons(4).
+ Set the uhidpp(4) battery level sensor status to unknown
while charging to handle devices reporting zero during
charge, preventing certain sensorsd.conf(5) actions from
triggering inappropriately.
+ Added Tiger Lake LP (INT34C5) support to pchgpio(4).
+ Fixed a panic at shutdown relating to azalia(4) on the X1
Extreme Gen 1.
+ Fixed a panic reported in upd(4).
+ Fixed display of incorrect patterns on LUNA's wscons(4) with
1bpp framebuffer when backspace is typed.
+ Fixed an attachment problem for dwctwo(4) for certain devices
issuing NAK interrupts during split transactions.
+ Added AMD 17h/6xh Root Complex to ksmn(4).
+ Ensured the TX FIFO isn't overrun for longer transfers in
dwiic(4).
+ Added titmp(4), a driver for the TI TMP451 temperature
sensor.
+ Ensured a USB mouse will attach if otherwise qualified even
if the usage report does not include X and Y usages.
+ Attached unsupported video devices to uvideo(4) but not video
(1), rather than leaving it unmatched.
+ Added a -R flag to usbhidctl(1) to dump the raw report
descriptor bytes.
+ Added hid_get_report_desc_data() to usbhid(3) to access raw
report descriptor data.
+ Fixed overflows when reading multiple bytes from AML over an
i2c bus in acpi(4).
+ Fixed uaudio(4) on certain machines such as the RPI4 by
adding a pre-DMA-write barrier after data is stored to
memory.
+ Worked around x86 machines that advertise the "hardware
reduced" ACPI feature, advertise S4 and S5 support, but fail
to populate the SLEEP_CONTROL_REG and SLEEP_STATUS_REG
descriptions in the FADT. This fixed the ASUS Zenbook 14.
+ Added quirk to enable ThinkPad X1 Extreme 1 speakers and
Dolby Atmos in azalia(4).
+ Fixed pchgpio(4) issues with dead touchpads after resume.
+ Fixed an mbuf leak in xnf(4).
* New or improved network hardware support:
+ Fixed ix(4) with older amd64 and current riscv64 hardware if
MSI is not enabled for the device.
+ Added the uaq(4) driver for Aquantia AQC111U/AQC112U USB
Ethernet devices.
+ Added the aq(4) driver to support Aquantia 1/2.5/5/10Gb/s
PCIe Ethernet adapters.
+ Synced dwctwo(4) with the NetBSD-current code base, enabling
the USB on-board Ethernet controller through mue(4), fixing
uvideo(4), and enabling the two USB uhub3 ports on the
Raspberry Pi 3 Model B+.
+ Added cad(4), a driver for Cadence GEM.
+ Added Broadcom BCM5725 to brgphy(4).
+ Added support for RTL8168FP/RTL8111FP/RTL8117 to re(4).
+ Fixed ure(4) after a media link change on RTL8153/B devices.
+ Fixed bnxt(4) with a single queue in MSI-X mode.
* Added or improved wireless network drivers:
+ Zeroed out iwx(4) Tx descriptors of frames which is done to
prevent the device from writing to the former DMA address of
a buffer which has been taken off the Tx ring.
+ Fixed a bug in iwx(4) Tx done interrupt processing which
could cause fatal firmware errors under load and memory
corruption.
+ Changed iwm(4) and iwx(4) to sleep for 1 second while loading
firmware to match what iwn(4) does. This fixes some issues
with suspend/resume.
+ Ensured that iwm(4) and iwx(4) will reload firmware from disk
on down/up and not during resume.
+ Fixed iwx(4) crystal latency values to match those used by
Linux iwlwifi.
+ Fixed an off-by-one error in bwfm(4).
+ Changed iwn(4), iwm(4), and iwx(4) devices to hide detailed
firmware error reports by default.
+ Prevented a loop when bwfm(4) receives an unsolicited
association status event right after successful association.
+ Fixed a leak with wg(4) keepalive.
+ Switched iwx(4) to -63 firmware images as shipped in
iwx-firmware-20210512, including fixes addressing fragattacks
vulnerabilities.
+ Supported the new iwx(4) firmware session protection command,
required for successful associations with new firmware.
+ Stopped asking iwx(4) to send probe requests on passive
channels, fixing firmware going unresponsive after
association.
+ Fixed an iwx(4) edge case where devices failed to resume
after system suspend.
+ Switched iwm(4) to newer firmware images available in
iwm-firmware-20210512. This provides FragAttacks fixes for
the updated devices.
+ Fixed iwx(4) against access points using TKIP as the group
cipher.
+ Prevented athn(4) from calling ieee80211_find_rxnode() on bad
frames in an attempt to prevent creation of bogus node cache
entries.
+ Implemented various fixes addressing firmware errors in iwm
(4) and iwx(4).
+ Fixed node leaks in iwm(4) and iwx(4) which caused the
drivers to get stuck when roaming between access points.
+ Fixed iwx(4) firmware reloading after a failure to parse the
firmware file.
+ Avoided "mac clock not ready" panics in iwm(4) and iwx(4).
+ Worked around a problem between certain athn(4) hardware
running in HostAP mode and clients that use Tx aggregation.
+ Corrected multicast decryption for iwx(4).
+ Added 802.11n Tx aggregation support to iwm(4).
+ Made iwn(4), iwm(4) and iwx(4) keep track of beacon
parameters at run-time.
+ Implemented support for Rx aggregation offload in iwm(4) and
iwx(4) and re-enabled de-aggregation of A-MSDUs in net80211
for all drivers capable of 11n mode.
+ Changed error reporting for bwfm(4) to use the long version
of the firmware path. This makes it easier to find the
correct files to add to the bwfm-firmware port.
* IEEE 802.11 wireless stack improvements and bugfixes:
+ Drop fragmented 802.11 frames.
+ Prevent frame injection via forged 802.11n A-MSDUs.
+ Tweaked net80211 RA heuristics to avoid picking Tx rate
choices that may be too optimistic.
* Generic network stack improvements and bugfixes:
+ Implemented reception of "VLAN 0 priority tagged" packets.
+ Fixed an alignment fault observed on an octeon machine while
pppoe(4) negotiated a large MTU.
+ Display provider ID for a umb(4) SIM in ifconfig(8).
* Installer and upgrade improvements:
+ Checked the installer's /tmp/i/hostname.* files for a
configured IP address so that configurations without a
broadcast address are detected as well.
+ Handled "inet autoconf" in the ramdisk.
+ Introduced a short wait in rc(8) after netstart(8) finishes
until an IPv4 or IPv6 default route is present before
continuing boot. Fixed setups depending on working network
and DNS resolution during early boot when using
autoconfiguration (dhcpleased(8) or slaacd(8)).
+ Made fdisk(8) always create an EFI SYS partition if the -b
option is specified when initializing a GPT.
+ Allowed (w)hole disk allocation for GPT disks in arm64, using
fdisk(8) -A when an Apple APFS ISC partition is detected and
fdisk -ig otherwise. Created EFI SYS boot partitions only on
ROOTDISK GPT disks.
+ Added installboot(8) "-p" to prepare by creating a new
filesystem on the partition reserved for the bootloader on
relevant architectures.
+ Added GPT support to armv7 installboot(8).
+ Added the Spleen 12x24 and 16x32 font on amd64's RAMDISK_CD
and RAMDISK kernels.
+ Use installboot(8) on arm64 ramdisks.
+ Enable dhcpleased(8) on ramdisks, and activate resolvd(8),
replacing dhclient(8).
+ Enable slaacd(8) to configure nameservers on ramdisks.
* Security improvements:
+ Moved objcopy to base set to allow KARL to work on all
installs.
+ Added unveil(2) calls to xterm in the case where there are no
exec-formatted or exec-selected resources set.
+ Changed usage of %n from a syslog warning to syslog and abort
for printf(3) (and associated variants).
+ Made kernel stop all threads when terminating via pledge_fail
().
* Routing daemons and other userland network improvements:
+ The bgpd(8) daemon saw the following changes:
o Stop processing queued UPDATES when the max-prefix limit
was reached.
o Improved negotiation for route refresh, graceful restart
and multi-protocol capabilities
o Correctly track 'rde evaluate all' and 'export' settings
during reload.
o Properly withdraw prefixes when 'rde evaluate all' is
used.
o Fixed MRT handling on initial startup for message dump
types.
o Fixed and use non-blocking connect for RTR sessions.
o Fully implemented RFC 6286 by checking for BGP ID
collisions.
o Adjusted the 4-byte AS number handling to RFC 6793 by
changing error behaviour from prefix withdraw to
attribute discard.
o In bgpctl(8) print out both the sent "Neighbor
capabilities" and the "Negotiated capabilities" for a
session.
o Print timestamps both as a formatted and a pure time in
seconds field in various JSON objects.
o Fixed a bug, where during bgpd(8) config reloads prefixes
of the wrong address family could leak to peers resulting
in session resets.
o Added support for RFC 7313 - Enhanced Route Refresh.
Disabled by default. To enable, use 'announce enhanced
refresh yes'.
o Improved output of Adj-RIB-Out by updating nexthop and
ASPATH before adding the prefix to the RIB. This improves
`bgpctl show rib out` output.
o Added command line option to both bgpd(8) and bgpctl(8)
to show the version.
o Added support for RFC 9072 - Extended Optional Parameters
Length for BGP OPEN Message
o Added support for RFC 8050 - MRT Format with BGP
Additional Path Extensions
o Implemented receive side of RFC 7911 - Advertisement of
Multiple Paths in BGP. OpenBGPD is currently not able to
send multiple paths out.
o Improved checks of VRPs loaded via RTR or from the
roa-set table.
o Allowed optionally specifying an expiry time for roa-set
entries to mitigate BGP route decision making based on
outdated RPKI data. OpenBGPD's companion rpki-client(8)
produces roa-sets with the new 'expires' property
+ The pf(4) packet filter and its userland utility:
o Corrected a potential memory leak associated with pfsync
(4) update requests.
o Introduced locks around the global pf(4) state list.
o Fixed a panic due to pfsync(4) deferral timeout handling.
o Added support for pf(4) divert-to on tpmr(4) and veb(4).
o Fixed state key reference underflow when both state keys
are identical in pf(4).
o Only skipped pf(4) once for packets injected by a
divert-packet socket, allowing pf to still act later on a
diverted packet.
+ IPSEC support in the kernel and the iked(8) userland daemon:
o Zeroed out potential passwords when freeing memory or
handling parsing errors in iked(8).
o Added client-side support for DNS configuration to iked
(8).
o Increased iked(8) default data bytes limit for Child SAs
to 4 GB, preventing excessive rekeying and lost data in
high performance setups.
o Fixed an iked(8) bug where no flows are added if a single
address is configured in the config address instead of a
pool.
o Fixed a problem in iked(8) where no flows are loaded when
a single config address without pool is configured.
o Added an experimental post-quantum hybrid key exchange
method based on Streamlined NTRU Prime (coupled with
X25519) to iked(8) as sntrup761x25519.
o Fixed races which were slowing ipsec(4) throughput.
o Fixed ipsec(4) NAT-T to work with pipex(4).
+ rpki-client(8) received the following new features and
bugfixes:
o Added keep-alive support to the HTTP client code for
RRDP.
o Reference-count and delete unused files synced via RRDP,
as far as possible.
o In the JSON output, changed the AS Number from a string
("AS123") to an integer ("123") to make processing of the
output easier.
o Added an 'expires' column to CSV & JSON output, based on
certificate and CRL validity times. The 'expires' value
can be used to avoid route selection based on stale data
when generating VRP sets, when faced with loss of
communication between consumer and validator, or
validator and CA repository.
o Made the runtime timeout (-s option) also trigger in
child processes.
o Improved RRDP support and make RRDP the default protocol
for synchronizing the RPKI repository data, with
openrsync(1) used as secondary.
o At startup, warn if the filesystem containing the cache
directory is probably too small.
o Handle running out of disk space more gracefully,
including cleanup of temporary and old files before
exiting.
o Improved the HTTP/1.1 request headers being sent.
o Improved validation checks for ROA and MFT objects.
o Improved the HTTP client code (status code handling, http
proxy support, keep-alive).
o In RRDP, do not access URI with userinfo (@-sign)
o Improved RRDP syncing by considering a notification file
serial jumping backwards as synced repository.
o Made -R (rsync only) also apply to the fetching of TA
files.
o Only sync *.{cer,crl,gbr,mft,roa} files via rsync and
exclude all others.
o When producing output for bgpd(8), make use of the
'roa-set expires' attribute to prevent machines from
loading outdated roa-sets.
o In RRDP, limited the number of deltas to 300 per repo. If
more deltas exist, downloading a full snapshot is faster.
o Limited the validation depth of X.509 certificate chains
to 12, double the current depth seen in RPKI.
+ traceroute(8) was improved:
o Probe packets are now sent in quick succession and
responses handled asynchronously.
o DNS lookups are performed asynchronously. This speeds up
the time required to display results considerably.
+ dhcpleased(8) was made the default program for configuring
IPv4 addresses via DHCP. resolvd(8) was activated to handle
concurrent changes to resolv.conf(5) by both dhcpleased(8)
and slaacd(8).
Additionally these programs saw the following improvements
and bugfixes:
o Changed dhcpleased(8) client identifier transmission to
match other DHCP client implementations.
o Simplified dhcpleasectl(8) and added syntax to match
dhclient(8) (interface), allowing one to be aliased to
the other.
o Retried broadcast with dhcpleased(8) when the DHCP server
is unreachable via unicast UDP.
o Made resolvd(8) accept DNS proposals for the loopback
addresses.
o Added to dhcpleased.conf(5) the ability to ignore routes
or nameservers from a lease and to ignore servers
entirely.
o Made dhclient(8) defer to dhcpleased(8) when the inet
autoconf flag is set. When run, dhclient will signal
dhcpleased to request a new lease rather than requesting
one itself.
o Fixed potential races in slaacd(8) and dhcpleased(8) when
two processes are configuring the same IP.
o Added the possibility to send vendor class identifier and
client identifier using dhcpleased.conf(5).
o Made dhcpleased(8) always configure provided routes,
regardless of whether the address received in the lease
is already configured.
o Used exclusive locks under /dev/ to ensure single
instances of resolvd(8), slaacd(8) and dhcpleased(8).
o Implemented classless static routes DHCP option in
dhcpleased(8).
o Added a new "nameserver" command to route(8), sending
nameserver proposals to resolvd(8) using the DNS proposal
protocol over the route socket. This command is intended
be used to integrate userland triggered nameserver
changes, for example by VPN software.
+ Changes to snmp related tools:
o Disable SNMPv1 and SNMPv2c by default in snmpd(8).
o Remove default communities from snmpd(8).
o Switched default seclevel to enc for snmpd(8).
o Changed the default snmp(1) version to -v3 and removed
the default community.
o Switched default snmp(1) auth to hmac-sha1.
o Switched default snmp(1) and snmpd(8) privacy protocol to
AES.
o Added the ability for snmpd(8) to send SNMPv3 traps.
o Allowed "any" to be used as a listen on address in
snmpd.conf(5).
o Allowed setting of the engineid in snmpd(8).
+ Other userland network changes:
o Fixed acme-client(1) SAN generation for CSRs.
o Added pledge(2) for ftpd(8) user processes.
o Allowed router solicitations from the unspecified address
(::) in rad(8).
o Altered slowcgi(8) so it no longer sends debug logging to
syslog unless debug logging is requested via the new -v
flag.
o Prevented httpd(8) from trying to chunk encode an empty
http body coming from an fcgi upstream.
o Used relative reference URIs in Location header on
directory redirects in httpd(8), adding support for
front-ending httpd with a TLS-terminating gateway that
forwards unencrypted http traffic.
o Prevented a crash on strict alignment architectures of
tcpdump(8) WireGuard printer.
o Made tcpdump(8) split the 802.11 sequence number field
into its sequence number and fragment number components
rather than printing the whole field in decimal.
o Added simple BGP enhanced route refresh message decoding
to tcpdump(8).
* tmux(1) improvements and bug fixes:
+ Added a -B flag to tmux(1) to remove borders from popups and
added a menu to popups as well as options to convert a popup
into a pane.
+ Added pipe variants of the tmux(1) line copy commands.
+ Added basic support for zero width joiners to tmux(1).
+ Added client focus hooks to tmux(1).
+ Made window-linked and window-unlinked window options in tmux
(1).
+ Added -F for tmux(1) command-prompt and used it to fix
"Rename" on the window menu.
+ Added different tmux(1) command histories for different types
of prompts.
+ Fixed tmux(1) problems with xterm in VT340 mode.
+ Added an "always" value to the extended-keys option to always
forward those keys to applications inside tmux(1).
* OpenSMTPD 7.0.0
+ Fixed incorrect status code for expired mails resulting in a
misleading bounce report in smtpd(8).
+ Added TLS options cafile=(path), nosni, noverify and
servername=(name) to smtp(1).
+ Allowed specification of TLS ciphers and protocols in smtp(1)
.
* LibreSSL 3.4.1
+ New Features
o Added support for OpenSSL 1.1.1 TLSv1.3 APIs.
o Enabled the new X.509 validator to allow verification of
modern certificate chains.
+ Portable Improvements
o Ported continuous integration and test infrastructure to
Github actions.
o Added Universal Windows Platform (UWP) build support.
o Fixed mingw-w64 builds on newer versions with missing SSP
support.
o Added non-executable stack annotations for CMake builds.
+ API and Documentation Enhancements
o Added the following APIs from OpenSSL
BN_bn2binpad BN_bn2lebinpad BN_lebin2bn
EC_GROUP_get_curve EC_GROUP_order_bits
EC_GROUP_set_curve EC_POINT_get_affine_coordinates
EC_POINT_set_affine_coordinates
EC_POINT_set_compressed_coordinates EVP_DigestSign
EVP_DigestVerify SSL_CIPHER_find
SSL_CTX_get0_privatekey SSL_CTX_get_max_early_data
SSL_CTX_get_ssl_method SSL_CTX_set_ciphersuites
SSL_CTX_set_max_early_data
SSL_CTX_set_post_handshake_auth
SSL_SESSION_get0_cipher
SSL_SESSION_get_max_early_data
SSL_SESSION_is_resumable
SSL_SESSION_set_max_early_data
SSL_get_early_data_status SSL_get_max_early_data
SSL_read_early_data SSL_set0_rbio
SSL_set_ciphersuites SSL_set_max_early_data
SSL_set_post_handshake_auth
SSL_set_psk_use_session_callback
SSL_verify_client_post_handshake SSL_write_early_data
o Added AES-GCM constants from RFC 7714 for SRTP.
+ Compatibility Changes
o Implement flushing for TLSv1.3 handshakes behavior,
needed for Apache.
o Call the info callback on connect/accept exit in TLSv1.3,
needed for p5-Net-SSLeay.
o Default to using named curve parameter encoding from
pre-OpenSSL 1.1.0, adding OPENSSL_EC_EXPLICIT_CURVE.
o Do not ignore SSL_TLSEXT_ERR_FATAL from the ALPN
callback.
+ Testing and Proactive Security
o Added additional state machine test coverage.
o Improved integration test support with ruby/openssl
tests.
o Error codes and callback support in new X.509 validator
made compatible with p5-Net_SSLeay tests.
+ Internal Improvements
o Numerous fixes and improvements to the new X.509
validator to ensure compatible error codes and callback
support compatible with the legacy OpenSSL validator.
* OpenSSH 8.8
+ Security
o sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword.
When this option was enabled with a set of patterns that
activated logging in code that runs in the low-privilege
sandboxed sshd process, the log messages were constructed
in such a way that printf(3) format strings could
effectively be specified the low-privilege code.
o sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly
initialise supplemental groups when executing an
AuthorizedKeysCommand or AuthorizedPrincipalsCommand,
where a AuthorizedKeysCommandUser or
AuthorizedPrincipalsCommandUser directive has been set to
run the command as a different user.
+ Potentially incompatible changes
o A near-future release of OpenSSH will switch scp(1) from
using the legacy scp/rcp protocol to using SFTP by
default.
o This release disables RSA signatures using the SHA-1 hash
algorithm by default.
o scp(1): this release changes the behaviour of remote to
remote copies (e.g. "scp host-a:/path host-b:") to
transfer through the local host by default. This was
previously available via the -3 flag. This mode avoids
the need to expose credentials on the origin hop, avoids
triplicate interpretation of filenames by the shell (by
the local system, the copy origin and the destination)
and, in conjunction with the SFTP support for scp(1)
mentioned below, allows use of all authentication methods
to the remote hosts (previously, only non-interactive
methods could be used). A -R flag has been added to
select the old behaviour.
o ssh(1)/sshd(8): both the client and server are now using
a stricter configuration file parser. The new parser uses
more shell-like rules for quotes, space and escape
characters. It is also more strict in rejecting
configurations that include options lacking arguments.
Previously some options (e.g. DenyUsers) could appear on
a line with no subsequent arguments. This release will
reject such configurations. The new parser will also
reject configurations with unterminated quotes and
multiple '=' characters after the option name.
o ssh(1): when using SSHFP DNS records for host key
verification, ssh(1) will verify all matching records
instead of just those with the specific signature type
requested. This may cause host key verification problems
if stale SSHFP records of a different or legacy signature
type exist alongside other records for a particular host.
o ssh-keygen(1): when generating a FIDO key and specifying
an explicit attestation challenge (using -Ochallenge),
the challenge will now be hashed by the builtin security
key middleware. This removes the (undocumented)
requirement that challenges be exactly 32 bytes in length
and matches the expectations of libfido2.
o sshd(8): environment="..." directives in authorized_keys
files are now first-match-wins and limited to 1024
discrete environment variable names.
+ New features
o scp(1): experimental support for transfers using the SFTP
protocol as a replacement for the venerable SCP/RCP
protocol that it has traditionally used. SFTP offers more
predictable filename handling and does not require
expansion of glob(3) patterns via the shell on the remote
side.
o sftp-server(8): add a protocol extension to support
expansion of ~/ and ~user/ prefixed paths. This was added
to support these paths when used by scp(1) while in SFTP
mode.
o ssh(1): add a ForkAfterAuthentication ssh_config(5)
counterpart to the ssh(1) -f flag.
o ssh(1): add a StdinNull directive to ssh_config(5) that
allows the config file to do the same thing as -n does on
the ssh(1) command- line.
o ssh(1): add a SessionType directive to ssh_config,
allowing the configuration file to offer equivalent
control to the -N (no session) and -s (subsystem)
command-line flags.
o ssh-keygen(1): allowed signers files used by ssh-keygen
(1) signatures now support listing key validity intervals
alongside the keys, and ssh-keygen(1) can optionally
check during signature verification whether a specified
time falls inside this interval. This feature is intended
for use by git to support signing and verifying objects
using ssh keys.
o ssh-keygen(8): support printing of the full public key in
a sshsig signature via a -Oprint-pubkey flag.
o ssh(1): allow the ssh_config(5)
CanonicalizePermittedCNAMEs directive to accept a "none"
argument to specify the default behaviour.
+ Bugfixes
o ssh(1)/ sshd(8): start time-based re-keying exactly on
schedule in the client and server mainloops. Previously
the re-key timeout could expire but re-keying would not
start until a packet was sent or received, causing a spin
in select() if the connection was quiescent.
o ssh-keygen(1): avoid Y2038 problem in printing
certificate validity lifetimes. Dates past 2^31-1 seconds
since epoch were displayed incorrectly on some platforms.
o scp(1): allow spaces to appear in usernames for local to
remote and scp -3 remote to remote copies.
o ssh(1)/ sshd(8): remove references to
ChallengeResponseAuthentication in favour of
KbdInteractiveAuthentication. The former is what was in
SSHv1, the latter is what is in SSHv2 (RFC4256) and they
were treated as somewhat but not entirely equivalent. We
retain the old name as a deprecated alias so
configuration files continue to work as well as a
reference in the man page for people looking for it.
o ssh(1)/ ssh-add(1)/ ssh-keygen(1): fix decoding of X.509
subject name when extracting a key from a PKCS#11
certificate.
o ssh(1): restore blocking status on stdio fds before
close. ssh(1) needs file descriptors in non-blocking mode
to operate but it was not restoring the original state on
exit. This could cause problems with fds shared with
other programs via the shell.
o ssh(1)/ sshd(8): switch both client and server mainloops
from select(3) to pselect(3). Avoids race conditions
where a signal may arrive immediately before select(3)
and not be processed until an event fires.
o ssh(1): sessions started with ControlPersist were
incorrectly executing a shell when the -N (no shell)
option was specified.
o ssh(1): check if IPQoS or TunnelDevice are already set
before overriding. Prevents values in config files from
overriding values supplied on the command line.
o ssh(1): fix debug message when finding a private key to
match a certificate being attempted for user
authentication. Previously it would print the
certificate's path, whereas it was supposed to be showing
the private key's path.
o sshd(8): match host certificates against host public
keys, not private keys. Allows use of certificates with
private keys held in a ssh-agent.
o ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8)
, which allows RSA/SHA2 signatures for public key
authentication but fails to advertise this correctly via
SSH2_MSG_EXT_INFO. This causes clients of these server to
incorrectly match PubkeyAcceptedAlgorithms and
potentially refuse to offer valid keys.
o sftp(1)/ scp(1): degrade gracefully if a sftp-server
offers the limits@openssh.com extension but fails when
the client tries to invoke it.
o ssh(1): allow ssh_config SetEnv to override $TERM, which
is otherwise handled specially by the protocol. Useful in
~/.ssh/config to set TERM to something generic (e.g.
"xterm" instead of "xterm-256color") for destinations
that lack terminfo entries.
o sftp-server(8): the limits@openssh.com extension was
incorrectly marked as an operation that writes to the
filesystem, which made it unavailable in sftp-server
read-only mode.
o ssh(1): fix SEGV in UpdateHostkeys debug() message,
triggered when the update removed more host keys than
remained present.
o scp(1): when using the SFTP protocol, continue
transferring files after a transfer error occurs, better
matching original scp/rcp behaviour.
o ssh(1): fixed a number of memory leaks in multiplexing,
o ssh-keygen(1): avoid crash when using the -Y
find-principals command.
o A number of documentation and manual improvements.
* mandoc 1.14.6
+ Added a style message about overlong text input lines.
+ Made "-W style" check .Xr links along the full manpath to
help validation of non-base manual pages.
+ Supported auto-tagging for ".It Va" in mdoc(7) documents.
+ Stopped printing two extra blank lines at the top and bottom
of man(7) documents.
+ Supported the CB and CI fonts in roff(7) \f font escapes and
.ft font requests.
+ Added support for two-character font names (BI, CW, CR, CB,
CI) to the tbl(7) layout font modifier.
+ Implemented the tbl(7) layout modifiers "b" (bold) and "i"
(italic) in HTML output mode.
+ Completed support for the "nospaces" option in the tbl(7)
parser.
+ Fixed an infinite loop in the tbl(7) parser for some cases of
horizontally overlapping horizontal spans.
+ Added a meta viewport element to "-T html" output.
+ Fixed a crash with "-T man" when an input file contains tbl
(7) or eqn(7) input.
+ Fixed a crash in makewhatis(8) when a manpath directory
contains a symbolic link that points to a directory.
* Ports and packages:
Many pre-built packages for each architecture:
+ aarch64: 11034
+ amd64: 11325
+ arm: ...
+ i386: 10248
+ mips64: 9311
+ mips64el: ...
+ powerpc: ...
+ powerpc64: 9273
+ riscv64: 8620
+ sparc64: 9636
Some highlights:
+ Asterisk 18.6.0
+ Audacity 2.4.2
+ CMake 3.20.3
+ Chromium 93.0.4577.82
+ Emacs 27.2
+ FFmpeg 4.4
+ GCC 8.4.0 and 11.2.0
+ GHC 8.10.6
+ GNOME 40.4
+ Go 1.17
+ JDK 8u302, 11.0.12 and 16.0.2
+ KDE Applications 21.08.1
+ KDE Frameworks 5.85.0
+ Krita 4.4.8
+ LLVM/Clang 11.1.0
+ LibreOffice 7.2.1.2
+ Lua 5.1.5, 5.2.4 and 5.3.6
+ MariaDB 10.6.4
+ Mono 6.12.0.122
+ Mozilla Firefox 92.0 and ESR 91.1.0
+ Mozilla Thunderbird 91.1.1
+ Mutt 2.1.3 and NeoMutt 20210205
+ Node.js 12.22.6
+ OCaml 4.10.0
+ OpenLDAP 2.4.59
+ PHP 7.3.30, 7.4.23 and 8.0.10
+ Postfix 3.5.12
+ PostgreSQL 13.4
+ Python 2.7.18, 3.8.12 and 3.9.7
+ Qt 5.15.2 and 6.0.4
+ R 4.1.1
+ Ruby 2.6.8, 2.7.4 and 3.0.2
+ Rust 1.55.0
+ SQLite 3.35.5
+ Shotcut 21.01.29
+ Sudo 1.9.7p2
+ Suricata 6.0.2
+ Tcl/Tk 8.5.19 and 8.6.8
+ TeX Live 2020
+ Vim 8.2.3394 and Neovim 0.5.0
+ Xfce 4.16
* As usual, steady improvements in manual pages and other
documentation.
* The system includes the following major components from outside
suppliers:
+ Xenocara (based on X.Org 7.7 with xserver 1.20.13 + patches,
freetype 2.10.4, fontconfig 2.12.4, Mesa 21.1.8, xterm 367,
xkeyboard-config 2.20, fonttosfnt 1.2.2 and more)
+ LLVM/Clang 11.1.0 (+ patches)
+ GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
+ Perl 5.32.1 (+ patches)
+ NSD 4.3.7
+ Unbound 1.13.2
+ Ncurses 5.7
+ Binutils 2.17 (+ patches)
+ Gdb 6.3 (+ patches)
+ Awk December 18, 2020 version
+ Expat 2.4.1
---------------------------------------------------------------------
How to install
Please refer to the following files on the mirror site for extensive
details on how to install OpenBSD 7.0 on your machine:
* .../OpenBSD/7.0/alpha/INSTALL.alpha
* .../OpenBSD/7.0/amd64/INSTALL.amd64
* .../OpenBSD/7.0/arm64/INSTALL.arm64
* .../OpenBSD/7.0/armv7/INSTALL.armv7
* .../OpenBSD/7.0/hppa/INSTALL.hppa
* .../OpenBSD/7.0/i386/INSTALL.i386
* .../OpenBSD/7.0/landisk/INSTALL.landisk
* .../OpenBSD/7.0/loongson/INSTALL.loongson
* .../OpenBSD/7.0/luna88k/INSTALL.luna88k
* .../OpenBSD/7.0/macppc/INSTALL.macppc
* .../OpenBSD/7.0/octeon/INSTALL.octeon
* .../OpenBSD/7.0/powerpc64/INSTALL.powerpc64
* .../OpenBSD/7.0/riscv64/INSTALL.riscv64
* .../OpenBSD/7.0/sparc64/INSTALL.sparc64
---------------------------------------------------------------------
Quick installer information for people familiar with OpenBSD, and the
use of the "disklabel -E" command. If you are at all confused when
installing OpenBSD, read the relevant INSTALL.* file as listed above!
OpenBSD/alpha:
If your machine can boot from CD, you can write install70.iso or
cd70.iso to a CD and boot from it. Refer to INSTALL.alpha for more
details.
OpenBSD/amd64:
If your machine can boot from CD, you can write install70.iso or
cd70.iso to a CD and boot from it. You may need to adjust your BIOS
options first.
If your machine can boot from USB, you can write install70.img or
miniroot70.img to a USB stick and boot from it.
If you can't boot from a CD, floppy disk, or USB, you can install
across the network using PXE as described in the included
INSTALL.amd64 document.
If you are planning to dual boot OpenBSD with another OS, you will
need to read INSTALL.amd64.
OpenBSD/arm64:
Write install70.img or miniroot70.img to a disk and boot from it
after connecting to the serial console. Refer to INSTALL.arm64 for
more details.
OpenBSD/armv7:
Write a system specific miniroot to an SD card and boot from it after
connecting to the serial console. Refer to INSTALL.armv7 for more
details.
OpenBSD/hppa:
Boot over the network by following the instructions in INSTALL.hppa
or the hppa platform page.
OpenBSD/i386:
If your machine can boot from CD, you can write install70.iso or
cd70.iso to a CD and boot from it. You may need to adjust your BIOS
options first.
If your machine can boot from USB, you can write install70.img or
miniroot70.img to a USB stick and boot from it.
If you can't boot from a CD, floppy disk, or USB, you can install
across the network using PXE as described in the included
INSTALL.i386 document.
If you are planning on dual booting OpenBSD with another OS, you will
need to read INSTALL.i386.
OpenBSD/landisk:
Write miniroot70.img to the start of the CF or disk, and boot
normally.
OpenBSD/loongson:
Write miniroot70.img to a USB stick and boot bsd.rd from it or boot
bsd.rd via tftp. Refer to the instructions in INSTALL.loongson for
more details.
OpenBSD/luna88k:
Copy 'boot' and 'bsd.rd' to a Mach or UniOS partition, and boot the
bootloader from the PROM, and then bsd.rd from the bootloader. Refer
to the instructions in INSTALL.luna88k for more details.
OpenBSD/macppc:
Burn the image from a mirror site to a CDROM, and power on your
machine while holding down the C key until the display turns on and
shows OpenBSD/macppc boot.
Alternatively, at the Open Firmware prompt, enter boot cd:,ofwboot /
7.0/macppc/bsd.rd
OpenBSD/octeon:
After connecting a serial port, boot bsd.rd over the network via DHCP
/tftp. Refer to the instructions in INSTALL.octeon for more details.
OpenBSD/powerpc64:
To install, write install70.img or miniroot70.img to a USB stick,
plug it into the machine and choose the OpenBSD install menu item in
Petitboot. Refer to the instructions in INSTALL.powerpc64 for more
details.
OpenBSD/riscv64:
To install, write install70.img or miniroot70.img to a USB stick, and
boot with that drive plugged in. Make sure you also have the microSD
card plugged in that shipped with the HiFive Unmatched board. Refer
to the instructions in INSTALL.riscv64 for more details.
OpenBSD/sparc64:
Burn the image from a mirror site to a CDROM, boot from it, and type
boot cdrom.
If this doesn't work, or if you don't have a CDROM drive, you can
write floppy70.img or floppyB70.img (depending on your machine) to a
floppy and boot it with boot floppy. Refer to INSTALL.sparc64 for
details.
Make sure you use a properly formatted floppy with NO BAD BLOCKS or
your install will most likely fail.
You can also write miniroot70.img to the swap partition on the disk
and boot with boot disk:b.
If nothing works, you can boot over the network as described in
INSTALL.sparc64.
---------------------------------------------------------------------
How to upgrade
If you already have an OpenBSD 6.9 system, and do not want to
reinstall, upgrade instructions and advice can be found in the
Upgrade Guide.
---------------------------------------------------------------------
Notes about the source code
src.tar.gz contains a source archive starting at /usr/src. This file
contains everything you need except for the kernel sources, which are
in a separate archive. To extract:
# mkdir -p /usr/src
# cd /usr/src
# tar xvfz /tmp/src.tar.gz
sys.tar.gz contains a source archive starting at /usr/src/sys. This
file contains all the kernel sources you need to rebuild kernels. To
extract:
# mkdir -p /usr/src/sys
# cd /usr/src
# tar xvfz /tmp/sys.tar.gz
Both of these trees are a regular CVS checkout. Using these trees it
is possible to get a head-start on using the anoncvs servers as
described here. Using these files results in a much faster initial
CVS update than you could expect from a fresh checkout of the full
OpenBSD source tree.
---------------------------------------------------------------------
Ports Tree
A ports tree archive is also provided. To extract:
# cd /usr
# tar xvfz /tmp/ports.tar.gz
Go read the ports page if you know nothing about ports at this point.
This text is not a manual of how to use ports. Rather, it is a set of
notes meant to kickstart the user on the OpenBSD ports system.
The ports/ directory represents a CVS checkout of our ports. As with
our complete source tree, our ports tree is available via AnonCVS.
So, in order to keep up to date with the -stable branch, you must
make the ports/ tree available on a read-write medium and update the
tree with a command like:
# cd /usr/ports
# cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_7_0
[Of course, you must replace the server name here with a nearby
anoncvs server.]
Note that most ports are available as packages on our mirrors.
Updated ports for the 7.0 release will be made available if problems
arise.
If you're interested in seeing a port added, would like to help out,
or just would like to know more, the mailing list ports@openbsd.org
is a good place to know.