OpenBSD 7.0

What's New

This is a partial list of new features and systems included in OpenBSD 7.0. For a comprehensive list, see the changelog leading to 7.0.

New/extended platforms:
- Added new riscv64 platform for 64-bit RISC-V systems.
- The arm64 platform support was improved with the following changes:
  - Support for Apple Silicon Macs has improved but is not ready for general use yet:
    - Added support for installing on a disk with a GPT.
    - Added apldart(4) support for a DART with two sets of registers, needed to support the Synopsis DesignWare USB 3 controller.
    - Added apldwusb(4), a glue driver for the Synopsys DesignWare USB 3 controllers found on the Apple M1 SoC.
    - Added aplns(4) to provide support for Apple NVME storage as found in Apple M1 devices.
    - Added aplpinctrl(4), a driver for the Apple GPIO controller found on the M1 SoCs.
    - Added aplpmu(4), a driver for the Apple "sera" SPMI power management unit that contains the RTC on Apple M1 systems.
    - Added aplspmi(4), a driver for the Apple SPMI controller.
  - Enabled LEDs for the mue(4) LAN7800 chip as found on the Raspberry Pi 3 Model B+.
  - Added rktcphy(4), a driver for the Type-C PHY controller found on the Rockchip RK3399.
  - Implemented multicast support in mvpp(4).
- Changes on other architectures:
  - Switched macppc to use ld.lld(1).
  - Fixed an issue preventing applications from selecting the non-ALTIVEC code path on macppc.
  - Made amd64 hw.setperf percentages proportional to the enhanced speed step frequencies on Intel processors. The default hw.setperf=99 corresponds to the maximum ordinary speed, and setting it to 100 enables turbo mode.
  - Enabled cy(4) on amd64.
  - Disabled base-gcc on amd64.
  - Prevented crashes on amd64 when TLB entries which should have been invalidated were used.
  - Prevented a kernel panic in sparc64 due to page boundary misalignment.
  - Forced luna88k to use the serial console when no graphics board is found.
  - Made additional free inodes on luna88k bsd.rd by specifying density=4096.
  - Fixed strchr() and strrchr() on mips64.
  - Prevented watchdog resets on some i.MX 64-bit machines with a recent U-Boot and watchdog enabled on boot in imxdog(8).
  - Created audio devices on armv7.
  - Retired OpenBSD/sgi platform.
  - Enabled MSI-X support for powerpc64.
  - Fixed __ppc_lock for page faults that recursively grab the lock on powerpc.
  - Increased the maximum data size on powerpc64 to 32GB.
  - Disabled global page table mappings when using PCID to prevent crashes when not flushed from TLB on amd64.
  - Added cduart(4) driver for Cadence Universal Asynchronous Receiver/Transmitter on armv7.
  - Added zqclock(4) driver for Xilinx Zynq-7000 clock controller on armv7.
  - Added zqreset(4) driver for Xilinx Zynq-7000 reset controller on armv7.
Various kernel improvements:
- Unlocked the top part of the VM fault handler on i386.
- Enabled dt(4) for GENERIC kernels on amd64, arm64, i386, sparc64, and powerpc64.
- Added kprobes provider for dt(4).
- Implemented < and > operators in btrace(8) filters.
- Added btrace(8) display of time spent in userland when analyzing the kernel stack in the flame graph tool and fixed a parsing bug.
- Introduced /etc/bsd.re-config(5), which can be used to configure the kernel using config(8), allowing use of KARL while making changes to the GENERIC kernel.
- Identify TPM 2.0 devices and perform the 2.0-specific suspend command, allowing the ThinkPad X1 Carbon Gen 9 and ThinkPad X1 Nano with the latest BIOS (which added S3) to resume.
- Changed the printing of the hibernate image size from bytes to megabytes.
- Increased hibernate writeout speed.
- Added "machine sysregs" command to ddb(4) on amd64.
- Prevented interleaved stack traces in ddb(4) from multiple CPUs.
- Delayed installation of sensors until a device with battery support is connected, allowing sensorsd(8) to pick up hotplugged uhidpp(4) devices.
- Prevented a kernel panic after VFS shutdown.
- Increased the setitimer(2) timer limit to UINT_MAX seconds.
- Serialized the internals of kqueue(2) with a mutex.
- Enabled pool cache on knote(9) pool.
- Fixed futex(2) errno handling to match what Mesa expects and prevent failure to properly report timeouts.
- Fixed a kernel crash in tty(4).
- Increased the default buffer space on PF_UNIX sockets to 8k and made the values tuneable via sysctl(2).
- Made kqueue(2) timer re-addition reset an existing timer to use the new timeout period.
- In the build system, pass make flags to kernel and lib builds, making hacking on ramdisks/the installer much faster.
SMP Improvements
- Made pmap_extract() mpsafe on hppa and amd64.
- Introduced CPU_IS_RUNNING() and used it in scheduler-related code to prevent waiting on non-running CPUs.
- Made anonymous object reference counting independent from the KERNEL_LOCK().
- Unlocked connect(2).
- Unlocked setrtable(2).
- Introduced per-CPU panic(9) message buffers.
- Used so_lock to protect key management (PF_KEY) sockets.
- Used so_lock to protect routing (PF_ROUTE) sockets.
- Unlocked lseek(2).
- Unlocked the top part of the fault handler.
Direct Rendering Manager
- Updated drm(4) to Linux 5.10.65
- inteldrm(4): better support for Tiger Lake
- amdgpu(4): support for Navi 12, Navi 21 "Sienna Cichlid", Arcturus
- amdgpu(4): support for Cezanne "Green Sardine" Ryzen 5000 APU
VMM/VMD improvements
- Added a theoretical limit of 512 to the number of allocated vcpus in vmm(4).
- Fixed vmm(4) vcpu locking issues.
- Added vmd(8) support for variable length vionet rx descriptor chains.
- Prevented stack overflow in vmd(8) due to large DHCP packets on local interfaces.
- Allowed locking of a randomly assigned lladdr in vmd(8).
- Skipped inspecting non-udp packets on local interfaces for vmd(8).
- Prevented guest virtio drivers from causing stack and buffer overflows in vmd(8).
- Fixed a race condition in vmm(4) relating to incorrect physical cpu tracking.
- Fixed vmctl(8) client "wait" state corruption in vmd(8) when a wait is canceled and restarted, allowing multiple waiting clients.
- Added protections against guests with bad virtio drivers to vmd(8)
- Unlocked the kernel in vmm(4) ioctl handlers and introduced vcpu locks
Various new userland features:
- Imported timeout(1) utility from NetBSD. timeout(1) can be used to run commands with a time limit.
- Added include and exclude options to openrsync(1).
- Implemented reporting of supplemental groups in ps(1).
- Added indication of whether an mg(1) function is unsuitable for a startup file.
- Added "dired-jump" command to mg(1) to open a dired buffer containing the current buffer's directory location.
Various bugfixes and tweaks in userland:
- Modified doas(1) to retry up to 3 times on password authentication failure.
- Made all vi(1) signal handler functions async-signal-safe.
- Changed diff(1) to consider two files sharing the same inode identical.
- Allowed xenodm(1) login when ~/.Xauthority does not exist.
- Disabled building all of the non-unicode fonts in Xenocara except for ISO8859-1.
- Altered passwd(1) to use stderr for printer error and informational messages. This allows easier parsing of what passwd(1) is doing if spawned from a GUI.
- Fixed iostat(8) per-device values when systat(1) is in boot time mode ('b'), not normalizing based on the sleep interval.
- Made jot(1) -b, -c and -w mutually exclusive.
- Made cdio(1) discard the current input line when Ctrl-C is used during line editing and provide a fresh prompt rather than exiting the program.
- Let el_gets(3) honour the first Ctrl-C typed by the user rather than ignoring it.
- Corrected awk(1) -F null string behavior to ensure -F '' behaves consistently with -v FS="".
- Avoided a potential buffer overflow in backslash escaping in awk(1).
- Disallowed the use of an empty list between "while" and "do" in ksh(1).
- Changed cwm(1) maximization and full-screen mode toggling to keep the cursor within the window, preventing focus loss.
- Made rc(8) quietly attempt an early mount of /var/log in case someone has created it as a separate filesystem to avoid /var overflow issues.
- Improved fdisk(8) to retain essential partitions on various platforms.
- Improved fdisk(8) for disks with 4K sectors.
- Cleaned up the fdisk(8) MBR/GPT initialization code, making -g independent of -i, leaving four mutually exclusive initialization options (-i, -g, -u and -A) with the last option specified executed (allowing the existing -i -g to work as intended).
- Relaxed criteria for recognizing GPT formatted media, allowing GPT disk images added with dd(1) onto larger physical media to be recognized by fdisk(8) and the kernel.
- Added the ability for fdisk(8) to recognize "BIOS Boot", "APFS", "APFS ISC", "APFS Recovry" (sic), "HiFive FSBL" and "HiFive BBL" GPT partitions.
- Ensured the values for fdisk(8) -b and -l are treated as 512-byte block counts.
- Added an fdisk(8) -A option to initialize a GPT without removing special boot partitions.
- Made fdisk(8) -b option available to architectures other than amd64 and i386 and extended the syntax to allow specification of the boot partition type and offset.
- Adjusted density for partitions on a 4k disk in newfs(8) when fragsize and density are not passed on the command line to ensure sufficient inodes to hold a src tree on a 2G fs.
- Fixed disklabel(8) generation on sparc64.
- Fixed overlap check in disklabel(1) autoalloc code.
- Corrected various min/max cluster numbers for FAT12/16/32 in newfs_msdos(8).
- Added libexecinfo, a library providing backtrace functions.
- Updated C library support for character classification to Unicode 13.0.
- Let wcwidth(3) treat all characters in Unicode private use areas as single-width, even those in planes 15 and 16.
- Limited the printf(1) \x escape sequence to two characters.
- Corrected the output of date(1) -f %s which was wrongly affected by the local timezone.
- Turn printing additional information into toggles for systat(1).
Improved hardware support and driver bugfixes, including:
- Added a workaround to amdgpu(4) for machines where the framebuffer size reported by the hardware is incorrect.
- In pchgpio(4), worked around a BIOS bug on Lenovo ThinkPads based on Intel's Tiger Lake platform to properly restore the GPIO pin used for the touchpad interrupt upon resume.
- Stopped setting the highspeed bit on bcm2835-sdhci sdhc(4) controllers, fixing bwfm(4) wifi on the Raspberry Pi 3 Model B+.
- Added support for obtaining sense status and source slot of a media to chio(1) and ch(4).
- Fixed dwiic(4) timeouts requesting data from at least one touchpad.
- Added ucc(4), a driver for USB HID Consumer Control keyboards. Often used to expose volume, audio and application launch keys. Volume keys are handled by the kernel and all other keys are propagated to X11 and the console through wscons(4).
- Set the uhidpp(4) battery level sensor status to unknown while charging to handle devices reporting zero during charge, preventing certain sensorsd.conf(5) actions from triggering inappropriately.
- Added Tiger Lake LP (INT34C5) support to pchgpio(4).
- Fixed a panic at shutdown relating to azalia(4) on the X1 Extreme Gen 1.
- Fixed a panic reported in upd(4).
- Fixed display of incorrect patterns on LUNA's wscons(4) with 1bpp framebuffer when backspace is typed.
- Fixed an attachment problem for dwctwo(4) for certain devices issuing NAK interrupts during split transactions.
- Added AMD 17h/6xh Root Complex to ksmn(4).
- Ensured the TX FIFO isn't overrun for longer transfers in dwiic(4).
- Added titmp(4), a driver for the TI TMP451 temperature sensor.
- Ensured a USB mouse will attach if otherwise qualified even if the usage report does not include X and Y usages.
- Attached unsupported video devices to uvideo(4) but not video(1), rather than leaving it unmatched.
- Added a -R flag to usbhidctl(1) to dump the raw report descriptor bytes.
- Added hid_get_report_desc_data() to usbhid(3) to access raw report descriptor data.
- Fixed overflows when reading multiple bytes from AML over an i2c bus in acpi(4).
- Fixed uaudio(4) on certain machines such as the RPI4 by adding a pre-DMA-write barrier after data is stored to memory.
- Worked around x86 machines that advertise the "hardware reduced" ACPI feature, advertise S4 and S5 support, but fail to populate the SLEEP_CONTROL_REG and SLEEP_STATUS_REG descriptions in the FADT. This fixed the ASUS Zenbook 14.
- Added quirk to enable ThinkPad X1 Extreme 1 speakers and Dolby Atmos in azalia(4).
- Fixed pchgpio(4) issues with dead touchpads after resume.
- Fixed an mbuf leak in xnf(4).
New or improved network hardware support:
- Fixed ix(4) with older amd64 and current riscv64 hardware if MSI is not enabled for the device.
- Added the uaq(4) driver for Aquantia AQC111U/AQC112U USB Ethernet devices.
- Added the aq(4) driver to support Aquantia 1/2.5/5/10Gb/s PCIe Ethernet adapters.
- Synced dwctwo(4) with the NetBSD-current code base, enabling the USB on-board Ethernet controller through mue(4), fixing uvideo(4), and enabling the two USB uhub3 ports on the Raspberry Pi 3 Model B+.
- Added cad(4), a driver for Cadence GEM.
- Added Broadcom BCM5725 to brgphy(4).
- Added support for RTL8168FP/RTL8111FP/RTL8117 to re(4).
- Fixed ure(4) after a media link change on RTL8153/B devices.
- Fixed bnxt(4) with a single queue in MSI-X mode.
Added or improved wireless network drivers:
- Zeroed out iwx(4) Tx descriptors of frames which is done to prevent the device from writing to the former DMA address of a buffer which has been taken off the Tx ring.
- Fixed a bug in iwx(4) Tx done interrupt processing which could cause fatal firmware errors under load and memory corruption.
- Changed iwm(4) and iwx(4) to sleep for 1 second while loading firmware to match what iwn(4) does. This fixes some issues with suspend/resume.
- Ensured that iwm(4) and iwx(4) will reload firmware from disk on down/up and not during resume.
- Fixed iwx(4) crystal latency values to match those used by Linux iwlwifi.
- Fixed an off-by-one error in bwfm(4).
- Changed iwn(4), iwm(4), and iwx(4) devices to hide detailed firmware error reports by default.
- Prevented a loop when bwfm(4) receives an unsolicited association status event right after successful association.
- Fixed a leak with wg(4) keepalive.
- Switched iwx(4) to -63 firmware images as shipped in iwx-firmware-20210512, including fixes addressing fragattacks vulnerabilities.
- Supported the new iwx(4) firmware session protection command, required for successful associations with new firmware.
- Stopped asking iwx(4) to send probe requests on passive channels, fixing firmware going unresponsive after association.
- Fixed an iwx(4) edge case where devices failed to resume after system suspend.
- Switched iwm(4) to newer firmware images available in iwm-firmware-20210512. This provides FragAttacks fixes for the updated devices.
- Fixed iwx(4) against access points using TKIP as the group cipher.
- Prevented athn(4) from calling ieee80211_find_rxnode() on bad frames in an attempt to prevent creation of bogus node cache entries.
- Implemented various fixes addressing firmware errors in iwm(4) and iwx(4).
- Fixed node leaks in iwm(4) and iwx(4) which caused the drivers to get stuck when roaming between access points.
- Fixed iwx(4) firmware reloading after a failure to parse the firmware file.
- Avoided "mac clock not ready" panics in iwm(4) and iwx(4).
- Worked around a problem between certain athn(4) hardware running in HostAP mode and clients that use Tx aggregation.
- Corrected multicast decryption for iwx(4).
- Added 802.11n Tx aggregation support to iwm(4).
- Made iwn(4), iwm(4) and iwx(4) keep track of beacon parameters at run-time.
- Implemented support for Rx aggregation offload in iwm(4) and iwx(4) and re-enabled de-aggregation of A-MSDUs in net80211 for all drivers capable of 11n mode.
- Changed error reporting for bwfm(4) to use the long version of the firmware path. This makes it easier to find the correct files to add to the bwfm-firmware port.
IEEE 802.11 wireless stack improvements and bugfixes:
- Drop fragmented 802.11 frames.
- Prevent frame injection via forged 802.11n A-MSDUs.
- Tweaked net80211 RA heuristics to avoid picking Tx rate choices that may be too optimistic.
Generic network stack improvements and bugfixes:
- Implemented reception of "VLAN 0 priority tagged" packets.
- Fixed an alignment fault observed on an octeon machine while pppoe(4) negotiated a large MTU.
- Display provider ID for a umb(4) SIM in ifconfig(8).
Installer and upgrade improvements:
- Checked the installer's /tmp/i/hostname.* files for a configured IP address so that configurations without a broadcast address are detected as well.
- Handled "inet autoconf" in the ramdisk.
- Introduced a short wait in rc(8) after netstart(8) finishes until an IPv4 or IPv6 default route is present before continuing boot. Fixed setups depending on working network and DNS resolution during early boot when using autoconfiguration (dhcpleased(8) or slaacd(8)).
- Made fdisk(8) always create an EFI SYS partition if the -b option is specified when initializing a GPT.
- Allowed (w)hole disk allocation for GPT disks in arm64, using fdisk(8) -A when an Apple APFS ISC partition is detected and fdisk -ig otherwise. Created EFI SYS boot partitions only on ROOTDISK GPT disks.
- Added installboot(8) "-p" to prepare by creating a new filesystem on the partition reserved for the bootloader on relevant architectures.
- Added GPT support to armv7 installboot(8).
- Added the Spleen 12x24 and 16x32 font on amd64's RAMDISK_CD and RAMDISK kernels.
- Use installboot(8) on arm64 ramdisks.
- Enable dhcpleased(8) on ramdisks, and activate resolvd(8), replacing dhclient(8).
- Enable slaacd(8) to configure nameservers on ramdisks.
Security improvements:
- Moved objcopy to base set to allow KARL to work on all installs.
- Added unveil(2) calls to xterm in the case where there are no exec-formatted or exec-selected resources set.
- Changed usage of %n from a syslog warning to syslog and abort for printf(3) (and associated variants).
- Made kernel stop all threads when terminating via pledge_fail().
Routing daemons and other userland network improvements:
- The bgpd(8) daemon saw the following changes:
  - Stop processing queued UPDATES when the max-prefix limit was reached.
  - Improved negotiation for route refresh, graceful restart and multi-protocol capabilities
  - Correctly track 'rde evaluate all' and 'export' settings during reload.
  - Properly withdraw prefixes when 'rde evaluate all' is used.
  - Fixed MRT handling on initial startup for message dump types.
  - Fixed and use non-blocking connect for RTR sessions.
  - Fully implemented RFC 6286 by checking for BGP ID collisions.
  - Adjusted the 4-byte AS number handling to RFC 6793 by changing error behaviour from prefix withdraw to attribute discard.
  - In bgpctl(8) print out both the sent "Neighbor capabilities" and the "Negotiated capabilities" for a session.
  - Print timestamps both as a formatted and a pure time in seconds field in various JSON objects.
  - Fixed a bug, where during bgpd(8) config reloads prefixes of the wrong address family could leak to peers resulting in session resets.
  - Added support for RFC 7313 - Enhanced Route Refresh. Disabled by default. To enable, use 'announce enhanced refresh yes'.
  - Improved output of Adj-RIB-Out by updating nexthop and ASPATH before adding the prefix to the RIB. This improves `bgpctl show rib out` output.
  - Added command line option to both bgpd(8) and bgpctl(8) to show the version.
  - Added support for RFC 9072 - Extended Optional Parameters Length for BGP OPEN Message
  - Added support for RFC 8050 - MRT Format with BGP Additional Path Extensions
  - Implemented receive side of RFC 7911 - Advertisement of Multiple Paths in BGP. OpenBGPD is currently not able to send multiple paths out.
  - Improved checks of VRPs loaded via RTR or from the roa-set table.
  - Allowed optionally specifying an expiry time for roa-set entries to mitigate BGP route decision making based on outdated RPKI data. OpenBGPD's companion rpki-client(8) produces roa-sets with the new 'expires' property
- The pf(4) packet filter and its userland utility:
  - Corrected a potential memory leak associated with pfsync(4) update requests.
  - Introduced locks around the global pf(4) state list.
  - Fixed a panic due to pfsync(4) deferral timeout handling.
  - Added support for pf(4) divert-to on tpmr(4) and veb(4).
  - Fixed state key reference underflow when both state keys are identical in pf(4).
  - Only skipped pf(4) once for packets injected by a divert-packet socket, allowing pf to still act later on a diverted packet.
- IPSEC support in the kernel and the iked(8) userland daemon:
  - Zeroed out potential passwords when freeing memory or handling parsing errors in iked(8).
  - Added client-side support for DNS configuration to iked(8).
  - Increased iked(8) default data bytes limit for Child SAs to 4 GB, preventing excessive rekeying and lost data in high performance setups.
  - Fixed an iked(8) bug where no flows are added if a single address is configured in the config address instead of a pool.
  - Fixed a problem in iked(8) where no flows are loaded when a single config address without pool is configured.
  - Added an experimental post-quantum hybrid key exchange method based on Streamlined NTRU Prime (coupled with X25519) to iked(8) as sntrup761x25519.
  - Fixed races which were slowing ipsec(4) throughput.
  - Fixed ipsec(4) NAT-T to work with pipex(4).
- rpki-client(8) received the following new features and bugfixes:
  - Added keep-alive support to the HTTP client code for RRDP.
  - Reference-count and delete unused files synced via RRDP, as far as possible.
  - In the JSON output, changed the AS Number from a string ("AS123") to an integer ("123") to make processing of the output easier.
  - Added an 'expires' column to CSV & JSON output, based on certificate and CRL validity times. The 'expires' value can be used to avoid route selection based on stale data when generating VRP sets, when faced with loss of communication between consumer and validator, or validator and CA repository.
  - Made the runtime timeout (-s option) also trigger in child processes.
  - Improved RRDP support and make RRDP the default protocol for synchronizing the RPKI repository data, with openrsync(1) used as secondary.
  - At startup, warn if the filesystem containing the cache directory is probably too small.
  - Handle running out of disk space more gracefully, including cleanup of temporary and old files before exiting.
  - Improved the HTTP/1.1 request headers being sent.
  - Improved validation checks for ROA and MFT objects.
  - Improved the HTTP client code (status code handling, http proxy support, keep-alive).
  - In RRDP, do not access URI with userinfo (@-sign)
  - Improved RRDP syncing by considering a notification file serial jumping backwards as synced repository.
  - Made -R (rsync only) also apply to the fetching of TA files.
  - Only sync *.{cer,crl,gbr,mft,roa} files via rsync and exclude all others.
  - When producing output for bgpd(8), make use of the 'roa-set expires' attribute to prevent machines from loading outdated roa-sets.
  - In RRDP, limited the number of deltas to 300 per repo. If more deltas exist, downloading a full snapshot is faster.
  - Limited the validation depth of X.509 certificate chains to 12, double the current depth seen in RPKI.
- traceroute(8) was improved:
  - Probe packets are now sent in quick succession and responses handled asynchronously.
  - DNS lookups are performed asynchronously. This speeds up the time required to display results considerably.
- dhcpleased(8) was made the default program for configuring IPv4 addresses via DHCP. resolvd(8) was activated to handle concurrent changes to resolv.conf(5) by both dhcpleased(8) and slaacd(8).
  Additionally these programs saw the following improvements and bugfixes:
  - Changed dhcpleased(8) client identifier transmission to match other DHCP client implementations.
  - Simplified dhcpleasectl(8) and added syntax to match dhclient(8) (interface), allowing one to be aliased to the other.
  - Retried broadcast with dhcpleased(8) when the DHCP server is unreachable via unicast UDP.
  - Made resolvd(8) accept DNS proposals for the loopback addresses.
  - Added to dhcpleased.conf(5) the ability to ignore routes or nameservers from a lease and to ignore servers entirely.
  - Made dhclient(8) defer to dhcpleased(8) when the inet autoconf flag is set. When run, dhclient will signal dhcpleased to request a new lease rather than requesting one itself.
  - Fixed potential races in slaacd(8) and dhcpleased(8) when two processes are configuring the same IP.
  - Added the possibility to send vendor class identifier and client identifier using dhcpleased.conf(5).
  - Made dhcpleased(8) always configure provided routes, regardless of whether the address received in the lease is already configured.
  - Used exclusive locks under /dev/ to ensure single instances of resolvd(8), slaacd(8) and dhcpleased(8).
  - Implemented classless static routes DHCP option in dhcpleased(8).
  - Added a new "nameserver" command to route(8), sending nameserver proposals to resolvd(8) using the DNS proposal protocol over the route socket. This command is intended be used to integrate userland triggered nameserver changes, for example by VPN software.
- Changes to snmp related tools:
  - Disable SNMPv1 and SNMPv2c by default in snmpd(8).
  - Remove default communities from snmpd(8).
  - Switched default seclevel to enc for snmpd(8).
  - Changed the default snmp(1) version to -v3 and removed the default community.
  - Switched default snmp(1) auth to hmac-sha1.
  - Switched default snmp(1) and snmpd(8) privacy protocol to AES.
  - Added the ability for snmpd(8) to send SNMPv3 traps.
  - Allowed "any" to be used as a listen on address in snmpd.conf(5).
  - Allowed setting of the engineid in snmpd(8).
- Other userland network changes:
  - Fixed acme-client(1) SAN generation for CSRs.
  - Added pledge(2) for ftpd(8) user processes.
  - Allowed router solicitations from the unspecified address (::) in rad(8).
  - Altered slowcgi(8) so it no longer sends debug logging to syslog unless debug logging is requested via the new -v flag.
  - Prevented httpd(8) from trying to chunk encode an empty http body coming from an fcgi upstream.
  - Used relative reference URIs in Location header on directory redirects in httpd(8), adding support for front-ending httpd with a TLS-terminating gateway that forwards unencrypted http traffic.
  - Prevented a crash on strict alignment architectures of tcpdump(8) WireGuard printer.
  - Made tcpdump(8) split the 802.11 sequence number field into its sequence number and fragment number components rather than printing the whole field in decimal.
  - Added simple BGP enhanced route refresh message decoding to tcpdump(8).
tmux(1) improvements and bug fixes:
- Added a -B flag to tmux(1) to remove borders from popups and added a menu to popups as well as options to convert a popup into a pane.
- Added pipe variants of the tmux(1) line copy commands.
- Added basic support for zero width joiners to tmux(1).
- Added client focus hooks to tmux(1).
- Made window-linked and window-unlinked window options in tmux(1).
- Added -F for tmux(1) command-prompt and used it to fix "Rename" on the window menu.
- Added different tmux(1) command histories for different types of prompts.
- Fixed tmux(1) problems with xterm in VT340 mode.
- Added an "always" value to the extended-keys option to always forward those keys to applications inside tmux(1).
OpenSMTPD 7.0.0
- Fixed incorrect status code for expired mails resulting in a misleading bounce report in smtpd(8).
- Added TLS options cafile=(path), nosni, noverify and servername=(name) to smtp(1).
- Allowed specification of TLS ciphers and protocols in smtp(1).
LibreSSL 3.4.1
- New Features
  - Added support for OpenSSL 1.1.1 TLSv1.3 APIs.
  - Enabled the new X.509 validator to allow verification of modern certificate chains.
- Portable Improvements
  - Ported continuous integration and test infrastructure to Github actions.
  - Added Universal Windows Platform (UWP) build support.
  - Fixed mingw-w64 builds on newer versions with missing SSP support.
  - Added non-executable stack annotations for CMake builds.
- API and Documentation Enhancements
  - Added the following APIs from OpenSSL
    - BN_bn2binpad
    - BN_bn2lebinpad
    - BN_lebin2bn
    - EC_GROUP_get_curve
    - EC_GROUP_order_bits
    - EC_GROUP_set_curve
    - EC_POINT_get_affine_coordinates
    - EC_POINT_set_affine_coordinates
    - EC_POINT_set_compressed_coordinates
    - EVP_DigestSign
    - EVP_DigestVerify
    - SSL_CIPHER_find
    - SSL_CTX_get0_privatekey
    - SSL_CTX_get_max_early_data
    - SSL_CTX_get_ssl_method
    - SSL_CTX_set_ciphersuites
    - SSL_CTX_set_max_early_data
    - SSL_CTX_set_post_handshake_auth
    - SSL_SESSION_get0_cipher
    - SSL_SESSION_get_max_early_data
    - SSL_SESSION_is_resumable
    - SSL_SESSION_set_max_early_data
    - SSL_get_early_data_status
    - SSL_get_max_early_data
    - SSL_read_early_data
    - SSL_set0_rbio
    - SSL_set_ciphersuites
    - SSL_set_max_early_data
    - SSL_set_post_handshake_auth
    - SSL_set_psk_use_session_callback
    - SSL_verify_client_post_handshake
    - SSL_write_early_data
  - Added AES-GCM constants from RFC 7714 for SRTP.
- Compatibility Changes
  - Implement flushing for TLSv1.3 handshakes behavior, needed for Apache.
  - Call the info callback on connect/accept exit in TLSv1.3, needed for p5-Net-SSLeay.
  - Default to using named curve parameter encoding from pre-OpenSSL 1.1.0, adding OPENSSL_EC_EXPLICIT_CURVE.
  - Do not ignore SSL_TLSEXT_ERR_FATAL from the ALPN callback.
- Testing and Proactive Security
  - Added additional state machine test coverage.
  - Improved integration test support with ruby/openssl tests.
  - Error codes and callback support in new X.509 validator made compatible with p5-Net_SSLeay tests.
- Internal Improvements
  - Numerous fixes and improvements to the new X.509 validator to ensure compatible error codes and callback support compatible with the legacy OpenSSL validator.
OpenSSH 8.8
- Security
  - sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this option was enabled with a set of patterns that activated logging in code that runs in the low-privilege sandboxed sshd process, the log messages were constructed in such a way that printf(3) format strings could effectively be specified the low-privilege code.
  - sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise supplemental groups when executing an AuthorizedKeysCommand or AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or AuthorizedPrincipalsCommandUser directive has been set to run the command as a different user.
- Potentially incompatible changes
  - A near-future release of OpenSSH will switch scp(1) from using the legacy scp/rcp protocol to using SFTP by default.
  - This release disables RSA signatures using the SHA-1 hash algorithm by default.
  - scp(1): this release changes the behaviour of remote to remote copies (e.g. "scp host-a:/path host-b:") to transfer through the local host by default. This was previously available via the -3 flag. This mode avoids the need to expose credentials on the origin hop, avoids triplicate interpretation of filenames by the shell (by the local system, the copy origin and the destination) and, in conjunction with the SFTP support for scp(1) mentioned below, allows use of all authentication methods to the remote hosts (previously, only non-interactive methods could be used). A -R flag has been added to select the old behaviour.
  - ssh(1)/sshd(8): both the client and server are now using a stricter configuration file parser. The new parser uses more shell-like rules for quotes, space and escape characters. It is also more strict in rejecting configurations that include options lacking arguments. Previously some options (e.g. DenyUsers) could appear on a line with no subsequent arguments. This release will reject such configurations. The new parser will also reject configurations with unterminated quotes and multiple '=' characters after the option name.
  - ssh(1): when using SSHFP DNS records for host key verification, ssh(1) will verify all matching records instead of just those with the specific signature type requested. This may cause host key verification problems if stale SSHFP records of a different or legacy signature type exist alongside other records for a particular host.
  - ssh-keygen(1): when generating a FIDO key and specifying an explicit attestation challenge (using -Ochallenge), the challenge will now be hashed by the builtin security key middleware. This removes the (undocumented) requirement that challenges be exactly 32 bytes in length and matches the expectations of libfido2.
  - sshd(8): environment="..." directives in authorized_keys files are now first-match-wins and limited to 1024 discrete environment variable names.
- New features
  - scp(1): experimental support for transfers using the SFTP protocol as a replacement for the venerable SCP/RCP protocol that it has traditionally used. SFTP offers more predictable filename handling and does not require expansion of glob(3) patterns via the shell on the remote side.
  - sftp-server(8): add a protocol extension to support expansion of ~/ and ~user/ prefixed paths. This was added to support these paths when used by scp(1) while in SFTP mode.
  - ssh(1): add a ForkAfterAuthentication ssh_config(5) counterpart to the ssh(1) -f flag.
  - ssh(1): add a StdinNull directive to ssh_config(5) that allows the config file to do the same thing as -n does on the ssh(1) command- line.
  - ssh(1): add a SessionType directive to ssh_config, allowing the configuration file to offer equivalent control to the -N (no session) and -s (subsystem) command-line flags.
  - ssh-keygen(1): allowed signers files used by ssh-keygen(1) signatures now support listing key validity intervals alongside the keys, and ssh-keygen(1) can optionally check during signature verification whether a specified time falls inside this interval. This feature is intended for use by git to support signing and verifying objects using ssh keys.
  - ssh-keygen(8): support printing of the full public key in a sshsig signature via a -Oprint-pubkey flag.
  - ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs directive to accept a "none" argument to specify the default behaviour.
- Bugfixes
  - ssh(1)/ sshd(8): start time-based re-keying exactly on schedule in the client and server mainloops. Previously the re-key timeout could expire but re-keying would not start until a packet was sent or received, causing a spin in select() if the connection was quiescent.
  - ssh-keygen(1): avoid Y2038 problem in printing certificate validity lifetimes. Dates past 2^31-1 seconds since epoch were displayed incorrectly on some platforms.
  - scp(1): allow spaces to appear in usernames for local to remote and scp -3 remote to remote copies.
  - ssh(1)/ sshd(8): remove references to ChallengeResponseAuthentication in favour of KbdInteractiveAuthentication. The former is what was in SSHv1, the latter is what is in SSHv2 (RFC4256) and they were treated as somewhat but not entirely equivalent. We retain the old name as a deprecated alias so configuration files continue to work as well as a reference in the man page for people looking for it.
  - ssh(1)/ ssh-add(1)/ ssh-keygen(1): fix decoding of X.509 subject name when extracting a key from a PKCS#11 certificate.
  - ssh(1): restore blocking status on stdio fds before close. ssh(1) needs file descriptors in non-blocking mode to operate but it was not restoring the original state on exit. This could cause problems with fds shared with other programs via the shell.
  - ssh(1)/ sshd(8): switch both client and server mainloops from select(3) to pselect(3). Avoids race conditions where a signal may arrive immediately before select(3) and not be processed until an event fires.
  - ssh(1): sessions started with ControlPersist were incorrectly executing a shell when the -N (no shell) option was specified.
  - ssh(1): check if IPQoS or TunnelDevice are already set before overriding. Prevents values in config files from overriding values supplied on the command line.
  - ssh(1): fix debug message when finding a private key to match a certificate being attempted for user authentication. Previously it would print the certificate's path, whereas it was supposed to be showing the private key's path.
  - sshd(8): match host certificates against host public keys, not private keys. Allows use of certificates with private keys held in a ssh-agent.
  - ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8), which allows RSA/SHA2 signatures for public key authentication but fails to advertise this correctly via SSH2_MSG_EXT_INFO. This causes clients of these server to incorrectly match PubkeyAcceptedAlgorithms and potentially refuse to offer valid keys.
  - sftp(1)/ scp(1): degrade gracefully if a sftp-server offers the limits@openssh.com extension but fails when the client tries to invoke it.
  - ssh(1): allow ssh_config SetEnv to override $TERM, which is otherwise handled specially by the protocol. Useful in ~/.ssh/config to set TERM to something generic (e.g. "xterm" instead of "xterm-256color") for destinations that lack terminfo entries.
  - sftp-server(8): the limits@openssh.com extension was incorrectly marked as an operation that writes to the filesystem, which made it unavailable in sftp-server read-only mode.
  - ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered when the update removed more host keys than remained present.
  - scp(1): when using the SFTP protocol, continue transferring files after a transfer error occurs, better matching original scp/rcp behaviour.
  - ssh(1): fixed a number of memory leaks in multiplexing,
  - ssh-keygen(1): avoid crash when using the -Y find-principals command.
  - A number of documentation and manual improvements.
mandoc 1.14.6
- Added a style message about overlong text input lines.
- Made "-W style" check .Xr links along the full manpath to help validation of non-base manual pages.
- Supported auto-tagging for ".It Va" in mdoc(7) documents.
- Stopped printing two extra blank lines at the top and bottom of man(7) documents.
- Supported the CB and CI fonts in roff(7) \f font escapes and .ft font requests.
- Added support for two-character font names (BI, CW, CR, CB, CI) to the tbl(7) layout font modifier.
- Implemented the tbl(7) layout modifiers "b" (bold) and "i" (italic) in HTML output mode.
- Completed support for the "nospaces" option in the tbl(7) parser.
- Fixed an infinite loop in the tbl(7) parser for some cases of horizontally overlapping horizontal spans.
- Added a meta viewport element to "-T html" output.
- Fixed a crash with "-T man" when an input file contains tbl(7) or eqn(7) input.
- Fixed a crash in makewhatis(8) when a manpath directory contains a symbolic link that points to a directory.
Ports and packages:
Many pre-built packages for each architecture:
- aarch64: 11034
- amd64: 11325
- arm: 8624
- i386: 10248
- mips64: 9311
- mips64el: 1947
- powerpc: 9452
- powerpc64: 9273
- riscv64: 8620
- sparc64: 9636
Some highlights:
- Asterisk 18.6.0
- Audacity 2.4.2
- CMake 3.20.3
- Chromium 93.0.4577.82
- Emacs 27.2
- FFmpeg 4.4
- GCC 8.4.0 and 11.2.0
- GHC 8.10.6
- GNOME 40.4
- Go 1.17
- JDK 8u302, 11.0.12 and 16.0.2
- KDE Applications 21.08.1
- KDE Frameworks 5.85.0
- Krita 4.4.8
- LLVM/Clang 11.1.0
- LibreOffice 7.2.1.2
- Lua 5.1.5, 5.2.4 and 5.3.6
- MariaDB 10.6.4
- Mono 6.12.0.122
- Mozilla Firefox 92.0 and ESR 91.1.0
- Mozilla Thunderbird 91.1.1
- Mutt 2.1.3 and NeoMutt 20210205
- Node.js 12.22.6
- OCaml 4.10.0
- OpenLDAP 2.4.59
- PHP 7.3.30, 7.4.23 and 8.0.10
- Postfix 3.5.12
- PostgreSQL 13.4
- Python 2.7.18, 3.8.12 and 3.9.7
- Qt 5.15.2 and 6.0.4
- R 4.1.1
- Ruby 2.6.8, 2.7.4 and 3.0.2
- Rust 1.55.0
- SQLite 3.35.5
- Shotcut 21.01.29
- Sudo 1.9.7p2
- Suricata 6.0.2
- Tcl/Tk 8.5.19 and 8.6.8
- TeX Live 2020
- Vim 8.2.3394 and Neovim 0.5.0
- Xfce 4.16
As usual, steady improvements in manual pages and other documentation.
The system includes the following major components from outside suppliers:
- Xenocara (based on X.Org 7.7 with xserver 1.20.13 + patches, freetype 2.10.4, fontconfig 2.12.4, Mesa 21.1.8, xterm 367, xkeyboard-config 2.20, fonttosfnt 1.2.2 and more)
- LLVM/Clang 11.1.0 (+ patches)
- GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
- Perl 5.32.1 (+ patches)
- NSD 4.3.7
- Unbound 1.13.2
- Ncurses 5.7
- Binutils 2.17 (+ patches)
- Gdb 6.3 (+ patches)
- Awk December 18, 2020 version
- Expat 2.4.1

OpenBSD 7.0

What's New

How to install

OpenBSD/alpha:

OpenBSD/amd64:

OpenBSD/arm64:

OpenBSD/armv7:

OpenBSD/hppa:

OpenBSD/i386:

OpenBSD/landisk:

OpenBSD/loongson:

OpenBSD/luna88k:

OpenBSD/macppc:

OpenBSD/octeon:

OpenBSD/powerpc64:

OpenBSD/riscv64:

OpenBSD/sparc64:

How to upgrade

Notes about the source code

Ports Tree