RSS

OpenBSD 6.8

29 Ottobre 2020

OpenBSD

OpenBSD

Il progetto OpenBSD è sistema operativo UNIX basato su 4.4 BSD ed è gratuito e multipiattaforma. OpenBSD supporta l’emulazione binaria di molti programmi da Solaris, FreeBSD, Linux, BSD/OS, SunOS e HP-UX.

Versione 6.8

Questa versione contiene (in Inglese):

  • New/extended platforms:
    • New powerpc64 platform, supporting PowerNV (non-virtualized) systems with POWER8 and POWER9 CPUs, such as Raptor Computing Systems Talos II and Blackbird systems. POWER8 support has not been tested on real hardware yet.
  • Improvements to time measurements, mostly in the kernel:
    • Added support in the kernel and libc for timecounting in userland, eliminating the need for a context switch everytime a process requests the current time, thereby improving speed and responsiveness in programs which make many gettimeofday(2) calls, especially browsers and office software.
      The userland timecounters are enabled on the amd64, arm64, macppc, octeon and sparc64 architectures.
    • Added a ktrace(1) -T option to make time-related system calls more prominent.
    • Added tsc_delay(), a delay(9) implementation based on the TSC, to amd64.
    • Used an LFENCE instruction everywhere RDTSC is used for a time measurement, reducing the jitter in TSC skew measurements.
    • Introduced gettime(9) and getuptime(9) and substituted these for time_second(9) and time_uptime(9) throughout the kernel to prevent split-read problems on 32-bit platforms.
    • Synchronized each core’s CP0 cycle counter using the IO clock counter on mips64 and octeon, making the cycle counter usable as timecounter.
    • Improved CPU frequency scaling in automatic performance mode by removing accounting for offline CPUs.
  • Various kernel improvements:
    • Added intrmap, an interrupt to CPU mapping API that is used by hardware drivers to use multiple CPUs for interrupt handling.
    • Added an ioctl PCIOCGETVPD allowing userland to access read-only support information about pci devices via the vpd register.
    • Set ddb(4) “/t” to show a trace via TID on all architectures.
    • Introduced kstat(1), a subsystem to allow the kernel to expose statistics to userland.
    • Added kstat to cnmac(4).
    • Added support for remote coverage to kcov(4).
    • Moved sysctl(2) CTL_DEBUG from DEBUG to the new DEBUG_SYSCTL.
    • Prevented creation of bogus sd(4) devices for nvme(4) namespaces which are configured but have size 0.
    • Added READ(12)/WRITE(12) support to cd(4).
    • Used READ(16)/WRITE(16) commands for disks large enough to require them to access the last sectors, fixing large 512E devices plugged into USB to ATA/ATAPI bridges which mistakenly use 4K sector addresses/sizes.
    • Restored VGA fonts on VT switch, preventing an unusable screen when switching to a VT with a custom VGA font from X.
    • Ensured only pseudo-terminal devices use reprint delays.
    • Prevented improper disabling of the backlight in umstc(4) when brightness is adjusted to 0.
    • Provided an optimized implementation of ffs(3) in the kernel on arm64/powerpc/powerpc64.
    • Rewrote m88k mutex code as a slight variation of the MI mutex code, potentially improving stability and rendering mutex spinning time visible in top(1).
    • Reworked kernel loading with octboot, the OpenBSD/octeon bootloader, which now does not rely on a mounted filesystem.
    • Ensured scsi(4) devices do not attempt to process bogus MODE SENSE data.
  • Various new userland features:
    • Imported login_ldap(8), using ldap(1) rather than openldap.
    • Added support for set -o pipefail to ksh(1), potentially helping error checking.
    • Cleared the screen in ksh(1)‘s vi mode before redrawing the line with ^L.
    • Implemented the gensub(), systime() and strftime() functions for awk(1).
    • Allowed specification of supported TLS protocols in ftp(1) “-S protocols”.
    • Switched the default man(1) pager from “more(1) -s” to less(1).
    • Supported -T html -O tag in man(1) by passing a file:// URI to the pager.
    • Added fstat(1) support for looking up unix domain sockets by file name.
    • Added / as an alias for g (grep) in top(1).
    • Provided a naptime variable for userspace via kvm_read(3), usable by vmstat(8).
    • Allowed switching between alternate devices (-F) with sndioctl(1).
    • Added the ability to set and display video(1) control values directly on the CLI.
    • Allowed the combination of video(1) “-dc” options, reset and display control values.
    • Added video(1) white balance temperature control through w/W keys.
    • Added control for backlight compensation to video(4).
    • Initialized v4l2_requestbuffers for libv4l compatibility, allowing view of video encodings not directly supported by video(1).
    • Added a new column to wsfontload(8) -l output to report the number of characters contained in a loaded font.
    • Relaxed filename checks in syspatch(8) to allow use of hyphens.
    • Enabled btrace(8) (dt(4) not yet enabled in GENERIC, though).
    • Added btrace(8) -p flag to filter all actions by PID.
    • Implemented linear and power-of-two histograms in bt(5).
    • Added support for “&” and “|” operators in btrace scripts.
  • Various bugfixes and tweaks in userland:
    • Fixed the ksh(1) exit code when evaluating a || compound list to prevent termination of the shell when running under -e.
    • Fixed “$@” splitting with empty IFS in ksh(1).
    • Stopped incrementing openclass for a literal “[” in awk(1), allowing parsing of expressions such as “/[[/[]/”.
    • Fixed make(1) :S with anchors and replacement.
    • Prevented mg(1) from running out of memory or segfaulting with query-replace-regex ^.
    • Fixed ls(1) -R mode to not display subdirectories of a directory beginning with ‘.’ and ensure directory names are always displayed.
    • Prevented a core dump in ftp(1) during fetch abort.
    • Taught su(1) -l -f to start a regular shell for non-csh shells rather than a login shell.
    • Used su(1) -fl to avoid sourcing the target user’s .profile in rc.d(8)/rcctl(8).
    • Fixed merging of files that lack newlines for diff3(1), OpenRCS and OpenCVS.
    • Prevented rcs(1) removal of locked revisions with rcs -orange, avoiding leaving behind a lock for a revision which no longer exists.
    • Fixed sndiod(8) crashes when USB devices are disconnected.
    • Fixed the initial sndiod(8) alternate device number, preventing device number 1 from being skipped on first use.
    • Switched the default CDDB database for cdio(1) to gnudb.gnudb.org:8880.
    • Stopped syslogd(8) from closing UDP sockets for sending messages when DNS lookup of a UDP loghost fails, allowing them to be used to send if DNS is working during the next SIGHUP.
    • Prevented established TCP and TLS sockets of syslogd(8) from staying open forever if a client aborted the connection silently.
    • Avoided reading one byte before the path buffer in mountd(8).
    • Made apmd(8) always ask the kernel about current hw.perfpolicy rather than maintaining state.
    • Prevented an unveil(2) failure with chdir / on sensorsd(8).
    • Fixed a segmentation fault in pstat(8)‘s printing of active vnodes.
    • Corrected getopt_long(3) parsing of a trailing dash in an option group, which was being incorrectly returned as an argument.
    • Prevented callers inspecting unrelated fields in the libc resolver function asr_run().
    • Introduced a darker xenodm(1) login widget and a lower contrast default background.
    • Fixed an xconsole(1) crash by starting it after setting the background.
  • Improved hardware support and driver bugfixes, including:
    • Enabled scrollback in simplefb(4).
    • Fixed display glitches on smaller screens or with larger fonts in efifb(4) associated with remapping and attaching.
    • Improved reporting of remaining power with batteries of different capacities in acpi(4).
    • Fixed bogus frame sizes being returned by xhci(4).
    • Added wsmoused(8) support to efifb(4).
    • Added umstc(4), a driver for Microsoft Surface Type Cover keyboards.
    • Introduced acpihid(4) for ACPI HID event and 5-button array devices.
    • Moved Powerbook5,4 audio from aoa(4) to snapper(4), adding the missing TAS3004 volume control.
    • Fixed broken HID descriptors of Elecom trackballs with 6 or 8 buttons.
    • Added RK3328 PWM, also found in the RK3308, to rkpwm(4).
    • Added RK3308 temperature sensors to rktemp(4).
    • Added pcamux(4), a driver for the PCA9548 I2C switch.
    • Introduced a framework for digital audio interfaces, and added simpleaudio(4), a driver for “simple audio cards.” This is a wrapper connecting the I2S controller, the codec and some aux devices, and simpleamp(4), a driver for “simple audio amplifier,” one of the aux devices for simpleaudio(4).
    • Enabled nvme(4) on i386.
    • Added support for the Ericsson F5521gw Mobile Broadband Modem.
    • Ensured the STOP command sent by sd(4) on powerdown will not result in hanging the machine if commands to the USB mass storage fail.
    • Fixed intermittent failing pms(4) device initialization seen on some Synaptics devices.
    • Corrected trackstick/button attachment of Windows Precision Touchpad imt(4) devices, fixing behavior on certain Dell Latitude laptops.
    • Improved speed of scrolling by optimizing rasops(9) write-only framebuffer console.
    • Modified uvideo(4) to fix webcam detection in Firefox 78.
    • Added a SENSOR_ENERGY sensor type to the sensors framework API which uses microjoules.
    • Added support for the AMDI0010 touchpad on the Inspiron 5505.
    • Avoided nvram lock timeout on sparc64 systems with onboard BCM5704 bge(4) instances that come without a fitted EEPROM/NVRAM.
    • Added pms(4) support for the Elantech v1 touchpad with firmware version 0x20022.
    • Added sdmmc(4) support for eMMC HS200 mode.
    • Added Exar XR17V35x serial port support.
    • Properly implemented amlmmc(4) setting of signal voltage.
    • Implemented UHS-I support in the sdmmc(4) midlayer and enabled it in amlmmc(4).
    • Introduced abl(4), a new driver to control the backlight brightness on Intel-based Apple machines, and allowed it to be controlled through wsconsctl(8).
    • Disabled acpivout(4) brightness control on machines aware of Windows 8, enabling inteldrm to handle brightness ioctls.
    • Fixed eeprom(8) error when setting variables on macppc.
    • Updated drm(4) to Linux 5.7.19.
  • New or improved network hardware support:
    • Enabled multiple tx/rx queues with Toeplitz RSS hashing in vmx(4), ix(4) and ixl(4).
    • Added support for hardware VLAN tagging and checksumming to mcx(4) and bnxt(4).
    • Fixed a crash in re(4).
    • Added bge(4) support for the BCM5719 A1 Ethernet controller.
    • Handled AGL interfaces on octeon, making management network ports usable on some machines.
    • Added support for the mcx(4) ConnectX-6 Dx.
    • Fixed a potential crash when bringing down an mcx(4) interface.
    • Increased the mcx(4) event queue size, preventing a potential interrupt storm on the ConnectX-4.
    • Fixed outbound bpf(4) tap on ogx(4) interfaces.
    • Improved ure(4) performance by combining multiple sent packets into one transfer.
    • Added support for RK3308 Ethernet to dwge(4).
    • Added rge(4) support for newer RTL8125 chipset (RTL8125B).
  • Added or improved wireless network drivers:
    • Added support to urtwn(4) for TP-Link TL-WN822N-EU v5 (and v4).
    • Added WPA2 (CCMP) crypto offload support to iwm(4) and iwx(4), reducing CPU load during traffic bursts.
    • Fixed causes of several fatal firmware errors on iwx(4) devices.
    • Added bwfm(4) support for BCM4359 SDIO variants such as the AP6359SA module found on the RockPro64 WiFi module.
    • Enabled critical temperature detection in iwx(4) firmware.
    • Fixed mbuf leak in urtwn(4) with frames CCMP-encrypted by hardware.
    • Added support for the D-Link DWA-121 rev B1 urtwn(4) device.
    • Repaired athn(4) in client mode against WPA2 access points.
    • Prevented a panic where athn(4) attempted to transmit old, unencryptable frames after switching to a new group key in hostap mode.
    • Switched iwx(4) from -46 to -48 firmware.
    • Enabled background scanning on iwx(4) devices.
    • Fixed gain calibration for some iwn(4) devices (5000 and up).
    • Added support for AX201 devices to iwx(4).
  • New arm64 and armv7 hardware support and bugfixes, including:
    • Added amlpwrc(4), a driver for the power domain controller found on Amlogic SoCs.
    • Made OpenBSD boot on the ODROID-C4 with power domain in amldwusb(4).
    • Added support for the SD card detect pins on the Turris Mox.
    • Added support for the Marvell Xenon SDHC, used as storage on the Armada 3700 and 8040 SoCs.
    • Opened up a 4GB memory bus window for mvneta(4) on the Marvell Armada 3700, making the second Ethernet controller/port work on the Turris Mox.
    • Added mkvpcie(4), a driver for the Aardvark PCIe controller found on the Armada 3700 SoC.
    • Adjusted dwpcie(4) timing to improve likelihood of a successful PCIe link on the i.MX8MM. Avoids a failure to detect em(4) on the HummingBoard Pulse.
    • Added cwfg(4), a driver for the Cellwise CW201x fuel gauge on the Pinebook Pro.
    • Populated a list of 256 brightness levels as a fallback when the device tree does not specify a list, making the Pinebook Pro display work with the dtb from Linux 5.7.
    • Added escodec(4), a driver for the Everest ES8316 audio codec used on the Pinebook Pro.
    • Added rkiis(4), a driver for the I2S controller found on the Rockchip RK3399.
    • Added bcmtmon(4), a driver for the temperature sensor on the Raspberry Pi 4.
    • Introduced mvpp(4), a driver for the Marvell Packet Processor v2 as used on the Armada 7K and 8K SoCs.
    • Improved PLL1(CPU_PLL) stability for the Allwinner H3/H2+.
    • Ported NetBSD’s arm64 disassembler for ddb(4).
    • Enabled spleen16x32 and spleen32x64 fonts on armv7 for GENERIC kernels.
    • Enabled building wsmoused(8) and wsfontload(8) on arm64 and armv7.
  • IEEE 802.11 wireless stack improvements and bugfixes:
    • Fixed CCMP replay checks with 11n Rx aggregation and CCMP hardware offloading.
    • In hostap mode, complete WPA group key renewals immediately if no station is associated.
    • Improved processing of lost frames during 802.11 Rx aggregation.
    • Allowed passage of unencrypted 802.11 frames during hardware decryption post-processing, fixing failure of some ral(4) devices to receive packets on encrypted networks.
    • Prevented a use-after-free when a wireless device is detached.
  • Generic network stack improvements and bugfixes:
    • Implemented a carp(4) transmit bypassing the ifq on output, enqueuing the packet directly on the parent interface.
    • Fixed pf.conf(5) “route-to TABLE least-states” in an anchor.
    • Allowed pf(4) to divert packets from bridge(4) to local socket.
    • Rehashed main pf(4) rulesets after rule expiration.
    • Added a check for pfctl(8) that an rtable exists when parsing the config.
    • Corrected ruleset checksum calculation to allow pfsync(4) to verify rulesets are identical on all nodes.
    • Added wg(4), an in-kernel driver for WireGuard VPN communication.
    • Protected the whole pipex(4) layer by NET_LOCK().
    • Stopped creation of non-existent bridge(4) interfaces.
    • Added a symmetric toeplitz implementation with integration for nics, usable through the stoeplitz_to_key(9) hash algorithm API.
    • Changed tpmr(4) from ifconfig [-]trunkport to add|del synopsis.
    • Filtered vlan and svlan packets by default for tpmr(4).
    • Implemented IPv6 source address selection as outlined in RFC 6724 section 5.
    • Set IPv6 source address selection to prefer the address with the highest preferred lifetime in case of a tie.
    • Stopped preventing TCP connections to IPv6 anycast addresses.
    • Added the pcap-filter(5) “sample NUM” primitive to allow capture of 1/NUM packets.
    • Added a ROUTE_FLAGFILTER socket option for routing sockets, allowing routing daemons to opt out of receiving messages for L2 and broadcast route entries.
    • Allowed SIOCSWGDPID and SIOCSWGMAXFLOW ioctls for non-root, preventing switch(4) interfaces from appearing partially as bridge(4) devices for unprivileged users running ifconfig(8).
    • Modified trunk(4) to keep port interfaces UP on removal, matching aggr(4) behavior.
    • Fixed rdomain(4) handling for IPv6.
    • Fixed rtable(4) separation of raw sockets for IPv6.
    • Documented rtable(4) removal semantics.
  • Installer improvements:
    • On systems with multiple root disks, the installer will upgrade the disk with auto_upgrade.conf present when the upgrade was initiated by sysupgrade(8).
    • Changed install images called *.fs to *.img to accommodate some UEFI bootloaders.
    • Forced long-names on msdos filenames for installboot on most 32-bit architectures.
    • Converted macppc, octeon and loongson to use machine-independent installboot.
  • Improvements in the FFS2 filesystem:
    • Made FFS2 the default for newfs(8), except for mfs.
    • Improved reliability of very large FFS2 filesystems.
    • Improved speed of checking FFS2 filesystems.
    • Enabled the FFS2 option on the luna88k ramdisk.
    • Made FFS2 the default non-root filesystems on landisk, sgi and luna88k.
  • Security improvements:
    • Added RB_GOODRANDOM passed from bootloader to kernel in boothowto, indicating confidence a “great seed” was loaded.
    • Passed boothowto from the sparc64 bootloader to the kernel using .openbsd.bootdata.
    • Introduced detection of /etc/random.seed reuse.
    • Rewrote the entropy enqueue ring to collect damage asynchronously and adapted the dequeue to mix a selection of “best” ring entries, exponentially backing off the dequeue timeout, to compensate rapidly for weak seeding in unidentifiable conditions and ensure quality to arc4random() calls early in boot.
    • Enabled PAN (Privileged Access Never) on arm64 CPUs supporting it.
    • Skipped scanning file systems which are both nodev and nosuid for SUID, SGID and device files with security(8).
    • Fixed two out-of-bounds array accesses in ioctl code pathways in wscons(4).
    • Fixed information leak in semctl SEM_GET.
    • Prevented root from freezing the UTC clock with settimeofday(2) at securelevel 2.
    • Fixed performance problems relating to tty subsystem abuse.
    • Fixed heap corruption in the X input method client in libX11.
    • Fixed potential information leak via X server pixel data uninitialized memory.
    • Fixed a race condition for isoc devices during device close.
    • Fixed an integer overflow in libX11 which could lead to a double free.
    • Corrected multiple input validation deficits in X server extensions.
  • Routing daemons and other userland network improvements:
    • In bgpctl(8), the “reload” command now takes a ‘reason’ argument to use as Administrative Shutdown Communication to its neighbors.
    • Added bgpctl(8) support for VPNv6 in the family option of the “show rib” command.
    • Added bgpctl(8) support for JSON formatted output in various “show” commands.
    • Improve performance of ospfd(8), ospf6d(8) by using the ROUTE_FLAGFILTER setsockopt to filter out routing socket messages for L2 and broadcast routes.
    • Modified ldapd(8) use of “ldaps” and “tls” keywords to enable only the libtls defaults for protocols and ciphers. The new “legacy” keyword can be used before these keywords in ldapd.conf(5) to enable them all.
    • Added a bsd.schema to ldapd(8) including a shadowPassword and an sshPublicKey attribute which can be used to extend existing LDAP users with the additional bsdAccount objectclass.
    • Removed support for the socket keyword in snmpd.conf(5).
    • Allowed snmpd(8) to define the port we listen on.
    • Allowed snmp(1) mibtree to take one or more arguments to be converted to a chosen output format.
    • Replaced relayd(8)‘s agentx backend and reworked the object structure to be in line with what is defined in the MIB.
    • Introduced a “dark mode” for directory listings and error pages in httpd(8).
    • Allowed specifying -d multiple times in slowcgi(8).
    • Added unveil(2) to the main process of relayd(8).
    • Added support for non-localhost fastcgi sockets to httpd.conf(5).
    • Fixed a hang in rpki-client(8) by properly waiting for exiting openrsync(1) processes.
    • Removed the -f (force) option in rpki-client(8).
    • rpki-client(8) no longer uses openrsync(1)‘s “–delete” to clean up stale files, but instead relies on cryptographically signed RPKI manifest listings.
    • Fixed rpki-client(8) return value check for OpenSSL API used during pubkey validation.
    • Released rpki-client(8) 6.7p1 including OpenBSD 6.7 Errata 015.
    • Changed rpki-client(8) -n behavior to automatically validate the repo.
    • Added a “-s timeout” feature to rpki-client(8) with a one hour default, allowing fresh attempts with cron(8) if rpki-client gets stuck.
    • Added an optional “domain name” acme-client.conf(5) option allowing use of multiple domain sections with the same name and creation of an rsa and an ecdsa key for the same domain name.
    • Added an optional “contact” acme-client.conf(5) option to the account section allowing issuance of certificates from authorities that require a contact email address.
    • Added netstat(1) -R to show a summary of rdomains with associated interfaces and tables.
    • Defaulted to showing full IPv6 address entries in the routing tables displayed by route(8) show and netstat(1) -r.
    • Fixed pcap-filters(5) on DLT_LOOP links, e.g. lo(4), gre(4), wg(4), etc.
    • Fixed dhclient(8) domain-search option processing.
    • Corrected dhclient(8) DECLINE message generation to always include the OFFER’d address.
    • Enabled append/prepend for the domain-search option in dhclient.conf(5).
    • Removed 128-byte limit on dhclient(8) search domains and static routes.
    • Corrected route(8) handling of ::/0 and “route add -inet 0.0.0.0 -prefixlen 0 (gateway)”.
    • Fixed integer underflow in tcpdump(8) due to tiny snaplen causing bogus hexdumps.
    • Added initial tcpdump(8) support for handling geneve packets.
    • Added top(1) “t” to toggle the display of routing tables.
    • Added filtering by routing table to top(1).
    • Moved ntpd(8) to unsynced mode if no replies are received for awhile due to connectivity issues.
    • Made slaacd(8) handle IPv6 address configuration in all rdomains in a single daemon, instead of running one daemon per rdomain.

Risorse

La distribuzione può essere scaricata da:

Il sito web della dstribuzione è: http://www.openbsd.org/

Screenshot

OpenBSD 5.3

OpenBSD 5.3

Conclusioni

Si può aggiornare dalla versione precedente.

Subscribe

Subscribe to our e-mail newsletter to receive updates.

No comments yet.

Leave a Reply