Open BSD
-current Changelog
This selection is intended to include all important
and all user-visible changes.
For a complete record of all changes, please see the "source-changes"
mailing list, called "OpenBSD CVS"
in the archives ,
or use CVS .
For changes in other releases, click below:2.0 ,
2.1 ,
2.2 ,
2.3 ,
2.4 ,
2.5 ,
2.6 ,
2.7 ,
2.8 ,
2.9 ,
3.0 ,
3.1 ,
3.2 ,
3.3 ,
3.4 ,
3.5 ,
3.6 ,
3.7 ,
3.8 ,
3.9 ,
4.0 ,
4.1 ,
4.2 ,
4.3 ,
4.4 ,
4.5 ,
4.6 ,
4.7 ,
4.8 ,
4.9 ,
5.0 ,
5.1 ,
5.2 ,
5.3 ,
5.4 ,
5.5 ,
5.6 ,
5.7 ,
5.8 ,
5.9 ,
6.0 ,
6.1 ,
6.2 ,
6.3 ,
6.4 ,
6.5 ,
6.6 ,
6.7 ,
6.8 ,
6.9 ,
7.0 ,
7.1 ,
7.2 ,
7.3 ,
7.4 ,
7.5 ,
7.6 ,
7.7 ,
7.8 ,
7.9 ,
8.0 .
Changes made between OpenBSD 8.0 and -current
In rpki-client(8) , correctly check whether CAs were previously confirmed.
Prevent fq_codel panic with sustained internet traffic through a congested fq_codel queue.
Use explicit_bzero passphrase on ssh-askpass(1) exit and delete.
Fixed pf(4) race between pf_test() and pf_purge_states().
Add /dev/radio support to hppa, octeon, and sparc64 to accommodate udsbr(4) .
Fixed out-of-bounds glob(7) read on on missing right bracket after character class.
In vmd(8) , fixed double free in the virtio-net TX path.
Limit the number of pending npppd(8) L2TP connections to avoid memory exhaustion.
Reject short MPPE packets in npppd(8) , to avoid memory faults.
Updated libexpat to version 2.9.0.
On octeon, span work queue interrupts across CPUs.
Enable HW offload for VLAN on cnmac(4) .
Fixed crash when locale(1) is run with "--" as its only argument.
Made rpki-client(8) prioritise previously confirmed certification paths.
Imported nsd(8) 4.15.4.
Avoid endless loop when unveil(2) is used in a chroot(2) environment.
Made httpd(8) only rekey TLS tickets for the first server on a socket.
Imported unbound(8) 1.26.2.
Skip backlight init when there is no display on intel(4) .
Fixed tmux(1) status drag targeting across window labels.
Have only one tmux(1) pane own shared corners so they are drawn with the active pane.
Extended tmux(1) REP limit to allow it to wrap on to the next line.
In isakmpd(8) , fixed multiple remotely triggerable crashes.
Fixed regression in mfii(4) driver's ability to detect non-raid disks.
Fixed openssl(1) smime and cms exit status on option parsing errors.
Initial commit of dbupdate(8) for updating (signed) zoneinfo and cert.pem.
Updated cert.pem to handle the Emudhra intermediate cert compromise.
Provide out-of-band information about firmware events to bwfm(4) RX, to avoid firmware injections.
Stopped bwfm(4) blindly trusting bss->length in scan results.
Avoid overflow while bwfm(4) is bounds-checking bwfm_bss_info messages.
Drop bwfm(4) firmware event packets which report a bad data length.
Added missing bounds checks for data length reported by bwfm(4) firmware events.
Validate URI characters in ocspcheck(8) OCSP to avoid header injections.
Fixed "timeout on lite software reset" on mue(4) LAN7800.
Fixed kernel stack overflow in mue(4) mue_init_ltm().
Made ocspcheck(8) check all OCSP AIA URLs for invalid characters.
Prevent HTTP request injection via a certificate's AIA URI in ocspcheck(8) .
Fixed video(4) buffer handling and mmap lifetime.
Updated pkgconf to 3.0.10.
Implemented draft-herdes-idr-otc-rs-verification-01 in bgpd(8) ,
Removed the safte(4) driver.
Made rpki-client(8) expose superfluous ROAIPAddress maxLength, show warning with '-vv'.
Backport security fixes from upstream nsd(8) version 4.15.3.
Fixed overflow on octeon and amd64 in hardware accelerated AES-GMAC crypto.
Fixed an off-by-one in bsd_decompress(), an ancient buffer overflow bug.
Fixed httpd(8) "server match" configuration blocks.
Simplified the pagedaemon when calculating free and inactive page shortages.
Updated pkgconf to 3.0.9.
Fixed errors on alpha when attempting to compile routines with more than 32KB of local variables.
Tidied ld.so(1) output to print the command header itself.
Libc initialisation now aborts if a setuid/setgid program does not have _permit_setugid.
On alpha, allign _STACKALIGNBYTES with GCC expectation.
Handle empty usbdev(4) HID responses that could otherwise lead to out of bounds memcpy().
Updated to freetype 2.15.0; libX11 1.8.14; libXi 1.8.4; libXpm 3.5.20; libXrender 0.9.13; libXtst 1.2.6; xterm 412.
Handle errno properly when accepting an npppd(8) PPTP connection, avoids file descriptor exhaustion.
Reject npppd(8) PPTP control packet with an invalid length field.
Don't attempt to re-read firmware in clcs(4) DVAT_RESUME.
Made npppd(8) reject a PADR with an invalid length AC-Cookie; fixed duplicate cookie check.
Allow urndrs(4) attach to "RNDIS over Ethernet" subclass devices (eg GL.iNet Mudi 7).
In uncm(4) , drop too large TX packets; validate NCM_FORMAT before use; switched to ifqueue(9) API; better checking of wNdpOutAlignment; close the control pipe before calling usb_rem_wait_task(9) .
Added a vertical (side) status line to tmux(1) .
Made ocspcheck(8) reject responses whose certificate status is not GOOD.
Limit ocspcheck(8) HTTP response header size, and body size.
Use the scheme for the verbose connection message as well.
Made ocspcheck(8) select TLS based on the OCSP URL scheme.
Multiple drm(4) bugfixes.
In uonerng(4) claim both the control and data interfaces, so device only attaches once.
Correct tmux(1) pane offsets when clipping both sides.
In ixl(4) and iavf(4) , load DMA map earlier, to avoid panic or stalled interface queue.
Backported stack overwrite security fixes from upstream nsd(8) version 4.15.3.
Don't print newline after reading password if readpassphrase(3) is interrupted by signal.
Bump MAXTSIZ to 256M on mips64, a step towards building lang/zig port on mips64.
Added rpki-client(8) safe guard: don't initially mark trust anchors as nonfunctional CAs.
Made rpki-client(8) '-P' imply offline mode.
In rpki-client(8) offline mode don't consider state related to non-functional CAs.
Fixed ssh(1) channels code spinning when ChannelTimeout used.
Made ypbind(8) privdrop to user _ypbind.
Check that uhidev(4) USB_GET_REPORT size doesn't exceed ucr_data, preventing heap overflow.
Save and restore qcdpc(4) EDO1455 panel state on suspend and resume; added power control.
Handle multiple uncm(4) notifications per interrupt.
Implemented filemode CMS prober using CBS in rpki-client(8) .
Implemented a CBS-based RFC 6488 parser in rpki-client(8) .
Use expire time of the signature path for BRKs in rpki-client(8) .
Improved apm(8) info for machines without a battery.
Fix calculation of i/o size needed to read FSInfo struct in mount_msdos(8) .
Properly activate aq(4) when detected at boot time.
Added RX queues/RSS/TSO support and update microcode for rge(4) RTL8127.
Fixed pppoe(4) out-of-bounds memory write, stack disclosure, and SIGSEGV.
Added unveil(2) to npppd(8) ; fixed stack leak.
Stopped npppd(8) from allowing a non-privileged process to open any file.
Multiple drm(4) bugfixes.
Improved mandoc(1) error messages with '-mdoc -T' markdown mode.
Updated libexpat to version 2.8.5.
Fixed llvm compiler-rt __clear_cache() on mips64.
Fix initialisation sequence required by virtio(4) 3.1.1.
Fixed uncm(4) link establishment on Pixel 7a.
Simplified video(4) kern.video.record logic to avoid bcopy with unchecked parameters.
Updated to makedepend(1) 1.0.10.
Updated to xserver(1) 21.1.25, libpng(3) 1.6.59, xclipboard(1) 1.1.6, xclock(1) 1.2.1, xfd(1) 1.1.6, xkbprint(1) 1.0.8, xload(1) 1.2.2, xmodmap(1) 1.0.12, xpr(1) 1.2.1, xwininfo(1) 1.1.7.
Fixed an off-by-one error in bsd_decompress().
Fixed ld.so(1) information leaks with AUX_openbsd_execmode.
Made binutils aware of the AUX_openbsd_execmode variable.
Cope with dates after 2040 on ADB macppc systems and macppc laptops.
Cleanup and refactoring of rc.subr(8) .
More complete parsing sanity checks in rc.subr(8) .
If rc.d run script was updated, ensure rc.subr(8) uses original values until restart.
unveil(2) and pledge(2) for ypmatch(1) , ypwhich(1) , and yppoll(8) .
Avoid infinite loop in pcidump(8) when encountering misbehaving devices.
Add extra vmd(8) mmio region, allows i686 linux kernels work with less RAM.
unveil(2) and pledge(2) for fgen(1) and ypbind(8) .
Reworked handling of the rpki-client(8) certificate expire time.
Fixed race condition in rc.subr(8) .
Updated to pkgconf(1) 3.0.8.
In pf(4) , check AH extension header length.
Added mwx(4) driver for Mediatek MT792x wifi devices.
Better malloc(3) boundscheck and low-memory behaviour in wsdisplay(4) WSDISPLAYIO_LDFONT.
Implemented mwx(4) MT7925 association to open APs in 11a/b/g modes.
Add tmux(1) commands to copy mode to select, pipe and open OSC 133 command output.
Don't allow mwx(4) deep sleep in ASSOC state, more stable connection and roaming.
Added vmd(8) queue size checks and reject malformed descriptor chains.
Enabled ssh(1) ssh-mldsa44-ed25519 as an allowed CA signature algorithm.
Added truncation detection to the vmd(8) instruction decoder.
In pf(4) , check extension header length does not exceed packet length.
Made mandoc(1) map '\:' to U+200B, to improve html output.
Fixed mandoc(1) handling of special character escape sequences used as delimiters.
Fixed mandoc(1) rendering of the \l (horizontal line) escape sequence.
Made dhcpd(8) siscard packets with unsupported htype's.
Show match count in tmux(1) copy mode.
Added tmux(1) window-default-command option to override default-command per window.
In mandoc(1) '-T utf8' output mode, made '\:' correctly output a line break not a glyph.
Implemented mediaopt monitor for MT7925 with mwx(4) .
Enables urndis(4) in the installer on amd64.
Fix refcnt bug in mwx(4) tx path, fixes hangs on MT7921.
Added preliminary support of RTL8159 to ure(4) .
Fixed tmux(1) tty_clamp_area with status lines at the top and a smaller display.
Added uncm(4) to i386 GENERIC config, and uncm(4) and urndis(4) to RAMDISK_CD.
Fixed mandoc(1) HTML formatter when encountering nonsensical sequence of macros.
Enabled uncm(4) in the installer on amd64 (allows firmware-less network installs).
Added uncm(4) , a driver for USB CDC NCM (i.e. USB phone tethering).
Fixed GPIO wakeup masking during suspend.
First bits of scan code added for the mwx(4) MT7925 chip.
Do not lose a pending pane resize when entering the alternate tmux(1) screen.
In tmux(1) , adjust widths of a few codepoints incorrectly set to double width.
Multiple bugfixes for drm(4) , amdgpu(4) , inteldrm(4) , and radeondrm(4) .
Further restrict the characters allowed in a ssh(1) command-line-supplied user name.
In drm(4) , fixed drm_pending_vblank_event leak in error path for out_fence_ptr.
Reserve a 16K-byte gap at start swap partitions, for upcoming disklabel changes.
In sysv_shm, fixed ordering claim on vm_shm slot.
Made mandoc(1) follow groff_mdoc(7) behaviour for width of a .Bl macro.
Made rpki-client(8) use SOCK_NONBLOCK where possible; handle errors for fcntl().
Improved mandoc(1) section identifier handling.