-
Notifications
You must be signed in to change notification settings - Fork 40
/
67.html
1671 lines (1566 loc) · 79.5 KB
/
67.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!doctype html>
<html lang=en id=release>
<meta charset=utf-8>
<title>OpenBSD 6.7</title>
<meta name="description" content="OpenBSD 6.7">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" type="text/css" href="openbsd.css">
<link rel="canonical" href="https://www.openbsd.org/67.html">
<h2 id=OpenBSD>
<a href="index.html">
<i>Open</i><b>BSD</b></a>
6.7
</h2>
<table>
<tr>
<td>
<a href="images/CoralFever.gif">
<img width="227" height="343" src="images/CoralFever-s.gif" alt="Coral Fever"></a>
<td>
Released May 19, 2020<br>
Copyright 1997-2020, Theo de Raadt.<br>
<br>
<br>
Artwork by Jonni Phillips.
<br>
<ul>
<li>See the information on <a href="ftp.html">the FTP page</a> for
a list of mirror machines.
<li>Go to the <code class=reldir>pub/OpenBSD/6.7/</code> directory on
one of the mirror sites.
<li>Have a look at <a href="errata67.html">the 6.7 errata page</a> for a list
of bugs and workarounds.
<li>See a <a href="plus67.html">detailed log of changes</a> between the
6.6 and 6.7 releases.
<p>
<li><a href="https://man.openbsd.org/signify.1">signify(1)</a>
pubkeys for this release:<p>
<table class=signify>
<tr><td>
openbsd-67-base.pub:
<td>
<a href="https://ftp.openbsd.org/pub/OpenBSD/6.7/openbsd-67-base.pub">
RWRmkIA877Io3oCILSZoJGhAswifJbFK4r18ICoia+3c0PfwANueolNj</a>
<tr><td>
openbsd-67-fw.pub:
<td>
RWSOSlsdN/fgAY1SvEyFdbTkouV2cIsUBXdJhEIhRscq8TT3bz9iOYRL
<tr><td>
openbsd-67-pkg.pub:
<td>
RWTR60UGd2MbnaRg+upZbbBYO00ZhHJehXy7tH2ORHvCjGcDH2pZpsxv
<tr><td>
openbsd-67-syspatch.pub:
<td>
RWTLqtfkjXfBADZEVkBDwSU0EAhy45nb5ovn1xHtQmD3DcqUWe+CouTL
</table>
</ul>
<p>
All applicable copyrights and credits are in the src.tar.gz,
sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the
files fetched via <code>ports.tar.gz</code>.
</table>
<hr>
<section id=new>
<h3>What's New</h3>
<p>
This is a partial list of new features and systems included in OpenBSD 6.7.
For a comprehensive list, see the <a href="plus67.html">changelog</a> leading
to 6.7.
<ul>
<li>General improvements and bugfixes:
<ul>
<li>Reduced the minimum allowed number of chunks in a CONCAT
volume from 2 to 1, increasing the number of volumes which can be
created on a single disk with <a
href="https://man.openbsd.org/bioctl">bioctl(8)</a> from 7 to 15. This
can be used to create more partitions than previously.
<li>Rewrote the <a href="https://man.openbsd.org/cron">cron(8)</a>
flag-parsing code to be getopt-like, allowing tight formations like
-ns and flag repetition. Renamed the "options" field in <a
href="https://man.openbsd.org/crontab.5">crontab(5)</a> to "flags".
<li>Added <a
href="https://man.openbsd.org/man5/crontab.5">crontab(5)</a> -s flag
to the command field, indicating that only a single instance of the
job should run concurrently.
<li>Added <a href="https://man.openbsd.org/cron">cron(8)</a>
support for random time values using the ~ operator.
<li>Allowed <a href="https://man.openbsd.org/cwm">cwm(1)</a>
configuration of window size based on percentage of the master window
during horizontal and vertical tiling actions.
<li>Allowed use of window-htile and window-vtile with the "empty"
group clients in <a href="https://man.openbsd.org/cwm">cwm(1)</a>.
<li>Switched powerpc to a machine-independent mplock implementation,
allowing use of <a href="https://man.openbsd.org/witness">
witness(4)</a>.
<li>Added <a href="https://man.openbsd.org/acpi">acpi(4)</a>
support for the _CCA method, indicating whether DMA is cache-coherent.
<li>Switched the default compiler on powerpc to clang.
<li>Bumped <a href="https://man.openbsd.org/nvme">nvme(4)</a> max
physio() i/o size to 128K.
<li>Improved <a href="https://man.openbsd.org/apmd">apmd(8)</a>
support for automatic suspend/hibernate (-z/-Z). The daemon now
reacts to power changes messages sent by the battery driver.
Those messages are ignored for 60 seconds after a resume, so
that the user can take control before the machine goes back to
sleep.
<li>Prevented a kernel hang when no unlocked ffs_softdep worklist
items could be processed.
<li>Stopped counting pages mapped as PROT_NONE against the
RLIMIT_DATA limit, helping code which reserves large chunks of address
space but populates it sparsely.
<li>Added the $REQUEST_SCHEME variable to <a
href="https://man.openbsd.org/httpd.conf">httpd.conf(5)</a>, allowing
preservation of the original connection type (http or https) for
redirect locations
<li>Implemented "strip" option in <a
href="https://man.openbsd.org/httpd.conf">httpd.conf(5)</a> for
fastcgi to be able to have multiple chroots under /var/www for FastCGI
servers.
<li>Changed <a href="https://man.openbsd.org/httpd">httpd(8)</a>
to send a 408 response when a timeout happens while headers are being
received, but close the connection if no request is received.
<li>Updated en_US.UTF-8.src to Unicode 12.1.
<li>Added a new __tmpfd system call which creates a new, unnamed file in
/tmp, intended for shm/fd passing, but in programs that may otherwise
lack filesystem access (due to restrictions imposed by
<a href="https://man.openbsd.org/unveil.2">unveil(2)</a> or
<a href="https://man.openbsd.org/pledge.2">pledge(2)</a>).
<li>Imported <a href="https://man.openbsd.org/dt">dt(4)</a>, a
driver and framework for Dynamic Profiling, and an accompanying bug
tracer that speaks the <a href="https://man.openbsd.org/dt">dt(5)</a>
language.
<li>Added a human-readable mode (-h) to <a
href="https://man.openbsd.org/systat">systat(1)</a>.
<li>Implemented scrolling in <a
href="https://man.openbsd.org/top">top(1)</a> using the 9 and 0 keys.
<li>Added <a
href="https://man.openbsd.org/timeout_set_flags">timeout_set_flags(9)</a>
and TIMEOUT_INITIALIZER_FLAGS(9) to the timeout API, allowing the
caller to initialize timeouts with arbitrary flags.
<li>Introduced TIMEOUT_SCHEDULED flag and tos_scheduled statistic
to <a href="https://man.openbsd.org/timeout.9">timeout(9)</a>.
<li>Switched to tickless backend in <a
href="https://man.openbsd.org/timeout.9">timeout(9)</a>, adding new
interface <a
href="https://man.openbsd.org/timeout_add_ts">timeout_add_ts(9)</a> to
avoid backwardly compatible behavior.
<li>Added the system clock interface <a
href="https://man.openbsd.org/nanoboottime">nanoboottime(9)</a>,
returning the UTC time at which the system booted in seconds and
nanoseconds.
<li>Introduced efficient page freeing in reverse order from uvm,
greatly improving cases of massive page freeing.
<li>Added uvm_objfree to uvm to efficiently free all pages from a
uvm object, used in the buffer cache for considerable speedup when
freeing pages.
<li>Modified buffer cache to use individual uvm_objs per buffer to
speed page lookups.
<li>Speed up <a href="https://man.openbsd.org/sort">sort(1)</a> by
not performing a top-level sort when -c is used with a -k field.
<li>Modified -z mode verification in <a
href="https://man.openbsd.org/signify">signify(1)</a> to save the
header and output it, so signify -zV >saved.tgz will keep the
signature for later checks.
<li>Enabled DNSSEC validation in <a
href="https://man.openbsd.org/unbound">unbound(8)</a> by default.
<li><a href="https://man.openbsd.org/ntpd">ntpd(8)</a> now does
constraint validation against 9.9.9.9 and 2620:fe::fe by default.
<li>Fixed <a href="https://man.openbsd.org/arp.4">arp(4)</a>
issues created by <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a>
modifying existing routes.
<li>Fixed <a href="https://man.openbsd.org/resolv.conf.5">resolv.conf(5)</a>
handling by <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a>
when an interface loses link.
<li>Restored previous <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a>
behaviour of rejecting leases that lack a subnet mask.
<li>Enabled <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a>
to configure <a href="https://man.openbsd.org/carp.4">carp(4)</a>
interfaces.
<li>Fixed <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a>
releasing leases without a server identifier.
<li>Improved <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a>
NAK handling in various corner cases.
<li>Fixed <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a>
endlessly sending REQUEST messages when an ACK is never received.
<li>Prevented
<a href="https://man.openbsd.org/dhcpd.8">dhcpd(8)</a>
from referencing freed memory when releasing a lease with
an unusually long uid.
<li>Corrected parsing of classless static default route "0/0" in
<a href="https://man.openbsd.org/dhcpd.conf.5">dhcpd.conf(5)</a>.
<li>Increased to 15 the number of
<a href="https://man.openbsd.org/softraid.4">softraid(4)</a>
CONCAT volumes that can be created on a single disk.
<li>Fixed
<a href="https://man.openbsd.org/softraid.4">softraid(4)</a>
CRYPTO volumes on 4K-sector disks.
</ul>
<!-- FFS2 -->
<li>The FFS2 filesystem, which uses 64bit timestamps and block numbers
is now the default for new installs on nearly all architectures:
<ul>
<li>Enabled ffs2 in sgi bootblocks and ramdisks.
<li>Made ffs2 the default filesystem type on installs except for landisk, luna88k and sgi.
<li>Changed the sparc64 bootblocks to be able to read from ffs1, ffs2 and softraid, and enabled the ffs2 option for both floppies.
<li>Enabled FFS2 on the landisk ramdisk.
<li>Taught i386 boot(8), cdboot(8) and pxeboot(8) about ffs2.
<li>Taught macppc boot(8) about ffs2.
<li>Taught sparc64 boot(8) about ffs2.
<li>Allowed hppa <a href="https://man.openbsd.org/man8/hppa/boot.8">boot(8)</a> to read from an ffs2 filesystem.
<li>Allowed alpha boot(8) to read from an ffs2 filesystem and adapted its custom installboot to deal with ffs2. Also fixed the partition read code to deal with offsets greater than 2G.
<li>Adapted <a href="https://man.openbsd.org/biosboot">biosboot(8)</a> so that it can read <a href="https://man.openbsd.org/boot.8">boot(8)</a> from an ffs2 filesystem.
<li>Allowed amd64 <a href="https://man.openbsd.org/man8/amd64/boot.8">boot(8)</a> to read from an ffs2 filesystem. Enabled ffs2 for floppy.
<li>Allowed loongson boot(8) to read from an ffs2 filesystem.
<li>Allowed arm64 and armv7 efiboot(8) to read from an ffs2 filesystem.
</ul>
<li>SMP-Improvements:
<ul>
<li>
<a href="https://man.openbsd.org/__thrsleep">__thrsleep(2)</a>,
<a href="https://man.openbsd.org/__thrwakeup">__thrwakeup(2)</a>,
<a href="https://man.openbsd.org/close">close(2)</a>,
<a href="https://man.openbsd.org/closefrom">closefrom(2)</a>,
<a href="https://man.openbsd.org/dup">dup(2)</a>,
<a href="https://man.openbsd.org/dup2">dup2(2)</a>,
<a href="https://man.openbsd.org/dup3">dup3(2)</a>,
<a href="https://man.openbsd.org/flock">flock(2)</a>,
<a href="https://man.openbsd.org/fcntl">fcntl(2)</a>,
<a href="https://man.openbsd.org/kqueue">kqueue(2)</a>,
<a href="https://man.openbsd.org/pipe">pipe(2)</a>,
<a href="https://man.openbsd.org/pipe2">pipe2(2)</a> and
<a href="https://man.openbsd.org/nanosleep">nanosleep(2)</a>
are run without KERNEL_LOCK.
<li>The generic part of <a href="https://man.openbsd.org/ioctl">ioctl(2)</a>
is run without KERNEL_LOCK.
<li>Reworked AMD smt/core/package detection, helping prevent cores being
misidentified as threads.
<li>Avoided false positives in
<a href="https://man.openbsd.org/witness">witness(4)</a> when detecting
lock order reversals by using separate rwlock initializations for
userland and kernel maps.
<li>Allowed sleeping inside kqueue event filters.
<li>Made <a href="https://man.openbsd.org/vmx">vmx(4)</a> transmit MP-safe.
</ul>
<li>Improved hardware support, including:
<ul>
<li>Improvements in the <a href="https://man.openbsd.org/em">em(4)</a> driver.
<li>Added <a href="https://man.openbsd.org/dsxrtc">dsxrtc(4)</a>,
a driver for the Maxim DS3231/DS3232 I2C RTC.
<li>Added <a href="https://man.openbsd.org/ure">ure(4)</a> support
for Lenovo OneLine Plus Dock Ethernet.
<li>Improved <a href="https://man.openbsd.org/ucom">ucom(4)</a> to
fix firmware upload on some microcontroller boards using DTR and RTS
as signaling lines to reset the device and enter the bootloader.
<li>Added a PCI attachment driver for <a
href="https://man.openbsd.org/com">com(4)</a> to support memory-mapped
PCI devices which are part of a Low Power Subsystem (LPSS).
<li>Implemented microsecond resolution using <a
href="https://man.openbsd.org/microuptime">microuptime(9)</a> to avoid
a hard hang when starting X on Intel Cherry Trail Atom processors.
<li>Added support for X553 controllers to <a
href="https://man.openbsd.org/ix">ix(4)</a>.
<li>Added <a href="https://man.openbsd.org/usb">usb(4)</a> device
support for an AMD hub on the APU2 and a Synaptics vendor id and two
fingerprint readers.
<li>Prevented buffer overflows with <a
href="https://man.openbsd.org/uthum">uthum(4)</a> by not assuming the
report length given by the hardware is necessarily smaller than the
length of the on-stack buffer.
<li>Added <a href="https://man.openbsd.org/rge">rge(4)</a>, a driver
for the Realtek 8125 PCI Express 2.5Gb Ethernet devices.
<li>Fixed cursor issues and suspend/resume on <a
href="https://man.openbsd.org/amdgpu">amdgpu(4)</a> and
<a href="https://man.openbsd.org/radeondrm">radeondrm(4)</a>.
<li>Fixed support for additional I2C busses in <a
href="https://man.openbsd.org/piixpm">piixpm(4)</a> for older SB800
SMBus controllers. Prevented sensors from attaching four times on old
AMD machines.
<li>Invalidated the <a
href="https://man.openbsd.org/knote">knote(9)</a> list of <a
href="https://man.openbsd.org/uhid">uhid(4)</a> after device detach,
preventing a crash that can happen when kqueue still holds references
to knotes pointing to the device.
<li>Prevented a use-after-free causing crashes with <a
href="https://man.openbsd.org/uhidev">uhidev(4)</a> devices.
<li>Prevented <a href="https://man.openbsd.org/mcx">mcx(4)</a>
interface lockups due to completion queue overflow.
<li>Fixed brightness keys on various laptops with AMD graphics.
<li>Fixed brightness controls on machines where the
initial brightness values are returned out of range.
<li>Set the default brightness level on attachment for <a
href="https://man.openbsd.org/pwmbl">pwmbl(4)</a>.
<li>Fixed <a
href="https://man.openbsd.org/acpivout">acpivout(4)</a> screen
brightness adjustment through function keys, better supporting
machines using exponential brightness scaling.
<li>Changed <a
href="https://man.openbsd.org/acpivout">acpivout(4)</a> to increment
and decrement screen brightness based only on brightness level changes
of 5% or higher.
<li>Fixed Etron EJ168 USB 3.0 Host Controllers via USB 2 devices.
<li>Added support for the SIERRA MC7700 to <a
href="https://man.openbsd.org/umsm">umsm(4)</a> UMTS and LTE modem device.
<li>Fixed RAID volume WWIDs for <a
href="https://man.openbsd.org/mpii">mpii(4)</a> LSI controllers on
sparc64, allowing <a
href="https://man.openbsd.org/autoconf">autoconf(9)</a> to identify
the volume as the root device and boot off hardware RAID.
<li>Populated logical disk port WWNs with their RAID volume's WWID
in <a href="https://man.openbsd.org/mpii">mpii(4)</a>.
<li>Added <a href="https://man.openbsd.org/fido">fido(4)</a>, an
HID driver for FIDO/U2F security keys.
<li>Added parsing of DDR4 and LPDDDR3/4 SPD memories to <a
href="https://man.openbsd.org/spdmem">spdmem(4)</a>.
<li>Added support to <a
href="https://man.openbsd.org/lm">lm(4)</a> for NCT6775F, NCT5104D,
NCT6779D and NCT679[1235]D sensors.
<li>Updated <a href="https://man.openbsd.org/piixpm">piixpm(4)</a>
to support newer AMD chips like Hudson-2 and KERNCZ and implemented
multi-bus support for SB800, Hudson-2 and KERNCZ.
<li>Extended the expected SPD types to include DDR4 and low-power DDR3/DDR4.
<li>Enabled full use of jumbo frames on <a
href="https://man.openbsd.org/bnx">bnx(4)</a> devices.
<li>Fixed <a href="https://man.openbsd.org/scsi">scsi(8)</a>
softraid crypto volumes on 4K-sector disks.
<li>Faked disk info to match expected boot disk when EFI
bootloader has been received via TFTP, fixing a hang during HP
Elitebook UEFI boot.
<li>Implemented a hexdump command in the bootloader, helping to
inspect the memory layout created by the firmware and useful for UEFI
debugging.
<li>Improved <a href="https://man.openbsd.org/ksmn">ksmn(4)</a>
temperature conversion precision.
<li>Added a quirk to handle Apollo Lake, Gemini Lake and 100
Series Intel SD/MMC <a href="https://man.openbsd.org/sdhc">sdhc(4)</a>
controllers which should not have voltages set to 0V.
<li>Prevented a local user from causing the system to hang by
reading specific registers when Intel Gen8/Gen9 graphics hardware is
in a low power state.
<li>Prevented writes to memory allowed by the Intel Gen9 graphics hardware.
<li>Added support for buttons 2 and 3 to <a
href="https://man.openbsd.org/imt">imt(4)</a>.
<li>Added <a href="https://man.openbsd.org/ogx">ogx(4)</a>, a
driver for the OCTEON III network processor.
<li>Fixed endian swapping in <a
href="https://man.openbsd.org/xhci">xhci(4)</a>, allowing it to work
again on octeon and other big endian architectures.
<li>Implemented the "parallel boot" feature on compatible sparc64 firmware.
<li>Introduced <a href="https://man.openbsd.org/iwx">iwx(4)</a>, a
driver for Intel AX200 WiFi devices.
<li>Added <a href="https://man.openbsd.org/iwm">iwm(4)</a> support
for Intel 9260 and 9560 wifi devices.
<li>Updated firmware for all devices supported by the
<a href="https://man.openbsd.org/iwm">iwm(4)</a> driver.
<li>Fixed <a href="https://man.openbsd.org/iwm">iwm(4)</a> support
for Intel 3168 wifi devices.
<li>Added support for the tp-link tl-wn823n to the <a
href="https://man.openbsd.org/urtwn">urtwn(4)</a> driver.
<li>The <a href="https://man.openbsd.org/athn">athn(4)</a> driver
now offloads CCMP (WPA2) encryption and decryption to hardware.
<li>Prevented an overflow due to <a
href="https://man.openbsd.org/xen">xen(4)</a> failing to release the
interrupt source when unmasking the interrupt.
<li>Fixed <a href="https://man.openbsd.org/usb.4">usb(4)</a>
handling USB 2.0 devices on various USB 3.0 controllers.
<li>Fixed <a href="https://man.openbsd.org/usb.4">usb(4)</a>
handling of controllers that STALL to indicate a short read.
<li>Fixed <a href="https://man.openbsd.org/xhci.4">xhci(4)</a>
handling of i/o's that are exact multiples of the max packet size.
<li>Bumped <a href="https://man.openbsd.org/nvme.4">nvme(4)</a>
maximum physio i/o size to 128K.
<li>Fixed probing of modern <a href="https://man.openbsd.org/scsi.4">scsi(4)</a>
devices to ignore the SYNC and WIDE flags used by parallel SCSI.
</ul>
<li>Removed hardware support
<ul>
<li>Removed the rtfps(4) driver, a multiplexing serial communications interface for IBM RT PC boards
<li>Removed the dpt(4) driver for DPT EATA SCSI RAID.
<li>Removed gpr(4), a driver for GemPlus GPR400 PCMCIA smartcard readers.
<li>Removed mesh(4), a driver for old world Apple Power Macintosh SCSI cards.
</ul>
<li>Improvements in audio drivers and the
<a href="https://man.openbsd.org/sndio">sndio(7)</a> framework:
<ul>
<li>Introduced the <a
href="https://man.openbsd.org/sioctl_open">sioctl_open(3)</a>
API to manipulate audio controls exposed by <a
href="https://man.openbsd.org/sndiod">sndiod(8)</a>.
<li>Modified <a
href="https://man.openbsd.org/sndiod">sndiod(8)</a> to
use and expose hardware volume controls if available.
<li>Modified all ports manipulating audio controls to use <a
href="https://man.openbsd.org/sndio">sndio(7)</a> instead of the
kernel <a href="https://man.openbsd.org/OpenBSD-6.6/mixer">mixer(4)</a> interface.
<li>Introduced the <a
href="https://man.openbsd.org/sndioctl">sndioctl(1)</a> utility to
manipulate audio controls exposed by <a
href="https://man.openbsd.org/sndiod">sndiod(8)</a>.
<li>Exposed the first 4 <a
href="https://man.openbsd.org/audio">audio(4)</a> devices
and the first 8 <a
href="https://man.openbsd.org/midi">midi(4)</a> devices through <a
href="https://man.openbsd.org/sndiod">sndiod(8)</a> by default.
<li>Disabled access for regular users to /dev/audio* and
/dev/rmidi*, for improved security.
<li>Modified <a
href="https://man.openbsd.org/mixerctl">mixerctl(1)</a> to use
/dev/audioctl* instead of /dev/mixer*.
<li>Removed /dev/mixer*
<li>Fixed support for <a
href="https://man.openbsd.org/uaudio">uaudio(4)</a>
devices with different recording and playback rate sets.
<li>Fixed volume control of many <a
href="https://man.openbsd.org/uaudio">uaudio(4)</a>
devices.
<li>Fixed channel duplication (-j option) in <a
href="https://man.openbsd.org/sndiod">sndiod(8)</a>.
<li>Allowed <a href="https://man.openbsd.org/rc.d">rc.d(8)</a>
script to reload <a
href="https://man.openbsd.org/sndiod">sndiod(8)</a>.
<li>Added an <a
href="https://man.openbsd.org/azalia">azalia(4)</a> quirk for the
ALC285 on the X1C7 to avoid a clicking noise on the headphone output.
<li>Disabled MSI for the AMD Hudson2 <a
href="https://man.openbsd.org/azalia">azalia(4)</a> HDA to fix random lock ups.
</ul>
<li>A large number of drivers were written to improve <a href="https://www.openbsd.org/arm64.html">arm64</a>
and <a href="https://www.openbsd.org/armv7.html">armv7</a> hardware support, including:
<ul>
<li>Better hardware support for the i.MX8MM platform.
<li>Support for the Raspberry Pi 4 on arm64.
<li>Better support for the Raspberry Pi 3 on arm64.
<li>Proper support for the Raspberry Pi 2 and 3 on armv7.
<li>Better support for Rockchip based systems, especially the Pinebook Pro.
<li>Switched USB to use non-coherent buffers for data transfers, dramatically improving performance on some ARM SoCs where the USB controller is not coherent with the caches.
<li>Allowed switching to framebuffer "glass" console on armv7 in the bootloader, mirroring previous changes to arm64.
<li>Corrected cache flush operations on arm64 which were being incorrectly treated as write operations. This fixes a bug where cache flushing caused Firefox to abort.
<li>Added the capability for armv7 boot from another block device than the one from which efiboot was loaded.
<br><br>
Specifically the following device drivers were added or fixed:
<li>Added <a href="https://man.openbsd.org/bcmbsc">bcmbsc(4)</a>, a driver for the Broadcom Serial Control (BSC) controller.
<li>Added <a href="https://man.openbsd.org/bcmgpio">bcmgpio(4)</a>, a driver for the Broadcom BCM283x GPIO controller.
<li>Added <a href="https://man.openbsd.org/bcmsdhost">bcmsdhost(4)</a>, a driver for the Broadcom "sdhost" SD controller found on the Raspberry Pi.
<li>Added <a href="https://man.openbsd.org/bcmdmac">bcmdmac(4)</a>, a driver for the DMA controller found on BCM283x SoCs.
<li>Added support for the additional <a href="https://man.openbsd.org/sdhc">sdhc(4)</a> controller found on the Raspberry Pi.
<li>Added quirks for the <a href="https://man.openbsd.org/sdhc">sdhc(4)</a> controller on the Raspberry Pi, providing microSD card or WiFi support depending on the firmware configuration.
<li>Added support for hardware with <a href="https://man.openbsd.org/sdhc">sdhc(4)</a> controllers on busses only supporting 32-bit access.
<li>Added <a href="https://man.openbsd.org/bcmirng">bcmirng(4)</a>, a driver for the RNG200 random number generator found on the Raspberry Pi 4.
<li>Added <a href="https://man.openbsd.org/bcmclock">bcmclock(4)</a>, a driver for the BCM283X CPRMAN clock controller.
<li>Added <a href="https://man.openbsd.org/bcmmbox">bcmmbox(4)</a>, a driver for the VideoCore messagebox interface on BCM283X.
<li>Added <a href="https://man.openbsd.org/bcmpcie">bcmpcie(4)</a>, a driver for the PCIe controller found on the Raspberry Pi 4.
<li>Added <a href="https://man.openbsd.org/bse">bse(4)</a>, a driver for the Broadcom GENET v5 network interface found on the Raspberry Pi 4.
<li>Added <a href="https://man.openbsd.org/brgphy">brgphy(4)</a> support for the Broadcom BCM54210E.
<li>Added support for the Armada 3720 CPU clock to <a href="https://man.openbsd.org/mvclock">mvclock(4)</a>.
<li>Fixed address filter in <a href="https://man.openbsd.org/mvneta">mvneta(4)</a>.
<li>Added <a href="https://man.openbsd.org/omcm">omcm(4)</a>, <a href="https://man.openbsd.org/omclock">omclock(4)</a> and <a href="https://man.openbsd.org/omsysc">omsysc(4)</a> drivers that support the new bus structure used in current mainline Linux device trees.
<li>Added <a href="https://man.openbsd.org/omrng">omrng(4)</a>, a driver for the random number generator found on TI OMAP SoCs.
<li>Fixed the MAC address on Pandaboard-ES by increasing <a href="https://man.openbsd.org/smsc">smsc(4)</a> buffer size used to fetch device tree properties.
<li>Added support for additional Allwinner A80 clocks and resets in <a href="https://man.openbsd.org/sxiccmu">sxiccmu(4)</a>.
<li>Fixed <a href="https://man.openbsd.org/amlpciephy">amlpciephy(4)</a> USB3 support when USB has not been initialized by U-Boot.
<li>Added clock support for i.MX8MM.
<li>Fixed CPU frequency scaling support on the Librem5 Devkit.
<li>Added <a href="https://man.openbsd.org/imxpwm">imxpwm(4)</a>, a driver for the PWM controller found on various NXP i.MX SoCs.
<li>Added support for reading the i.MX8MM temperature sensors to <a href="https://man.openbsd.org/imxtmu">imxtmu(4)</a>.
<li>Added <a href="https://man.openbsd.org/bdpmic">bdpmic(4)</a>, a driver for the ROHM BD71837 and BD71847 Power Management IC.
<li>Allowed <a href="https://man.openbsd.org/ipmi">ipmi(4)</a> to attach using mmio.
<li>Added <a href="https://man.openbsd.org/rkrng">rkrng(4)</a>, a driver for the random number generator found on various Rockchip SoCs.
<li>Added glass console support to <a href="https://man.openbsd.org/rkdrm">rkdrm(4)</a> in Rockchip SoCs, including kernel modesetting support.
<li>Added <a href="https://man.openbsd.org/rkdrm">rkdrm(4)</a>, a driver providing kernel mode setting (KMS) functionality for the graphics hardware integrated on Rockchip SoCs.
<li>Added <a href="https://man.openbsd.org/rkdwhdmi">rkdwhdmi(4)</a>, a driver for the HDMI transmitter found on the Rockchip RK3399 SoC.
<li>Added <a href="https://man.openbsd.org/rkanxdp">rkanxdp(4)</a>, a driver for the Analogix Display Port controller on the RK3399.
<li>Added <a href="https://man.openbsd.org/rkvop">rkvop(4)</a>, a driver for the RK3399's Video Output Processors.
<li>Added <a href="https://man.openbsd.org/rkpwm">rkpwm(4)</a>, a driver for the RK3399's PWM controller.
<li>Added <a href="https://man.openbsd.org/rkemmcphy">rkemmcphy(4)</a>, a driver for the RK3399's eMMC PHY.
<li>Added support for gen2 negotiation to <a href="https://man.openbsd.org/rkpcie">rkpcie(4)</a> and enabled gen2 link state training when the dtb is configured with max-link-speed = 2.
<li>Enabled backlight control use on the Pinebook Pro via <a href="https://man.openbsd.org/wsconsctl">wsconsctl(8)</a>.
<li>Fixed the Pinebook Pro's trackpad by ensuring only hid_input items are accepted when walking the HID descriptor.
<li>Fixed <a href="https://man.openbsd.org/pwmbl">pwmbl(4)</a> attachment on the Pinebook Pro.
<li>Added <a href="https://man.openbsd.org/simplepanel">simplepanel(4)</a>, a driver for simple display panels such as the one found on the Pinebook Pro.
<li>Recognized BCM4345 rev 9 as shipped with the Pinebook Pro as an AMPAK AP6256 module in <a href="https://man.openbsd.org/bwfm">bwfm(4)</a>.
<li>Improved <a href="https://man.openbsd.org/bwfm">bwfm(4)</a> on the Pinebook Pro by acking SDIO interrupts earlier on <a href="https://man.openbsd.org/dwmmc">dwmmc(4)</a>.
<li>Added <a href="https://man.openbsd.org/amltemp">amltemp(4)</a>, a driver for the temperature sensors on various Amlogic SoCs.
<li>Added <a href="https://man.openbsd.org/pwmfan">pwmfan(4)</a>, a driver for PWM-regulated fans.
<li>Enabled <a href="https://man.openbsd.org/umt">umt(4)</a> (USB HID multitouch touchpad devices) on arm64.
</ul>
<li>IEEE 802.11 wireless stack improvements and bugfixes:
<ul>
<li>Stop connecting to any available unencrypted wifi networks when an
interface is marked up. This behavior must now be explicitly enabled
with <code><a href="https://man.openbsd.org/ifconfig">ifconfig(8)</a> join
""</code>.
<li>A background scan is now triggered when root runs the <a
href="https://man.openbsd.org/ifconfig">ifconfig(8)</a> scan command.
This updates the list of cached APs displayed by the scan command and
forces a search for a better AP to roam to.
<li>Add <code>nwflag nomimo</code> which can be set with <a
href="https://man.openbsd.org/ifconfig">ifconfig(8)</a> to work
around packet loss in 11n mode if the wireless network device has
unused antenna connectors.
<li>Increased the net80211 node cache size to allow more APs to be viewed during scans.
<li>Fixed the <a
href="https://man.openbsd.org/ifconfig">ifconfig(8)</a> "media:" line
displayed during and after a background scan in 11n mode.
<li>Made background scans less frequent if they keep choosing the same AP.
<li>Fix kernel crashes in net80211 hostap mode due to mbuf corruption
which occurred if a relatively long SSID was configured.
<li>Added support for active scanning to <a
href="https://man.openbsd.org/bwfm">bwfm(4)</a>.
<li>Fix <a href="https://man.openbsd.org/bwfm">bwfm(4)</a> behavior which
could trigger the ifq pressure drop mechanism under moderate load.
<li>Improved error handling for <a
href="https://man.openbsd.org/bwfm">bwfm(4)</a> connection attempts.
<li>Improved automatic switching between wifi networks by lowering the priority
of networks in the <a
href="https://man.openbsd.org/ifconfig">ifconfig(8)</a> join list which
fail to connect.
<li>Avoid repeated switching between APs in areas where APs
are tuned for low transmit range.
<li>Raised net80211's "beacon miss" threshold to avoid frequent
reconnects under conditions which cause loss of beacons.
<li>Reduced stalls on packet loss in 11n mode by improving net80211 handling
of the Rx block ack sequence number window and queue.
<li>Fixed a bug where outstanding frames on the <a
href="https://man.openbsd.org/iwn">iwn(4)</a> aggregation queue
interfered with roaming to another AP.
<li>Fixed a race condition in <a
href="https://man.openbsd.org/iwm">iwm(4)</a> Rx interrupt handling.
<li>Implemented a workaround for missing Tx completion interrupts
in <a href="https://man.openbsd.org/iwm">iwm(4)</a> which could lead
to failures when roaming to another AP.
<li>Re-enabled firmware-based Tx retries at lower rates for <a
href="https://man.openbsd.org/iwm">iwm(4)</a>, reducing packet loss.
<li>Fixed automatic Tx rate control issues in <a
href="https://man.openbsd.org/iwm">iwn(4)</a>, and <a
href="https://man.openbsd.org/iwm">iwm(4)</a>.
<li>Fixed a use-after-free that caused a kernel crash during <a
href="https://man.openbsd.org/zyd">zyd(4)</a> device detach.
</ul>
<li>Generic network stack improvements and bugfixes:
<ul>
<li>Fixed a panic when using <a href="https://man.openbsd.org/pppac">
pppac(4)</a> without <a href="https://man.openbsd.org/pipex">pipex(4)</a>.
<li>Fixed a "route contains no arp information" bug where a kernel routing
table entry was incorrectly deleted upon insertion of a new entry.
<li>Stopped processing packets under non-exclusive netlock, preventing
concurrency in the socket layer.
<li>Prevented data corruption on UDP receive socket buffers by grabbing the
exclusive NET_LOCK() in the softnet thread.
<li>Fixed a kernel crash due to unlimited recursion caused by
local outbound UDP broadcast/multicast packets sent by a spliced
socket.
<li>Added IPv6 support to <a href="https://man.openbsd.org/umb">umb(4)</a>.
<li>Added support for very old firmware umsm devices with <a
href="https://man.openbsd.org/umsm">umsm(4)</a> rather than <a
href="https://man.openbsd.org/umb">umb(4)</a>.
<li>Added <a href="https://man.openbsd.org/pppac">pppac(4)</a>
code for a dedicated PPP Access Concentrator interface and switched <a
href="https://man.openbsd.org/npppd.conf">npppd.conf(5)</a> to use <a
href="https://man.openbsd.org/pppac">pppac(4)</a> instead of <a
href="https://man.openbsd.org/tun">tun(4)</a>.
<li>Added a check when IP forwarding is disabled to ensure packet
destination address matches interface address.
<li>Fixed kernel crash in pf_ioctl with WITH_PF_LOCK and NET_TASKQ > 1.
<li>Ensured proper kernel stack alignment on mips64, fixing a
panic on octeon related to <a
href="https://man.openbsd.org/pppoe">pppoe(4)</a>.
<li>Added <a href="https://man.openbsd.org/rge">rge(4)</a>, a new
driver for Realtek 8125 PCI Express 2.5Gb ethernet devices.
<li>Repaired the "set delay" option for <a
href="https://man.openbsd.org/pf">pf(4)</a> to function as specified
in <a href="https://man.openbsd.org/pf.conf">pf.conf(5)</a>.
<li>Prevented non-root users from using <a
href="https://man.openbsd.org/ioctl">ioctl(2)</a> to alter the address
of a network interface.
<li>Prevented non-root users from setting the parameters of <a
href="https://man.openbsd.org/pppoe">pppoe(4)</a> interfaces.
<li>Removed mobileip(4).
<li>Stopped checking whether the IPv6 source address of a neighbor
advertisement is from a neighbor's address, not required in accordance
with RFC 4861.
</ul>
<li>Installer improvements:
<ul>
<li>Simplified <a
href="https://man.openbsd.org/sysupgrade">sysupgrade(8)</a> directory
check and creation (/home/_syspatch). It can now be a symlink.
<li>Printed the URL when <a
href="https://man.openbsd.org/sysupgrade">sysupgrade(8)</a> fetches
new sets.
<li>Added an opportunistic run of <a
href="https://man.openbsd.org/fw_update">fw_update(1)</a> to <a
href="https://man.openbsd.org/sysupgrade">sysupgrade(8)</a> before
rebooting to run the upgrade.
</ul>
<li>Security improvements:
<ul>
<li><a href="https://man.openbsd.org/unveil.2">unveil(2)</a> is
now used in 82 userland programs to redact filesystem access.
<li>Used <a href="https://man.openbsd.org/unveil">unveil(2)</a> to
reduce filesystem access in <a
href="https://man.openbsd.org/vmstat">vmstat(8)</a>, <a
href="https://man.openbsd.org/iostat">iostat(8)</a> and <a
href="https://man.openbsd.org/systat">systat(1)</a>.
<!-- dig -->
<li>Extracted <a href="https://man.openbsd.org/dig">dig(1)</a>, <a
href="https://man.openbsd.org/host">host(1)</a> and <a
href="https://man.openbsd.org/nslookup">nslookup(1)</a> from the
bind(8) source code and cleaned up the source code by removing not
needed features and auditing it. The kernel API accessible to these
programs is now restricted through <a
href="https://man.openbsd.org/pledge">pledge(2)</a>.
<li>System calls may now only be performed from selected code regions:
the main program, <a href="https://man.openbsd.org/ld.so">ld.so(1)</a>,
libc.so and the signal trampoline. A new system call
<a href="https://man.openbsd.org/msyscall">msyscall(2)</a> indicates
the libc range, and activates the locking. This change hardens
against some attack methods.
<li>Prevented stack trace saving from inspecting untrusted data on
amd64, arm64 and i386.
<li>Used lfence in place of stac/clac on pre-SMAP CPUs to protect
against Load-Value-Injection attacks against the kernel.
<li>Prevented a panic due to missing <a
href="https://man.openbsd.org/sysctl">sysctl(2)</a> input validation.
<li>Injected failure to fetch entropy with an rdrand() timeout as
an entropic event, along with an additional rdtsc measuring the vmexit
latency.
<li>Enforced that <a href="https://man.openbsd.org/ksh">ksh(1)</a>
TMOUT is an integer literal to prevent command execution from the
environment at shell initialization time.
<li>Ensured the first 2MB page of the amd64 kernel is correctly
mapped read-only in the direct map.
<li>Addressed an armv7/arm64 speculative execution issue by changing the
system call ABI to skip two instructions and inserting a barrier
after each system call.
<li>Fixed arm64 speculative execution of instructions after ERET,
which had led to spectre-like effects on some processors.
<li>Tightened permissions for USB device nodes.
<li>Ensured that <a
href="https://man.openbsd.org/ld.so">ld.so(1)</a> removed the
LD_LIBRARY_PATH environment variable for set-user-ID and set-group-ID
executables in low memory conditions.
<li>Added support for RSA-PSS to <a
href="https://man.openbsd.org/crypto">crypto(3)</a>.
<li>Added retguard for octeon/mips64.
<li>The following security bugs were addressed:
<ul>
<li>Reset the login class each time through the loop when using -L
(loop) mode with <a href="https://man.openbsd.org/su">su(1)</a>. Fixes
CVE-2019-19519.
<li>Fixed insufficient username validation performed by libc's
authentication privilege separation layer and added additional
validation points, further validating in <a
href="https://man.openbsd.org/login">login(1)</a> and <a
href="https://man.openbsd.org/su">su(1)</a>.
<li>Prevented escalation to the auth group in <a
href="https://man.openbsd.org/xlock">xlock(1)</a> through path-related
environment variables and disabled mesa and opengl functionality.
</ul>
</ul>
<li>Routing daemons and other userland network improvements:
<ul>
<!-- bgpd -->
<li>Add initial support for JSON output in
<a href="https://man.openbsd.org/bgpctl">bgpctl(8)</a>.
<li>Allow setting both IPv4 and IPv6 local-addresses at the same time in
<a href="https://man.openbsd.org/bgpd.conf">bgpd.conf(5)</a> group
blocks. Introduced <code>no local-address</code> to reset a previously
set local address.
<li>Properly aggregate duplicate <a href="https://man.openbsd.org/bgpd">
bgpd(8)</a> roa table prefix/source-as combinations into a single entry
with the longest maxlen length.
<li>Implemented <a
href="https://man.openbsd.org/bgpd.conf">bgpd.conf(5)</a>
<code>max-prefix NUM out</code> to limit the number of announced
prefixes, avoiding leaks of full tables to upstreams and peers.
<li>Extended <a href="https://man.openbsd.org/bgpctl">bgpctl(8)</a>
<code>show neighbor</code> to include the received and set prefix
count, as well as the max-prefix out limit if set.
<li>Improved reporting of notifications to include the suberror cause.
<li>Also report the last received error cause in
<a href="https://man.openbsd.org/bgpctl">bgpctl(8)</a> <code>show
neighbor</code> output.
<li>Fix softreconfig out handling to also work for neighbors using
<code>export default-route</code>.
<li>Mark stale prefixes in the Adj-RIB-Out so that graceful reload
operates properly.
<!-- OSPF -->
<li>Allowed configuration of the <a
href="https://man.openbsd.org/ospfd">ospfd(8)</a> interface setting
"type p2p" to be configured globally or per area.
<li>Added point-to-point <a
href="https://man.openbsd.org/ospf6d">ospf6d(8)</a> support for
broadcast interfaces.
<!-- other daemons -->
<li>Validated authentication lengths in <a
href="https://man.openbsd.org/ripd">ripd(8)</a> before use to prevent
crashes.
<li>Fixed empty response packages sent out by <a
href="https://man.openbsd.org/ripd">ripd(8)</a> when entries are
skipped due to split-horizon simple.
<li>Reduced temporary address valid lifetime to 2 days in <a
href="https://man.openbsd.org/slaacd">slaacd(8)</a>.
<li>Made <a href="https://man.openbsd.org/slaacd">slaacd(8)</a>
honor the rdomain in which it runs when configuring the default route.
<li>Withdrew all proposals on <a
href="https://man.openbsd.org/slaacd">slaacd(8)</a> startup to prevent
indefinite retention of nameservers on interfaces no longer flagged
for autoconf.
<li>Modified <a href="https://man.openbsd.org/ldpd">ldpd(8)</a> to
lookup the adjacency by LSR id as well as source IP address, as the
remote peer may change its LSR id.
<!-- other programs -->
<li>Added support for printing RFC 2332 NBMA Next Hop Resolution Protocol
(NHRP) to <a href="https://man.openbsd.org/tcpdump">tcpdump(8)</a>.
<li>Added <a href="https://man.openbsd.org/tcpdump">tcpdump(8)</a>
support for printing RFC 8300 Network Service Header (NSH).
<li>Added <a href="https://man.openbsd.org/tcpdump">tcpdump(8)</a>
support for VXLAN-GPE.
<li>Fixed a <a href="https://man.openbsd.org/tcpdump">tcpdump(8)</a>
crash when printing the contents of a malformed packet where the
packet length was smaller than the size of the usbpcap header.
<li>Rewrote dhcpv6 parsing in <a
href="https://man.openbsd.org/tcpdump">tcpdump(8)</a> to match the
RFC, correctly handling dhcpv6 messages.
<li>Accept netmask for IPv6 in <a
href="https://man.openbsd.org/ifconfig">ifconfig(8)</a> instead of
ignoring it and using only the prefixlen argument.
<li>Fixed <a href="https://man.openbsd.org/snmp">snmp(1)</a> agent
address parsing to allow IPv6 addresses to be used based on format,
allow those without brackets to skip the port if it results in a
nonsensical address (allowing use of ::1), and try to connect to the
address immediately.
<li>Implemented a df subcommand for <a
href="https://man.openbsd.org/snmp">snmp(1)</a> which outputs disk and
memory information in a <a href="https://man.openbsd.org/df">df(1)</a>
format.
<li>Implemented a -Cs option in <a
href="https://man.openbsd.org/snmp">snmp(1)</a> for snmp walk and
bulkwalk, allowing subsections of a tree to be skipped.
<li>Introduced option filter-pf-addresses to <a
href="https://man.openbsd.org/snmpd.conf">snmpd.conf(5)</a>, allowing
the OPENBSD-PF-MIB::pfTblAddrTable tree to be filtered out when many
prefixes are stored in pf tables, reducing CPU usage during bulk
walks.
<li>Added retries and timeouts for test packets to <a
href="https://man.openbsd.org/radiusctl">radiusctl(8)</a>.
<li>Corrected http auth combined with proxy auth in <a
href="https://man.openbsd.org/ftp">ftp(1)</a>.
<li>Corrected <a href="https://man.openbsd.org/ftp">ftp(1)</a>
access to an https server with user/password through the "http_proxy"
environment variable.
<li>Prevented <a href="https://man.openbsd.org/ftp">ftp(1)</a>
from following remote redirects to local files.
<li>Implemented HTTP/1.1 in <a href="https://man.openbsd.org/ftp">ftp(1)</a>.
<li>Added new -N name option to <a
href="https://man.openbsd.org/ftp">ftp(1)</a>, allowing calling
scripts to change the progname and produce better error messages.
<li>Allowed <a href="https://man.openbsd.org/pfctl">pfctl(8)</a>
to recursively flush rules and tables.
<li>In <a href="https://man.openbsd.org/pf">pf(4)</a>, ensured
rdr-to with loopback destination will work even when IP forwarding is
disabled.
<!-- rpki-client -->
<li>Enabled <a
href="https://man.openbsd.org/rpki-client">rpki-client(8)</a>, a free,
easy-to-use implementation of the Resource Public Key Infrastructure
(RPKI) for Relying Parties (RP) to facilitate validation of the Route
Origin of a BGP announcement. The program queries the RPKI repository
system and outputs Validated ROA Payloads in the configuration format
of OpenBGPD, BIRD, and also as CSV or JSON objects for consumption by
other routing stacks.
<li>Modified root's <a
href="https://man.openbsd.org/crontab">crontab(1)</a> to run <a
href="https://man.openbsd.org/rpki-client">rpki-client(8)</a> and
reload <a href="https://man.openbsd.org/bgpd">bgpd(8)</a>
configuration, enabling RPKI ROA filtering.
<li>Stopped hardcoding the cache directory in <a
href="https://man.openbsd.org/rpki-client">rpki-client(8)</a>. Cache
and output directory will use defaults for root users and must be
specified by non-root users.
<li>Made <a
href="https://man.openbsd.org/rpki-client">rpki-client(8)</a> use
the existing cache and not exit if rsync(1) exits non-zero.
<li>Fixed <a
href="https://man.openbsd.org/rpki-client">rpki-client(8)</a> -j
option, which had not been producing any output.
<li>Rewrote the time validity check for mtfs in <a
href="https://man.openbsd.org/rpki-client">rpki-client(8)</a> to
correctly account for the timezone.
<li>Added <a
href="https://man.openbsd.org/rpki-client">rpki-client(8)</a> output
formats for the BIRD routing daemon and CSV.
<li>For BIRD <a
href="https://man.openbsd.org/rpki-client">rpki-client(8)</a> can
generate three different output formats with the option
<code>-B</code>: v1 with IPv4 and IPv6 routes, and v2.
</ul>
<li><a href="https://man.openbsd.org/unwind">unwind(8)</a> improvements:
<ul>
<li>Implemented <a
href="https://man.openbsd.org/unwindctl">unwindctl(8)</a> status
memory to show cache memory usage.
<li>Allowed forcing specific domains to be resolved by specific
resolvers in <a
href="https://man.openbsd.org/unwind.conf">unwind.conf(5)</a>,
handling typical split-horizon setups.
<li>Measured performance of resolving strategies in <a
href="https://man.openbsd.org/unwind">unwind(8)</a>, sorting them and
choosing the next best strategy when one fails.
Performance data decays over time.
<li>Switched captive portal detection from HTTP probing to DNS probing in <a
href="https://man.openbsd.org/unwind">unwind(8)</a>.
<li>Implemented DNS proposals in <a
href="https://man.openbsd.org/unwind">unwind(8)</a> to learn
nameservers from network autoconfiguration daemons.
<li>Added opportunistic DoT support to <a
href="https://man.openbsd.org/unwind">unwind(8)</a>.
<li>Added an ASR resolver type to <a
href="https://man.openbsd.org/unwind">unwind(8)</a>, using the libc
asynchronous resolver directly with DHCP-provided nameservers to work
around broken middle boxes.
</ul>
<li><a href="https://man.openbsd.org/ipsec">ipsec(4)</a> improvements and
bugfixes:
<ul>
<li>Added support for automatically moving traffic between
rdomains on <a href="https://man.openbsd.org/ipsec">ipsec(4)</a>
encryption or decryption, reducing the attack surface for network
sidechannel attacks.
<li>Added <a href="https://man.openbsd.org/iked">iked(8)</a>
support for switching rdomain on <a
href="https://man.openbsd.org/ipsec">ipsec(4)</a>
encryption/decryption, configurable per policy with the new
'rdomain' option in <a
href="https://man.openbsd.org/iked.conf">iked.conf(5)</a>.
<li>Changed the default ipsec level set by <a
href="https://man.openbsd.org/iked">iked(8)</a> and <a
href="https://man.openbsd.org/isakmpd">isakmpd(8)</a> to
IPSEC_LEVEL_REQUIRE. Unencrypted packets matching incoming
ipsec flows are no longer accepted by default.
<li>Added curve25519, ecp256, ecp384, ecp521, modp3072 and modp4096 to
the default Diffie-Hellman group configuration for IKE SAs in
<a href="https://man.openbsd.org/iked">iked(8)</a>.
<li>Removed support for the insecure EC2N Diffie-Hellman groups in <a
href="https://man.openbsd.org/iked">iked(8)</a>.
<li>Changed the default authentication method in <a
href="https://man.openbsd.org/iked">iked(8)</a> to
generic signature authentication (RFC 7427).
<li>Added ESN configuration options for ikesa in <a
href="https://man.openbsd.org/iked.conf">iked.conf(5)</a>.
<li>Added transport mode for child SAs to <a
href="https://man.openbsd.org/iked">iked(8)</a>.
<li>Added active probing for lost connection in <a
href="https://man.openbsd.org/iked">iked(8)</a> resulting in a
faster connection reset.
<li>Added a -p command line option to <a
href="https://man.openbsd.org/iked">iked(8)</a> allow configuration
of a non-standard UDP encapsulation port.
<li>Added support for multiple X.509 extensions and multiple
subjectAltName fields in certificates used with <a
href="https://man.openbsd.org/iked">iked(8)</a>.
<li>Added support for certificates with uppercase subjectAltNames
in <a href="https://man.openbsd.org/iked">iked(8)</a>.
<li>Removed automatically installed <a
href="https://man.openbsd.org/ipsec">ipsec(4)</a> flow blocking
unencrypted IPv6 traffic in <a
href="https://man.openbsd.org/iked">iked(8)</a>.
<li>Reduced size of IKE_AUTH message by eliminating duplicate traffic
selectors in <a href="https://man.openbsd.org/iked">iked(8)</a>.
<li>Added an <a
href="https://man.openbsd.org/ikectl">ikectl(8)</a> "show sa"
command to print information about the state of negotiated IKE SAs,
their child SAs and the resulting IPsec flows.
<li>Added an <a
href="https://man.openbsd.org/ikectl">ikectl(8)</a> "reset id"
command to reset all SAs from policies with matching destination IDs.
<li>Added support for UDP encapsulation in manual SAs set up with <a
href="https://man.openbsd.org/ipsec.conf">ipsec.conf(5)</a>.
<li>Fixed an <a href="https://man.openbsd.org/iked">iked(8)</a>
bug that lead to connection loss after simultaneous rekeying.
<li>Fixed an <a href="https://man.openbsd.org/iked">iked(8)</a>
public key leak in the CA process for ASN-DN IDs.
<li>Fixed a bug that lead to a lost EAP ID after rekeying in <a
href="https://man.openbsd.org/iked">iked(8)</a>.
<li>Fixed EAP user database corruption resulting from use of the <a
href="https://man.openbsd.org/ikectl">ikectl(8)</a> reload command.
<li>Corrected <a href="https://man.openbsd.org/iked">iked(8)</a>
calculation of IPv6 address leases from small address pools.
<li>Fixed several bugs that could lead to <a
href="https://man.openbsd.org/iked">iked(8)</a> selecting a false policy
for incoming requests, resulting in a failed handshake.
<li>Fixed a bug that broke PSK authentication against Strongswan.
<li>Enabled UDP-encapsulation in Child SAs if <a
href="https://man.openbsd.org/iked">iked(8)</a> was started with -t.
<li>Fixed <a href="https://man.openbsd.org/isakmpd">isakmpd(8)</a>
IKE pcap file creation.
</ul>
<li><a href="https://man.openbsd.org/tmux">tmux(1)</a> improvements and bug fixes:
<ul>
<li>Indicated the marked pane in <a
href="https://man.openbsd.org/tmux">tmux(1)</a> choose mode in
reverse, and added keys to set (m) and clear it (M), and to jump to
the starting pane (H).
<li>Allowed <a href="https://man.openbsd.org/tmux">tmux(1)</a>
main-pane-width and height to be specified as percentages.
<li>Added a -f filter argument to the <a
href="https://man.openbsd.org/tmux">tmux(1)</a> list commands like
choose-tree.
<li>Added an -s flag to <a
href="https://man.openbsd.org/tmux">tmux(1)</a> copy-mode to specify a
different pane for the source content.
<li>Added a -T flag to <a
href="https://man.openbsd.org/tmux">tmux(1)</a> resize-pane to trim
lines below the cursor.
<li>Added support for <a
href="https://man.openbsd.org/tmux">tmux(1)</a> overlay popup boxes,
created with the display-popup command.
<li>Added a <a href="https://man.openbsd.org/tmux">tmux(1)</a> -d
flag to run-shell to wait for delay before running the command (or
delay with no command).
<li>Added a <a href="https://man.openbsd.org/tmux">tmux(1)</a>
copy-mode -H flag to hide the position marker in the top right.
<li>Added <a href="https://man.openbsd.org/tmux">tmux(1)</a> C-g
to cancel command prompt with <a
href="https://man.openbsd.org/vi">vi(1)</a> keys as well as emacs, and
q in command mode.
<li>Modified <a href="https://man.openbsd.org/tmux">tmux(1)</a> -S
server socket to be created with umask 177 rather than 117.
<li>Introduced a <a
href="https://man.openbsd.org/tmux">tmux(1)</a> selection_active
format for when the selection is present but not moving with the
cursor.
<li>Added -a to the list-keys command in <a
href="https://man.openbsd.org/tmux">tmux(1)</a> to also list keys
without notes with -N.
<li>Added <a href="https://man.openbsd.org/tmux">tmux(1)</a> support
for adding a note to a key binding with bind-key -N and using this to
add descriptions to the default key binding. Using list-keys -N shows
key bindings with notes. Changed the default ? binding to show a
readable summary of keys.
<li>Added -Z to the default <a
href="https://man.openbsd.org/tmux">tmux(1)</a> switch-client command
in tree mode.
<li>Prevented read-only <a
href="https://man.openbsd.org/tmux">tmux(1)</a> clients from limiting
the size of other clients.
<li>Added support for regex searches in <a
href="https://man.openbsd.org/tmux">tmux(1)</a> copy mode.
<li>Modified <a href="https://man.openbsd.org/tmux">tmux(1)</a>
source-file to allow reading from stdin.
<li>Added a <a href="https://man.openbsd.org/tmux">tmux(1)</a> p
format modifier for padding to width.
<li>Added -f for full size to join-pane in <a
href="https://man.openbsd.org/tmux">tmux(1)</a>.
<li>Changed <a href="https://man.openbsd.org/tmux">tmux(1)</a>
new-session -A to attach to the best existing session when a session
name is not specified, rather than creating a new session.
<li>Added an option to <a
href="https://man.openbsd.org/tmux">tmux(1)</a> to set the key sent by
backspace for systems using ^H.
<li>Added -F flag to <a
href="https://man.openbsd.org/tmux">tmux(1)</a> send-keys to expand
formats in search-backward and forward copy mode commands.