Repository navigation
Expand file tree
/
Copy path78.html
More file actions
1368 lines (1267 loc) · 59.6 KB
/
Copy path78.html
File metadata and controls
1368 lines (1267 loc) · 59.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!doctype html>
<html lang="en" id="release">
<head>
<meta charset=utf-8>
<title>OpenBSD 7.8</title>
<meta name="description" content="OpenBSD 7.8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" type="text/css" href="openbsd.css">
<link rel="canonical" href="https://www.openbsd.org/78.html">
</head><body>
<h2 id="OpenBSD">
<a href="index.html">
<i>Open</i><b>BSD</b></a>
7.8
</h2>
<table>
<tr>
<td>
<a href="images/Terraodontidae.png">
<img width="200" height="300" src="images/Terraodontidae-s.gif" alt="Terraodontidae"></a>
<td>
Released Oct 22, 2025. (59th OpenBSD release)<br>
Copyright 1997-2025, Theo de Raadt.<br>
<br>
Artwork by Apsephion.
<br>
<ul>
<li>See the information on <a href="ftp.html">the FTP page</a> for
a list of mirror machines.
<li>Go to the <code class=reldir>pub/OpenBSD/7.8/</code> directory on
one of the mirror sites.
<li>Have a look at <a href="errata78.html">the 7.8 errata page</a> for a list
of bugs and workarounds.
<li>See a <a href="plus78.html">detailed log of changes</a> between the
7.7 and 7.8 releases.
<p>
<li><a href="https://man.openbsd.org/signify.1">signify(1)</a>
pubkeys for this release:<p>
<table class=signify>
<tr><td>
openbsd-78-base.pub:
<td>
<a href="https://ftp.openbsd.org/pub/OpenBSD/7.8/openbsd-78-base.pub">
RWS3/nvFmk4SWSmt/5QIk9yB4+uoAGoiYvFhVlDQBG3rWENeeIys0LWB</a><tr><td>
openbsd-78-fw.pub:
<td>
RWSFPOE2F7PQul5Fu/3G/JKMmqJD76vKKQh30UrwSslcMcU5/MEBVqTd
<tr><td>
openbsd-78-pkg.pub:
<td>
RWRdSyJORZBFeOu7a8K3nODBr9GrFJlGZUG2j93jDSds8Zc+NLTP8v60
<tr><td>
openbsd-78-syspatch.pub:
<td>
RWRYSW9gIG/XToA9BM+s+ehGgxdWe0+ZShwt85+/dFXYOZFRUi4uqhiR
</table>
</ul>
<p>
All applicable copyrights and credits are in the src.tar.gz,
sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the
files fetched via <code>ports.tar.gz</code>.
</table>
<hr>
<section id="new">
<h3>What's New</h3>
<p>
This is a partial list of new features and systems included in OpenBSD 7.8.
For a comprehensive list, see the <a href="plus78.html">changelog</a> leading to 7.8.
<p>
<ul>
<li>Platform-specific improvements:
<ul>
<li><a href="arm64.html">arm64</a>:
<ul>
<li>Added support for Raspberry Pi 5 (with console on serial port).
<li>Implement <a href="https://man.openbsd.org/acpicpu.4">acpicpu(4)</a> for arm64.
<li>On Apple variants, enter DDB when exuart detects a BREAK.
<li>On arm64 and riscv64, avoid multiple threads of a process
continuously faulting on a single page when <a
href="https://man.openbsd.org/pmap_enter.9">pmap_enter(9)</a> is asked
to enter a mapping that already exists.
<li>Make apm and <code>hw.cpuspeed</code> work on Snapdragon X Elite
machines.
</ul>
<li><a href="amd64.html">amd64</a>:
<ul>
<li>Fix processing of GPIO events for pin numbers less than 256 with
an _EVT method. Fixes power button on various ThinkPads with AMD CPUs.
</ul>
<li>Other <a href="plat.html">architectures</a>:
<ul>
<li>Added a sparc64-specific _raw flavour to the softintr routines for
those drivers that need to be able to schedule soft interrupts at
actual hardware levels.
</ul>
<li>More platform specific changes can be found in the <a href="#hardware_support">hardware support</a> section below.
</ul>
<li>Various kernel improvements:
<ul>
<li>Set an upper limit on the value of
<a href="https://man.openbsd.org/sysctl.2#KERN_SEMINFO_SEMOPM~2">
sysctl(2) kern.seminfo.semopm</a> to avoid a possible kernel panic.
<li>On arm64, avoid decoding instructions when ELR isn't pointing
into the kernel part of the virtual address space and use fault()
instead of panic() to provide better error reports.
<li>Inherit <code>PS_NOBTCFI</code> at
<a href="https://man.openbsd.org/fork.2">fork(2)</a>
so forked children do not get killed by BTCFI safeguards.
<li>Inherit <code>PS_PROFILE</code> at
<a href="https://man.openbsd.org/fork.2">fork(2)</a>.
This lets child processes
disable/reenable profiling when they deemed appropriate.
<li>Implement the POSIX-2024 close-on-fork flag, but modified to be
reset on exec as preserving it across exec is not necessary for its
original purpose and has security and usability concerns.
<li>Improve handling of lock nesting by <a
href="https://man.openbsd.org/witness.4">witness(4)</a>.
<li>Add MI high-level software interrupt dispatcher, providing a
common subsystem for the high-level allocation, scheduling, and
dispatching of soft interrupts.
<li>Remove the functionality of the <code>fs.posix.setuid</code> sysctl.
<li>Use a FIFO queue for passing dead threads to the reaper,
reducing latency with large numbers of CPUs and jobs.
<li>Skip filesystem mount time update in BOOT kernels to enable
crude timekeeping across reboots without RTC and NTP.
<li>Move the kernel to using nanoseconds for the sleep time argument
instead of ticks. Userland functions don't change but precision is no
longer lost converting nanoseconds into ticks.
<li>Show SEV or SEV-ES guest mode in dmesg when running with AMD SEV.
<li>Support the GHCB protocol for IO and MMIO with SEV-ES.
This makes OpenBSD work with SEV-ES on kvm/qemu in 1-vCPU VMs
<li>Add <a href="https://man.openbsd.org/psp.4">psp(4)</a> <a
href="https://man.openbsd.org/ioctl.2">ioctl(2)</a> to encrypt and
measure state for AMD SEV-ES.
<li>Add <a
href="https://man.openbsd.org/cpu_xcall.9">cpu_xcall(9)</a>, an API
for CPU xcalls (crosscalls), allowing dispatching of code to run on
the specified CPU from an interrupt context.
<li>Add <a href="https://man.openbsd.org/dt.4">dt(4)</a> trace points
to <a href="https://man.openbsd.org/rwlock.9">rwlock(9)</a>.
<li>Teach <a href="https://man.openbsd.org/btrace.8">btrace(8)</a>
how to resolve addresses in callstacks to symbols.
<li>Improve the documentation of <a
href="https://man.openbsd.org/dt.4">dt(4)</a> and <a
href="https://man.openbsd.org/btrace.8">btrace(8)</a>
<li>Improve compatibility of the FUSE filesystem with
the Linux libfuse implementation.
<li>Make it possible to run the upper part of the fault handler in parallel.
<li>Improve mtx_enter() for machines with a huge number of CPUs.
</ul>
<li>Suspend/Hibernate Support:
<ul>
<li>Preallocate hibernate work area during boot to fix failures where the needed region can't be late-allocated.
<li>Implement lid suspend/resume for lids that use a GPIO.
<li>Implement support for wakeup interrupts in <a
href="https://man.openbsd.org/amdgpio.4">amdgpio(4)</a>, making it
possible to resume laptops with AMD CPUs from S0ix suspend.
<li>Introduce a generic powerbutton_event() function that does
everything we expect from a power button event in a consistent manner,
ensuring all drivers now prevent shutdown within the first 10 seconds
after resume.
<li>Implement a <code>ddb.suspend</code> sysctl that will force "S0ix"
suspend and skip suspend of <a
href="https://man.openbsd.org/inteldrm.4">inteldrm(4)</a> and <a
href="https://man.openbsd.org/amdgpu.4">amdgpu(4)</a> such that the
display remains on during suspend.
<li>Fix dead USB ports after suspend/resume on the ThinkPad Z13.
<li>Make <a href="https://man.openbsd.org/amdgpu.4">amdgpu(4)</a> S3 suspend more reliable.
<li>Double the size of the amd64 unhibernate chunk table for machines with large amounts of memory.
</ul>
<li id="SMP_Improvements">SMP Improvements:
<ul>
<li>Up to 8 softnet threads are used to handle network input.
The number of threads is also limited by the number of CPUs.
<li>TCP stack is now running in parallel on multiple CPUs.
Up to 8 threads are used to process TCP traffic.
Note that each connection can only be handled by one CPU.
Use multiple streams and a network interface capable of
multi queue to distribute packets.
<li>IPv6 fragment reassembly is now running in parallel.
<li>IPv6 destination option and routing header parsing is now
running in parallel.
<li>System calls
<a href="https://man.openbsd.org/close.2">close(2)</a> and
<a href="https://man.openbsd.org/listen.2">listen(2)</a>
run without exclusive net lock.
</ul>
<li>Direct Rendering Manager and graphics drivers:
<ul>
<li>Updated <a href="https://man.openbsd.org/drm.4">drm(4)</a>
to Linux 6.12.50.
<li>New <a href="https://man.openbsd.org/qcdrm.4">qcdrm(4)</a>
driver for Qualcomm Snapdragon DRM subsystem.
<li>New <a href="https://man.openbsd.org/qcdpc.4">qcdpc(4)</a>
driver for Qualcomm DisplayPort Controller.
</ul>
<li>VMM/VMD improvements:
<ul>
<li>On AMD processors SEV-ES technology is supported to start
confidential virtual machines.
SEV-ES works with the vmm/vmd hypervisor and with OpenBSD
guests on KVM/qemu.
<li>Add option for <a href="https://man.openbsd.org/vmd.8">vmd(8)</a>
to run guests in AMD SEV-ES mode and keyword "seves" for <a
href="https://man.openbsd.org/vm.conf.5">vm.conf(5)</a> to enable it.
<li>Allow SEV-ES enabled guests to run on <a
href="https://man.openbsd.org/vmm.4">vmm(4)</a>/<a
href="https://man.openbsd.org/vmd.8">vmd(8)</a>.
<li>Make <a href="https://man.openbsd.org/vmctl.8">vmctl(8)</a> show file path in error messages.
<li>Sanitize <a href="https://man.openbsd.org/vmd.8">vmd(8)</a>'s interprocess communication.
<li>Back <a href="https://man.openbsd.org/vmm.4">vmm(4)</a> guest
memory with UVM aobjs, simplifying how guest memory is represented and
managed.
<li>Allow Linux guests to use kvm-clock in <a href="https://man.openbsd.org/vmm.4">vmm(4)</a>.
<li>Remove <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> send & receive functionality.
<li>Prevent <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> guests from reading outside pci config space.
<li>Emulate PKRU XSAVE area and features in <a href="https://man.openbsd.org/vmm.4">vmm(4)</a>.
<li>Update <a href="https://man.openbsd.org/vmd.8">vmd(8)</a>'s
emulated Virtio network, block, entropy, and scsi devices
to support Virtio 1.2 in non-transitional mode.
</ul>
<li>Various new userland features:
<ul>
<li>Switched <a href="https://man.openbsd.org/pkg-config.1">pkg-config(1)</a>
to the widely used C-based pkgconf 2.4.3 due to major performance issues
with the unmaintained homegrown Perl script.
<li>Import IIJ's iwatch as <a href="https://man.openbsd.org/watch.1">watch(1)</a>, a utility to periodically execute a command and display its output.
<li><a href="https://man.openbsd.org/security.8">security(8)</a>
creates backups of GPT/MBR.
<li><a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a>
<code>-R</code> recovers/creates GPT/MBR from a file.
<li><a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a>
interactive editor supports one-line partition addition/modification.
<li>Add [-w percent] and /etc/apm/warnlow hook to <a href="https://man.openbsd.org/apmd.8">apmd(8)</a>.
<li>Introduced a new gprof profiling system using <a
href="https://man.openbsd.org/profil.2">profil(2)</a> system call and
removed the <a
href="https://man.openbsd.org/OpenBSD-7.7/monstartup.3">monstartup(3)</a>
interface.
<li>Add <a href="https://man.openbsd.org/ibufq_new.3">ibufq(3)</a>
API to support multithreaded use of ibufs.
</ul>
<li>More bugfixes and tweaks in userland:
<ul>
<li>As usual, many improvements and corrections in documentation were made.
<li><a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a>
interactive editor displays verbose information if <code>-v</code>
was set.
<li><a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a>
displays GPT partitions in disk offset order with free areas shown.
<li><a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a>
can create GPT partitions with any well formed UUID as the type.
<li>Only GPT partitions with recognized filesystems are
included in the default <a href="https://man.openbsd.org/disklabel.5">disklabel(5)</a>.
<li>Version 0 <a href="https://man.openbsd.org/disklabel.5">disklabel(5)</a>
no longer supported.
<li>Fix a crash in <a href="https://man.openbsd.org/vi.1">vi(1)</a> when executing commands.
<li>Fix <a href="https://man.openbsd.org/vi.1">vi(1)</a> crash with expandtab and running external commands.
<li>Make <a href="https://man.openbsd.org/vi.1">vi(1)</a> 'p' command paste in the correct place.
<li>Improve the
<a href="https://man.openbsd.org/flockfile.3">flockfile(3)</a>
implementation by switching from external
locks to per FILE recursive mutexes.
<li>Do not log OTP secrets in
<a href="https://man.openbsd.org/login_yubikey.8">login_yubikey(8)</a>.
<li>Change <a href="https://man.openbsd.org/gmtime.3">gmtime(3)</a>
to return time in UTC rather than GMT, as
required by our own manpage, POSIX, C standards, and other OSes.
<li>Make <a href="https://man.openbsd.org/exit.3">exit(3)</a>,
<a href="https://man.openbsd.org/fclose.3">fclose(3)</a>,
<a href="https://man.openbsd.org/fflush.3">fflush(3)</a>, and
<a href="https://man.openbsd.org/freopen.3">freopen(3)</a> comply with
POSIX-2008 requirements for setting the underlying file position when
flushing read-mode streams, and make an
<a href="https://man.openbsd.org/fseek.3">fseek(3)</a>-after-<a
href="https://man.openbsd.org/fflush.3">fflush(3)</a> not
change the underlying file position.
<li>FILE is now opaque. Its member representing the file descriptor has been
widened from type short to int.
<li>Improve externs for KEYMAPE(), extern in .c files resulted in the use of a wrongly sized
anonymous struct.
<li>Make <a href="https://man.openbsd.org/bioctl.8">bioctl(8)</a> properly indicate key disk for RAID 1C.
<li>Fix sign of <code>%z</code> output in
<a href="https://man.openbsd.org/zic.8">zic(8)</a>, and add DST offset.
<li>Add <code>-t</code> and <code>-V</code> options from tzcode2013d to
<a href="https://man.openbsd.org/zdump.8">zdump(8)</a>.
<li>Fix an <a href="https://man.openbsd.org/rmdir.1">rmdir(1)</a> bug where "mkdir exampledir; ln -s exampledir examplelink; rmdir examplelink/" didn't remove exampledir like POSIX requires.
<li>Fix a POSIX-violating
<a href="https://man.openbsd.org/grep.1">grep(1)</a> bug where
arguments starting with a hyphen-minus character were misinterpreted
as options even when appearing behind non-option operands.
<li>Improve handling of UTF-8 input in
<a href="https://man.openbsd.org/ksh.1">ksh(1)</a> VI mode
in several ways. This work is not yet complete.
<li>In <a href="https://man.openbsd.org/ksh.1">ksh(1)</a> VI mode, make the
behaviour of "1P" consistent with the behaviour of "2P" such that
both back up to the first byte of the last character inserted.
<li>Make <a href="https://man.openbsd.org/mdoc.7">mdoc(7)</a>
support the input syntax ".Lb libname [...]" with multiple arguments
in the SYNOPSIS.
<li>For better consistency with POSIX and traditional UNIX and BSD
<a href="https://man.openbsd.org/man.1">man(1)</a>, if the
<code>-l</code> option is not specified, never interpret "name"
command line arguments as absolute or relative path names, not
even for arguments that contain a slash and that do not resolve
to a manual page name.
<li>Make <a href="https://man.openbsd.org/sndiod.8">sndiod(8)</a> use
per-program level controls instead of per-client.
<li>Stop <a href="https://man.openbsd.org/tar.1">tar(1)</a> from
exiting silently if the mtime didn't fit in the ustar header when
writing out the extended headers.
<li>Fix memleak in <a
href="https://man.openbsd.org/syslogd.8">syslogd(8)</a> when a client
aborts a TLS connection, and ensure that <a
href="https://man.openbsd.org/syslogd.8">syslogd(8)</a> runs TLS
handshake callback.
<li>Support for embedded PNG bitmaps in Freetype (often used for fonts
with colour emoji).
<li>Backport TearFree page flips for the modesetting driver from X.Org master.
</ul>
<li id="hardware_support">Improved hardware support and driver bugfixes, including:
<ul>
<li>New <a href="https://man.openbsd.org/acpiwmi.4">acpiwmi(4)</a>
driver for Windows Management Instrumentation.
<li>New <a href="https://man.openbsd.org/amdpmc.4">amdpmc(4)</a>
driver for AMD power management controller.
<li>New bcmmip
driver for BCM2712 MSI controller.
<li>New <a href="https://man.openbsd.org/bcmstbgpio.4">bcmstbgpio(4)</a>
driver for Broadcom Set-top Box GPIO controller.
<li>New <a href="https://man.openbsd.org/bcmstbintc.4">bcmstbintc(4)</a>
driver for Broadcom Set-to Box interrupt controller.
<li>New <a href="https://man.openbsd.org/bcmstbpinctrl.4">bcmstbpinctrl(4)</a>
driver for Broadcom Set-top Box pin multiplexing.
<li>New <a href="https://man.openbsd.org/bcmstbrescal.4">bcmstbrescal(4)</a>
driver for Broadcom Set-top Box reset calibration controller.
<li>New <a href="https://man.openbsd.org/bcmstbreset.4">bcmstbreset(4)</a>
driver for Broadcom Set-top Box reset controller.
<li>New <a href="https://man.openbsd.org/arm64/rpone.4">rpone(4)</a>
driver for Raspberry Pi RP1 peripheral controller.
<li>New <a href="https://man.openbsd.org/arm64/rpiclock.4">rpiclock(4)</a>
driver for Raspberry Pi RP1 clock controller.
<li>New <a href="https://man.openbsd.org/arm64/rpipwm.4">rpipwm(4)</a>
driver for Raspberry Pi RP1 PWM controller.
<li>New <a href="https://man.openbsd.org/arm64/rpirtc.4">rpirtc(4)</a>
driver for Raspberry Pi real-time clock.
<li>New <a href="https://man.openbsd.org/iasuskbd.4">iasuskbd(4)</a>
driver for ASUS I2C HID keyboards.
<li>Add support for the SDHC controllers found on the Raspberry Pi 5.
<li>In <a href="https://man.openbsd.org/virtio.4">virtio(4)</a>,
allow to use memory above 4G on amd64 for virtio rings and
descriptors.
<li>Add support for H.264 advanced video coding to
<a href="https://man.openbsd.org/uvideo.4">uvideo(4)</a>.
<li>Prevent a kernel panic in
<a href="https://man.openbsd.org/wsdisplay.4">wsdisplay(4)</a>
when asked to switch VTs during resume.
<li>Avoid a use-after-free in
<a href="https://man.openbsd.org/psp.4">psp(4)</a>.
<li>Do not attach YubiKeys as keyboards anymore in
<a href="https://man.openbsd.org/ukbd.4">ukbd(4)</a>.
This disables the OTP functionality, but makes it easier to use
the FIDO function without the need to configure the YubiKeys
correctly first.
<li>Implement support for "vmmc-supply" in
<a href="https://man.openbsd.org/sdhc.4">sdhc(4)</a>,
needed to power on the WiFi chip on the Raspberry Pi 5.
<li>Add RK3528 support to <a href="https://man.openbsd.org/rkpinctrl.4">rkpinctrl(4)</a>.
<li>Add RK3528 support to <a href="https://man.openbsd.org/rkclock.4">rkclock(4)</a>.
<li>Add RK3528 support to <a href="https://man.openbsd.org/rkusbphy.4">rkusbphy(4)</a>.
<li>Fix and add time sensor to <a href="https://man.openbsd.org/pvclock.4">pvclock(4)</a>.
</ul>
<li>New or improved network hardware support:
<ul>
<li>Make the <a href="https://man.openbsd.org/cad.4">cad(4)</a>
Ethernet interface on the Raspberry Pi 5 work by
configuring the delays for RGMII PHYs correctly.
<li>Add support for the Realtek RTL8125D and RTL8127 chips to the <a
href="https://man.openbsd.org/rge.4">rge(4)</a> driver and update
microcode for RTL8125B.
<li>Add a software implementation of TCP Large Receive Offload to <a
href="https://man.openbsd.org/ixl.4">ixl(4)</a>.
<li>Intel E810 network devices
<a href="https://man.openbsd.org/ice.4">ice(4)</a> are
supported for 100 and 25 GBit in QSFP and SFP variants.
<li>Add support for the ifconfig
<a href="https://man.openbsd.org/ifconfig.8#transceiver">transceiver</a>
command to <a href="https://man.openbsd.org/ice.4">ice(4)</a>.
<li>Add Rx checksum offload and TSO (TCP Segmentation Offload) support to <a
href="https://man.openbsd.org/ice.4">ice(4)</a>.
<li>Enable RSS in <a
href="https://man.openbsd.org/ice.4">ice(4)</a>, and enable Tx/Rx
across multiple queues.
<li>Use SoftLRO in <a href="https://man.openbsd.org/ice.4">ice(4)</a>, but default off.
<li>Add SoftLRO support to <a href="https://man.openbsd.org/bnxt.4">bnxt(4)</a>.
<li>Add support for TSO to <a
href="https://man.openbsd.org/iavf.4">iavf(4)</a>.
<li>Disable <a href="https://man.openbsd.org/hvn.4">hvn(4)</a> TCP
checksum offload, broken on newer hyper-v versions.
<li>Add support for the RTL8157 chipset in <a href="https://man.openbsd.org/ure.4">ure(4)</a>.
</ul>
<li>Added or improved wireless network drivers:
<ul>
<li>Add 802.11n/HT and roaming support to
<a href="https://man.openbsd.org/qwx.4">qwx(4)</a>.
<li>Fix TKIP crypto offload in
<a href="https://man.openbsd.org/qwx.4">qwx(4)</a>.
<li>Fix suspend/resume instability caused by
<a href="https://man.openbsd.org/qwx.4">qwx(4)</a>.
<li>Make WPA handshakes succeed more reliably with the
<a href="https://man.openbsd.org/bwfm.4">bwfm(4)</a> driver.
<li>Unbreak support for a subset of Intel AX210 devices by making
<a href="https://man.openbsd.org/iwx.4">iwx(4)</a> load the
correct firmware image for them.
</ul>
<li>Installer, upgrade, bootloader, and pkg-tools improvements:
<ul>
<!-- installboot -->
<!-- sysupgrade -->
<!-- fw_update -->
<!-- installer proper -->
<li>Add installer preference for disks bigger than 1G as default root disk.
<li>Stop offering http/nfs for offline installation.
<li>Prevent installing a corrupted <code>/bsd</code> on relink errors.
<!-- updates/sysmerge -->
<!-- pkg_ -->
<li>Prevent <a
href="https://man.openbsd.org/pkg_add.1">pkg_add(1)</a> update from
advising file removal appropriate only when deleting packages.
</ul>
<li>Security improvements:
<ul>
<li>Permit <a href="https://man.openbsd.org/setsockopt.2">setsockopt(2)</a>
and <a href="https://man.openbsd.org/getsockopt.2">getsockopt(2)</a>
<code>IPPROTO_IP</code>/<code>IP_TOS</code> and
<code>IPPROTO_IPV6</code>/<code>IPV6_TCLASS</code> in
<a href="https://man.openbsd.org/pledge.2">pledge(2)</a> "stdio".
Previously these were restricted to "inet".
However, setting TOS is low risk and this way a
lot more attack surface from inet can be removed.
<li>Allow low-risk
<a href="https://man.openbsd.org/getsockname.2">getsockname(2)</a> and
<a href="https://man.openbsd.org/getpeername.2">getpeername(2)</a>
in stdio.
<li>Pledge <a
href="https://man.openbsd.org/fc-cache.1">fc-cache(1)</a> and <a
href="https://man.openbsd.org/mkfontscale.1">mkfontscale(1)</a> and
change ownership of the fontconfig cache to the
<code>_fc-cache</code> user to run unprivileged when installing fonts.
<li>Add <code>IPV6_RECVTCLASS</code> to the authorized
<a href="https://man.openbsd.org/setsockopt.2">setsockopt(2)</a>
operations for <code>IPPROTO_IPV6</code> in
<a href="https://man.openbsd.org/pledge.2">pledge(2)</a>
fixing recent chromium browser with IPv6.
<li>Add an MI mechanism for creating an (unmapped) guard page between
the PCB and the kernel stack and enable on 64-bit architectures with
4k pages.
</ul>
<li>New features in the network stack:
<ul>
<li>Stop adding interfaces with blackhole and reject routes to the
egress group, even if a default route points at them.
<li>Some network drivers allow to use soft LRO for TCP.
If the hardware does not support to concatenate received
TCP packets, this can be done at driver level.
As the upper layers handle less packets, performance
improves.
Currently the feature is disabled by default, activate with ifconfig(8)
<a href="https://man.openbsd.org/ifconfig.8#tcplro">tcplro</a>.
Software LRO has been implemented for
<a href="https://man.openbsd.org/bnxt.4">bnxt(4)</a>,
<a href="https://man.openbsd.org/ice.4">ice(4)</a>,
<a href="https://man.openbsd.org/ixl.4">ixl(4)</a>.
<li>New <a href="https://man.openbsd.org/erspan.4">erspan(4)</a>
driver for ERSPAN Type II tunnel networks.
</ul>
<li>Further changes and bugfixes in the network stack:
<ul>
<li>For
<a href="https://man.openbsd.org/divert.4">divert(4)</a>
protocols
<a href="https://man.openbsd.org/sysctl.8">sysctl(8)</a>
knobs have been consolidated.
<li>ARP and ND6 list use iterators to be MP safe.
This also avoids a race when timeouts handled multipath
link layer entries.
<li>TCP keepalive intervals have been fixed.
<li>Do not allow negative values for
<a href="https://man.openbsd.org/sysctl.2">sysctl(2)</a>
<code>net.inet6.ip6.neighborgcthresh</code>, which would disable
the limit ND6 entries, and disallow setting negative values for
<code>net.inet6.ip6.maxdynroutes</code>, which previously allowed
unlimited redirect routes.
<li>Fix error handling in IPv6 multicast sysctl.
<li>Fix refcnt leak in <a href="https://man.openbsd.org/veb.4">veb(4)</a>.
<li>Use VLAN hardware tagging in <a href="https://man.openbsd.org/veb.4">veb(4)</a>.
<li>Use VLAN hardware tagging in <a href="https://man.openbsd.org/bridge.4">bridge(4)</a>.
<li>Use checksum offload in <a href="https://man.openbsd.org/veb.4">veb(4)</a>
and <a href="https://man.openbsd.org/bridge.4">bridge(4)</a>.
<li>Unbreak <a href="https://man.openbsd.org/vport.4">vport(4)</a> to
vport communication on the same <a
href="https://man.openbsd.org/veb.4">veb(4)</a>.
<li>Remove <code>net.inet6.ip6.soiikey</code> sysctl.
<li>Make <a href="https://man.openbsd.org/lo.4">lo(4)</a> attach
multiple interface queues, allowing local network connections to use
multiple softnets.
<li>Allow packets being sent out <a
href="https://man.openbsd.org/pppoe.4">pppoe(4)</a> interfaces to
bypass queues and go straight onto the underlying interface.
</ul>
<li>The following changes were made to the <a
href="https://man.openbsd.org/pf.4">pf(4)</a> firewall:
<ul>
<li>The check whether a TCP RST packet belongs to a connection
was too strict.
Now resetting a TCP state also works if there were gaps in
the sequence number space due to lost packets.
<li>Repair "least-states" in
<a href="https://man.openbsd.org/pf.4">pf(4)</a> by decrementing
the state counter properly when the state is removed.
</ul>
<li>Routing daemons and other userland network programs saw the following improvements:
<ul>
<li>Make <a href="https://man.openbsd.org/getaddrinfo.3">getaddrinfo(3)</a>
convert numeric host addresses for all address families,
independent of them being listed in /etc/resolv.conf.
<li>Added <a href="https://man.openbsd.org/lldpd.8">lldpd(8)</a>,
Link Layer Discovery Protocol (LLDP) daemon, and
<a href="https://man.openbsd.org/lldp.8">lldp(8)</a> control program.
<li>Added <a href="https://man.openbsd.org/bpflogd.8">bpflogd(8)</a>,
Berkeley Packet Filter logging daemon.
<li>Disallow <a href="https://man.openbsd.org/nc.1">nc(1)</a>
<code>-T</code> with = when arguments are not key=value pairs.
<li>Add SOCKS4A support to <a
href="https://man.openbsd.org/nc.1">nc(1)</a>
proxy (<code>-X</code>) mode.
<li>Add ALPN TLS option, so you can specify <code>-T</code> alpn=value
in <a href="https://man.openbsd.org/nc.1">nc(1)</a>.
<li>Make <a href="https://man.openbsd.org/iked.8">iked(8)</a> load
multiple certificates as a certificate chain from a file.
<li>In <a href="https://man.openbsd.org/relayd.8">relayd(8)</a>
add tighter checks on inter-process messages.
<li>Remove the currently useless "status memory" command in
<a href="https://man.openbsd.org/unwindctl.8">unwindctl(8)</a>.
<li>Disable aggressive-nsec when "force" is in use in
<a href="https://man.openbsd.org/unwind.8">unwind(8)</a>.
<li>Repair the printing of IPv6 route commands with
<a href="https://man.openbsd.org/netstart.8">netstart(8)</a>
<code>-n</code>, which was broken in 2022.
<li>Change <a href="https://man.openbsd.org/dhcpd.8">dhcpd(8)</a> to
use the rdomain/rtable it was started in.
<li>Reduce the number of times that
<a href="https://man.openbsd.org/dhcpleased.8">dhcpleased(8)</a> uses
<a href="https://man.openbsd.org/if_indextoname.3">if_indextoname(3)</a>
to translate an interface index to an interface name.
<li>In <a href="https://man.openbsd.org/dhcp6leased.8">dhcp6leased(8)</a>,
install reject route for prefix delegation, to
prevent routing loops in case only parts of the delegated prefix are
configured on interfaces.
<li>Introduce a lower bound for the IPv6-Only preferred timelimit in
<a href="https://man.openbsd.org/dhcpleased.8">dhcpleased(8)</a>.
<li>Network statistics reporting using <a
href="https://man.openbsd.org/netstat.1">netstat(1)</a> was changed:
<ul>
<li>The output of
<a href="https://man.openbsd.org/netstat.1">netstat(1)</a>
for multicast route and divert protocol statistics
have been improved.
<li>Export TCP send congestion window for IPv6 also to allow its
display with <a
href="https://man.openbsd.org/netstat.1">netstat(1)</a>
<code>-B</code>.
<li>Harmonize <a
href="https://man.openbsd.org/netstat.1">netstat(1)</a> ip4 and ip6
multicast counter output.
<li>Provide m_pool_alloc() failures in mbstat, making the count
visible in <a href="https://man.openbsd.org/netstat.1">netstat(1)</a>
<code>-m</code>.
<li>Remove specific divert6 netstat counters, use divert instead.
</ul>
<li><a href="https://man.openbsd.org/acme-client.1">acme-client(1)</a> saw several changes:
<ul>
<li>Made <a
href="https://man.openbsd.org/acme-client.1">acme-client(1)</a> handle
"processing" status by retrying.
<li>Remove http support from <a
href="https://man.openbsd.org/acme-client.1">acme-client(1)</a>, using
https for the API server per RFC 8555.
<li>Allow port numbers in API URLs, letting <a
href="https://man.openbsd.org/acme-client.1">acme-client(1)</a> talk
to Let's Encrypt's pebble server.
<li>Implement draft-ietf-acme-profiles for <a
href="https://man.openbsd.org/acme-client.1">acme-client(1)</a>.
<li>Adapt renewal calculation for shortlived certificates in <a
href="https://man.openbsd.org/acme-client.1">acme-client(1)</a>.
</ul>
<li>In <a href="https://man.openbsd.org/bgpd.8">bgpd(8)</a>:
<ul>
<li>In verbose mode log the NOTIFICATION data for UPDATE errors.
<li>Fix a busy loop error in the pfkey handling.
<li>Introduce monotime - an internal time API using microsecond resolution.
<li>Fix accounting of the pending update counter
<li>Use new ibufq interface instead of handrolling the same.
<li>Large refactoring of internal APIs to make the code easier to share
and cleaner.
</ul>
<li>In <a href="https://man.openbsd.org/rpki-client.8">rpki-client(8)</a>:
<ul>
<li>The parser process now uses parallel threads for object
validation. The new <code>-p</code> option can be used
to adjust the number of threads.
<li>Support for Canonical Cache Representation has been added.
<a href="https://datatracker.ietf.org/doc/html/draft-spaghetti-sidrops-rpki-ccr">CCR</a>
is a new DER-encoded data interchange format to support audit trail
keeping, validated payload dissemination, and analytics pipelines.
<li>Certificate parsing and validation has been completely reworked.
In particular, a more stringent set of compliance checks based on RFC
6487, RFC 8209, and RFC 8608 is imposed on end entity certificates.
<li>Filemode is now able to detect most file types without recourse
to the file name extension.
<li>Experimental support for P-256 Trust Anchor keys was added.
<li>Marshalling and unmarshalling of privsep messages was improved.
<li>In verbose mode, warnings are emitted about uncompressed
HTTP/RRDP transfers larger than one megabyte. Publication server
operators are strongly encouraged to offer gzip compressed HTTP
content-encoding, see draft-ietf-sidrops-publication-server-bcp,
section 6.3.
<li>Emit all key identifiers (AKI and SKI) encoded in JSON as bare
hex strings without colons.
<li>Fixed numerous minor issues flagged by the Coverity static analyzer.
</ul>
</ul><!-- Routing daemons and other userland network improvements -->
<li><a href="https://man.openbsd.org/tmux.1">tmux(1)</a> improvements and bug fixes:
<ul>
<li>Allow <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> bind -r and -N to change an existing key binding if no command is specified.
<li>Add more features for boolean expressions in <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> formats.
<li>Add an option variation-selector-always-wide to instruct <a
href="https://man.openbsd.org/tmux.1">tmux(1)</a> not to always
interpret VS16 as a wide character and assume the terminal does
likewise.
<li>Add R format modifier to <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> to repeat an argument.
<li>Add -E to run-shell to forward stderr as well as stdout in <a href="https://man.openbsd.org/tmux.1">tmux(1)</a>.
<li>Fix several memory leaks.
<li>Flush scrolling when wrapping so UTF-8 in last position draws correctly.
<li>Treat Shift-Tab just like the up arrow in completion popup menu.
<li>Fix PageDown in menus.
<li>Replace invalid UTF-8 with the placeholder instead of ignoring them.
<li>Add pane-border-lines value to use spaces for pane borders.
<li>Add a nicer default second and third status line.
<li>Add a <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> set-default style attribute which replaces the current default colours and attributes completely.
<li>Add S: to list <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> sessions with modifiers for sorting.
<li>Add <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> support for DECRQSS SP q (report cursor style), DECRQM ?12 (report cursor blink state) and DECRQM ?2004, ?1004, ?1006 (report mouse state).
<li>Introduce <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> new window option: tiled-layout-max-columns, which configures the maximum number of columns in the tiled layout.
</ul>
<li>LibreSSL version 4.2.0:
<ul>
<li>Portable changes:
<ul>
<li>Added explicit OpenBSD/ISC license to build system / scripts.</li>
<li>Fixed compilation on more CPU targets by removing architecture-specific definitions from header files.</li>
<li>Fixed builds in deep paths by using relative paths for linking.</li>
<li>Fixed Windows builds with Clang and CMake.</li>
<li>Fixed Windows error handling accepting connections with nc.</li>
</ul>
<li>Internal improvements:
<ul>
<li>Cleaned up code implementing block cipher modes of operation.
Includes untangling a horrible <code>#ifdef</code> mess and removing a few
instances of undefined behavior.
<li>Removed assembly implementations of AES using bit slicing (BS-AES)
and vector permutation (VP-AES).
<li>Removed <code>OPENSSL_SMALL_FOOTPRINT</code> and <code>OPENSSL_FIPSAPI</code>.
<li>Implemented constant time EC field element operations to allow
elliptic curve operations without bignum arithmetic.
<li>Implemented an EC method using homogeneous projective coordinates.
This will allow exception-free elliptic curve arithmetic in
constant time in future releases.
<li>Started cleaning up the openssl speed implementation.
<li>The last <code>SIGILL</code>-based CPU capability detection was removed.
Instead, capabilities are now detected using a constructor on
library load, which improves the incomplete coverage by calls
to <a href="https://man.openbsd.org/OPENSSL_init_crypto.3"
>OPENSSL_init_crypto(3)</a> on various entry points.
<li>Rework and simplify AES handling in EVP. In particular, AES-NI
is now handled in the AES internal code and no longer requires
the use of <a href="https://man.openbsd.org/evp.3">EVP</a>.
<li>Added a public API for ML-KEM. This is not yet documented in a
manpage and may not be in its final form. This will be used to
support X25519MLKEM768 in libssl.
</ul>
<li>Compatibility changes:
<ul>
<li>Removed the -msie_hack option from the
<a href="https://man.openbsd.org/openssl.1">openssl(1)</a>
<a href="https://man.openbsd.org/openssl.1#ca">ca</a>
subcommand.
<li>Removed parameters of the 239-bit prime curves from X9.62, H.5.2:
prime239v1, prime239v2, prime239v3.
<li>Increased default MAC salt length used by PKCS12_set_mac(3) to 16
per recommendation of NIST SP 800-132.
<li>Encrypted PKCS#8 key files now use a default password-based key
derivation function that is acceptable in the present millennium.
<li>const corrected
<a href="https://man.openbsd.org/EVP_PKEY_get1_RSA.3"
>EVP_PKEY_get{0,1}_{DH,DSA,EC_KEY,RSA}(3)</a>.
<li><a href="https://man.openbsd.org/X509_CRL_verify.3"
>X509_CRL_verify(3)</a> now checks that the AlgorithmIdentifiers in the
signature and the tbsCertList are identical.
<li>Of the old *err() only PEMerr(), RSAerr(), and SSLerr() remain.
<li>Remove BIO_s_log(),
<a href="https://man.openbsd.org/OpenBSD-7.7/X509_PKEY_new.3"
>X509_PKEY_{new,free}(3)</a>,
<a href="https://man.openbsd.org/OpenBSD-7.7/PEM_X509_INFO_read.3"
>PEM_X509_INFO_read(3)</a>, and PEM_X509_INFO_write_bio().
<li>Re-expose the ASN.1 Boolean template items.
<li>opensslconf.h is now machine-independent.
</ul>
<li>New features:
<ul>
<li>Allow specifying ALPN in <a href="https://man.openbsd.org/nc.1#T">nc(1)</a>
via -Talpn="http/1.1,http:/1.0".
</ul>
<li>Bug fixes:
<ul>
<li>Avoid pointer arithmetic on <code>NULL</code> for memory BIOs.
<li>Fix leaks and use-after-frees in PKCS7 attribute handling.
<li>Ensure p and q in RSA private key have a minimum distance of
2^(bits/2 - 100) as specified in NIST SP 800-56B Revision 2.
</ul>
<li>Security fixes:
<ul>
<li>Fix out-of-bounds read and write, memory leaks and incorrect
error check for CMS enveloped data.
</ul>
<li>Documentation:
<ul>
<li>Rewrote most of the EC documentation from scratch to be at least
somewhat accurate and intelligible.
<li>Updated documentation for SMIME_{read,write}* to match reality.
</ul>
<li>Testing and proactive security:
<ul>
<li>Added a testing framework that will help deduplicating lots of
ad-hoc code in the regression tests.
<li>Converted the Wycheproof testing framework to use testvectors_v1.
This in combination with a few new tests significantly increases
regress coverage.
</ul>
</ul>
<li>OpenSSH 10.2:
<ul>
<li>Security fixes:
<ul>
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
disallow control characters in usernames passed via the
commandline or expanded using %-sequences from the configuration
file, and disallow \0 characters in ssh:// URIs.
<br>
If an ssh(1) commandline was constructed using usernames or URIs
obtained from an untrusted source, and if a ProxyCommand that uses
the %r expansion was configured, then it may be possible for an
attacker to inject shell expressions that may be executed when the
proxy command is started.
<br>
We strongly recommend against using untrusted inputs to construct
ssh(1) commandlines.
<br>
This change also relaxes the validity checks in one small way:
usernames supplied via the configuration file as literals (i.e.
that have no % expansion characters) are not subject to these
validity checks. This allows usernames that contain arbitrary
characters to be used, but only via configuration files. This is
done on the basis that ssh's configuration is trusted.
<br>
This issue was reported by David Leadbeater.
</ul>
<li>Potentially incompatible changes:
<ul>
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
add a warning when the connection negotiates a non-post
quantum safe key agreement algorithm.
<br>
This warning has been added due to the risk of "store now, decrypt
later" attacks. More details at the
<a href="https://openssh.com/pq.html"
>OpenSSH Post-Quantum Cryptography</a> page.
<br>
This warning may be controlled via a new <code>WarnWeakCrypto</code>
<a href="https://man.openbsd.org/ssh_config">ssh_config(5)</a>
option, defaulting to on. This option is likely to control
additional weak crypto warnings in the future.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,
<a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
major changes to handling of DSCP marking/<code>IPQoS</code>
<br>
Both the client and the server have changed the default DSCP
(a.k.a IPQoS) values and the way these values are selected at
runtime.
<br>
Both endpoints now use Expedited Forward (EF) for interactive
traffic by default. This provides better prioritisation,
especially on wireless media (cf. RFC 8325). Non-interactive
traffic now uses the operating system default DSCP marking.
Both the interactive and non-interactive DSCP values may be
overridden via the <code>IPQoS</code> keyword in <a
href="https://man.openbsd.org/ssh_config.5">ssh_config(5)</a> and
<a href="https://man.openbsd.org/sshd_config.5">sshd_config(5)</a>.
<br>
The DSCP value selected may now change over the course of a
connection. ssh(1) and sshd(8) will automatically select between
the interactive and non-interactive IPQoS values depending on
the type of SSH channels open. E.g. if an sftp session is using
the connection, then the non-interactive value will be used.
<br>
This is important now that the default interactive IPQoS is EF
(Expedited Forwarding), as many networks are configured to allow
only relatively small amounts of traffic of this class and they will
aggressively deprioritise the entire connection if this is exceeded.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,
<a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
deprecate support for IPv4 type-of-service (TOS)
keywords in the IPQoS configuration directive.
<br>
Type of Service (ToS) was deprecated in the late nineties and
replaced with the Differentiated Services architecture. Diffserv
has significant advantages for operators because this mechanism
offers more granularity.
<br>
OpenSSH switched its default IPQoS from ToS to DSCP values in 2018.
<br>
IPQoS configurations with 'lowdelay', 'reliability', or
'throughput' will be ignored and instead the system default QoS
settings apply. Additionally, a debug message is logged about the
deprecation with a suggestion to use DSCP.
<li><a href="https://man.openbsd.org/ssh-add.1">ssh-add(1)</a>:
when adding certificates to an agent, set the expiry
to the certificate expiry time plus a short (5 min) grace period.
<br>
This will cause the agent to automatically remove certificates shortly
after they expire. A new ssh-add(1) <code>-N</code> option
disables this behaviour.
<li>All: remove experimental support for XMSS keys. This was never
enabled by default. We expect to implement a new post-quantum
signature scheme in the near future.
<li><a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>,
<a href="https://man.openbsd.org/sshd.8">sshd(8)</a>: move agent
listener sockets from /tmp to under ~/.ssh/agent
for both ssh-agent(1) and forwarded sockets in sshd(8).
<br>
This ensures processes that have restricted filesystem access
that includes /tmp do not ambiently have the ability to use keys
in an agent.
<br>
Moving the default directory has the consequence that the OS will
no longer clean up stale agent sockets, so ssh-agent(1) now gains
this ability.
<br>
To support $HOME on NFS, the socket path includes a truncated hash of
the hostname. ssh-agent(1) will by default only clean up sockets from
the same hostname.
<br>
ssh-agent(1) gains some new flags: <code>-U</code> suppresses the
automatic cleanup of stale sockets when it starts.
<code>-u</code> forces a cleanup without keeping a running agent,
<code>-uu</code> forces a cleanup that ignores the hostname.
<code>-T</code> makes ssh-agent(1) put the socket back in /tmp.
</ul>
<li>New features:
<ul>
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,
<a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
add <code>SIGINFO</code> handlers to log active channel and
session information.
<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
when refusing a certificate for user authentication, log
enough information to identify the certificate in addition to the
reason why it was being denied. Makes debugging certificate
authorisation problems a bit easier.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,
<a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>:
support ed25519 keys hosted on PKCS#11 tokens.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
add a <a href="https://man.openbsd.org/ssh_config.5">ssh_config(5)</a>
RefuseConnection option that, when encountered while processing
an active section in a configuration terminates ssh(1) with an
error message that contains the argument to the option.
<br>
This may be useful for expressing reminders or warnings in config
files, for example:
<pre>
Match host foo
RefuseConnection "foo is deprecated, use splork instead"
</pre>
<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
make the X11 display number check relative to
X11DisplayOffset. This will allows people to use X11DisplayOffset
to configure much higher port ranges if they really want, while
not changing the default behaviour.
<li>unit tests: the unit test framework now includes some basic
benchmarking capabilities. Run with "make UNITTEST_BENCHMARK=yes".
</ul>
<li>Bugfixes:
<ul>
<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
fix mistracking of MaxStartups process exits in some
situations. At worst, this could cause all MaxStartups slots to
fill and sshd(8) to refuse new connections.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
fix delay on X client startup when ObscureKeystrokeTiming is enabled.
<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
increase the maximum size of the supported configuration
from 256KB to 4MB, which ought to be enough for anybody. Fail
early and visibly when this limit is breached.
<li><a href="https://man.openbsd.org/sftp.1">sftp(1)</a>:
during sftp uploads, avoid a condition where a failed
write could be ignored if a subsequent write succeeded. This is
unlikely but technically possible because sftp servers are
allowed to reorder requests.
<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
avoid a race condition when the sshd-auth process exits
that could cause a spurious error message to be logged.
<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
log at level <code>INFO</code> when PerSourcePenalties actually
blocks access to a source address range. Previously this was
logged at level <code>VERBOSE</code>, which hid enforcement
actions under default config settings.
<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
GssStrictAcceptor was missing from sshd(8) <code>-T</code> output; fix
<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
Make the MaxStartups and PerSourceNetBlockSize options
first-match-wins as advertised.
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
fix an incorrect return value check in the local forward
cancellation path that would cause failed cancellations not to be
logged.
<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
make "Match !final" not trigger a 2nd pass ssh_config
parsing pass (unless hostname canonicalisation or a separate
"Match final" does).
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
better debug diagnostics when loading keys. Will now list
key fingerprint and algorithm (not just algorithm number) as well
as making it explicit which keys didn't load.
<li>All: fix a number of memory leaks found by LeakSanitizer,
Coverity and manual inspection.
<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
Output the current name for PermitRootLogin's
"prohibit-password" in sshd(8) <code>-T</code> instead of its
deprecated alias "without-password".
<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
make writing known_hosts lines more atomic by writing
the entire line in one operation and using unbuffered stdio.
<br>