OpenBSD -current Changelog

This selection is intended to include all important and all user-visible changes. For a complete record of all changes, please see the "source-changes" mailing list, called "OpenBSD CVS" in the archives, or use CVS.

Changes made between OpenBSD 8.0 and -current

• Capped ssh(1) keyboard-interactive devices accepted, to avoid DoS in sshd-auth.
• Use client source port instead of remote proxy port, to unbreak relayd(8) PROXY sending.
• Merged fixes for Xserver(1) CVEs.
• Added cpu scaling and GPIO pin access to the Qualcomm CPUSS Control Processor driver.
• Automatically load the DTB for Qualcomm-based Thinkpad T14s Gen 7 and Yoga Slim laptops.
• Correct outgoing record checks in the legacy ssl(8) TLSv1.2 stack.
• Made rpki-client(8) enforce a single AS identifier in ASPA EE certs.
• Stopped prepending underscores to symbol names in nlist(3) input.
• No longer allow TIOCSCTTY, TIOCNOTTY, or TIOCSPGRP on the pty master, avoids incoherent session states.
• Track age of etherbridge entries in gre(4).
• Made vmd(8) reject vioblk requests beyond the disk capacity; check alignment.
• In iked(8): implemented IKEv1 support (experimental).
• Fixed pf(4) traffic statistics for state created by af-to rules.
• Fixed pf(4) flush for source tracking rules under NAT.
• Unlocked KERN_HOSTNAME and KERN_DOMAINNAME sysctl pathsm using mutexes to protect.
• Made smtpd(8) fail on usernames and passwords that are too long.
• Properly set smtpd(8) socket lengths when building the various sockaddr structures.
• Fixed ld.lld(1) .note.gnu.property values in ld -b binary invocations.
• In pf(4), limit retries to avoid depleted source port pool for NAT starving other packets.
• Raises the drm(4) gem object size limit from 512M to 1.5G.
• Added ujoy(4) devices to wscons group, reducing permissions to 440.
• Multiple bugfixes for amdgpu(4).
• For SEV-SNP, disabled ipmi(4) on confidential VMs.
• Added ML-DSA 44 support (based on BoringSSL).
• For SEV-SNP, added memory clobber to vmgexit() so content not cached across the instruction.
• Avoid use-after-free in IPv6 duplicate address detection.
• Stopped checkalias replacing vnodes in vfs.
• Avoid out-of-bounds wscons(4) array accesses.
• Stopped ix(4) deallocating rings in DVACT_SUSPEND, reuse them in DVACT_RESUME.
• Added addresses to smtpd(8) log lines.
• Fixed rx map leak in em(4).
• Fix race where tcp(4) syn cache could free a used route.
• Made rtwn(4) send complete H2C commands to the firmware.
• Hide ld.so(1) LD_DEBUG support behind a compile-time #ifdel DL_DEBUG; removed other information leaks.
• Libutil updated to version 23.0.
• crypto(3) will now reject any v1 CRL's.
• Made openssl(1) always issue v2 CRLs.
• Replaced login_fbtab(3) with the wscons(4) group if the users is on the glass console.
• crypto(3) will now ignore the Netscape certificate type extension.
• Made openssl(1) always issue v3 x509 certificates.
• Backported security fixes from zlib 1.4.
• Securelevel(7) 2 no longer prevents pf(4) ruleset changes.
• Capped snmpd(8) getbulk max-repetitions to 50.
• Adapted firmware from rge(4) to work on ure(4) RTL8157 and RTL8159.
• Updated libexpat to version 2.10.0 for security fixes.
• Fixed resets on Fujitsu Futro S940.
• Removed a potential sleep point in the nvme(4) resume path.
• Avoid using malloc(9) to avoid sleep(3) in DVACT_SUSPEND and DVACT_RESUME.
• Plugged mbuf leak in inet6(4) forwarding.
• Add 'Q' flag/key to top(1), show pledge/chroot/unveil usage.
• Fixed vio(4) control queue handling during reset.
• Fix mbuf leak in ip(4) rip_output when in_pcbselsrc fails.
• patch(1) will now abort in fetchname() if out of memory.
• Fixed rge(4) RTL8125 and RTL8125B TX hangs on short UDP frames.
• Made aggr(4) balance traffic over ports like trunk(4); improved use of flowids in the TR path.
• Added sanity check for queue priority assigned to pf(4) state via 'set prio' rule action.
• Improved malloc(3) canary code to handle more cases.
• Avoid race condition in pf(4) tcp scrub pf_test_state().
• Reworked how rtables are allocated and reduce use of RT_TABLEID_MAX by ip(4) and subsystems.
• Avoids infinite loops with a particular construction of unveil(2).
• rpki-client(8) will now disallow certs with zero serialNumber.
• In rpki-client(8), reject short URIs, and URIs not long enough to hold https:// or rsync://.
• On rum(4), reject receive transfers whose descriptor frame length exceeds data actually transferred.
• Increased MAXDSIZ to 3Gb for macppc.
• Made uhidev(4) reject payloads that exceed their declared input report sizes.
• Provide flags specify using IPv4 or IPv6 in dbupdate(8), fw_update(8), syspatch(8), and sysupgrade(8).
• In rpki-client(8), reject URIs with // except at the start of the authority.
• Activated linker relaxation on riscv64, to let ld.lld(1) rewrite branches.
• Added ssh(1) -Q addressfamily.
• Added 'glob' and 'glob ignorecase' matching keywords to relayd.conf(5); made parser more strict.
• Limit impact of quadratic workload in rpki-client(8) caused by duplicate references from manifests.
• In signify(1), check last block size for gzip, to avoid length extension attacks.
• In nc(1) with -k, do not treat tls_read() failures as fatal.
• Fixed potential race condition in chpass(1).
• Bumped MAXTSIZ on arm64 to 512M (to accommodate bloated browsers).
• Added a storage process to snmpd(8) at /var/db/snmpd, used to store SNNMP engine information.
• Made tmux(1) clear tabs and wide characters cut by EL and ED.
• Nul-delimit the concatenation of user/hosts/port/etc that is hashed to generate the ssh(1) %C token.
• Disallow remote removal of PKCS#11 providers from ssh-agent(1) by default.
• Made ssh(1) @revoked keys in known_hosts apply to the host regardless of port number.
• Made ssh-keysign(8) check that the peername of socket matches attached interface.
• Avoid ssh-keyscan(1) crashing when one host of many fails strict KEX.
• Fixed ssh(1) ChannelTimeout for PermitTunnel forwardings.
• Harden ssh(1) privsep monitor: enforce CASignatureAlgorithms and RequiredRSASize checks.
• Disallow use of certificates signed with RSA/SHA1 in ssh(1) sshsig.
• Made ssh(1) UnusedConnectionTimeout and FingerprintHash properly first-match-wins.
• Clear PIN when deallocating in ssh-add(1).
• Added mutex protection to pf(4) rule item traversal.
• Made uncm(4) NCM 1.0 spec compliant.
• Fixed qwz(4) firmware loading for Samsung GalaxyBook4 Edge.
• Update timezone data to 2026fgtz from https://github.com/JodaOrg/global-tz.
• Prevent potential use-after-free in the DMA engine of the bse(4) network interface.
• In rpki-client(8) check_delta(), ensure delta list ends with the notification serial.
• Bumped sigalg maximum to 256 in ssl(8).
• In pf(4), fixed missing pf_state_key_unref(); fixed mbuf leak in pf_refragment6().
• Stopped fatal errors when ssh(1) receives malformed SOCKS5 requests.
• Powerdown more eDP and Samsung OLED panels during suspend.
• Made tmux(1) reject \u and \U escapes that are not Unicode characters.
• Stopped tmux(1) losing keys sent after a command prompt opens.
• Increased MAXDSIZ on alpha to 4GB.
• Multiple amdgpu(4) and intel(4) bugfixes.
• Use loadfirmware(9) to load the rge(4) microcode.
• Made sysmerge(8) ignore /etc/ssl/cert.pem for now.
• Reverted previous aq(4) commit, which broke the Apple Silicon Mac mini interface.
• Removed hppa floating-point emulation code for ancient processors.
• Fixed bgpctl(8) loading networks via mrt and bulk endpoints.
• Handle protected frames in the rx and tx path for mwx(4) MT7925.
• Use linker relaxation in riscv64 kernels, lowers sys time.
• In rpki-client(8), correctly check whether CAs were previously confirmed.
• Prevent fq_codel panic with sustained internet traffic through a congested fq_codel queue.
• Use explicit_bzero passphrase on ssh-askpass(1) exit and delete.
• Fixed pf(4) race between pf_test() and pf_purge_states().
• Add /dev/radio support to hppa, octeon, and sparc64 to accommodate udsbr(4).
• Fixed out-of-bounds glob(7) read on on missing right bracket after character class.
• In vmd(8), fixed double free in the virtio-net TX path.
• Limit the number of pending npppd(8) L2TP connections to avoid memory exhaustion.
• Reject short MPPE packets in npppd(8), to avoid memory faults.
• Updated libexpat to version 2.9.0.
• On octeon, span work queue interrupts across CPUs.
• Enable HW offload for VLAN on cnmac(4).
• Fixed crash when locale(1) is run with "--" as its only argument.
• Made rpki-client(8) prioritise previously confirmed certification paths.
• Imported nsd(8) 4.15.4.
• Avoid endless loop when unveil(2) is used in a chroot(2) environment.
• Made httpd(8) only rekey TLS tickets for the first server on a socket.
• Imported unbound(8) 1.26.2.
• Skip backlight init when there is no display on intel(4).
• Fixed tmux(1) status drag targeting across window labels.
• Have only one tmux(1) pane own shared corners so they are drawn with the active pane.
• Extended tmux(1) REP limit to allow it to wrap on to the next line.
• In isakmpd(8), fixed multiple remotely triggerable crashes.
• Fixed regression in mfii(4) driver's ability to detect non-raid disks.
• Fixed openssl(1) smime and cms exit status on option parsing errors.
• Initial commit of dbupdate(8) for updating (signed) zoneinfo and cert.pem.
• Updated cert.pem to handle the Emudhra intermediate cert compromise.
• Provide out-of-band information about firmware events to bwfm(4) RX, to avoid firmware injections.
• Stopped bwfm(4) blindly trusting bss->length in scan results.
• Avoid overflow while bwfm(4) is bounds-checking bwfm_bss_info messages.
• Drop bwfm(4) firmware event packets which report a bad data length.
• Added missing bounds checks for data length reported by bwfm(4) firmware events.
• Validate URI characters in ocspcheck(8) OCSP to avoid header injections.
• Fixed "timeout on lite software reset" on mue(4) LAN7800.
• Fixed kernel stack overflow in mue(4) mue_init_ltm().
• Made ocspcheck(8) check all OCSP AIA URLs for invalid characters.
• Prevent HTTP request injection via a certificate's AIA URI in ocspcheck(8).
• Fixed video(4) buffer handling and mmap lifetime.
• Updated pkgconf to 3.0.10.
• Implemented draft-herdes-idr-otc-rs-verification-01 in bgpd(8),
• Removed the safte(4) driver.
• Made rpki-client(8) expose superfluous ROAIPAddress maxLength, show warning with '-vv'.
• Backport security fixes from upstream nsd(8) version 4.15.3.
• Fixed overflow on octeon and amd64 in hardware accelerated AES-GMAC crypto.
• Fixed an off-by-one in bsd_decompress(), an ancient buffer overflow bug.
• Fixed httpd(8) "server match" configuration blocks.
• Simplified the pagedaemon when calculating free and inactive page shortages.
• Updated pkgconf to 3.0.9.
• Fixed errors on alpha when attempting to compile routines with more than 32KB of local variables.
• Tidied ld.so(1) output to print the command header itself.
• Libc initialisation now aborts if a setuid/setgid program does not have _permit_setugid.
• On alpha, allign _STACKALIGNBYTES with GCC expectation.
• Handle empty usbdev(4) HID responses that could otherwise lead to out of bounds memcpy().
• Updated to freetype 2.15.0; libX11 1.8.14; libXi 1.8.4; libXpm 3.5.20; libXrender 0.9.13; libXtst 1.2.6; xterm 412.
• Handle errno properly when accepting an npppd(8) PPTP connection, avoids file descriptor exhaustion.
• Reject npppd(8) PPTP control packet with an invalid length field.
• Don't attempt to re-read firmware in clcs(4) DVAT_RESUME.
• Made npppd(8) reject a PADR with an invalid length AC-Cookie; fixed duplicate cookie check.
• Allow urndrs(4) attach to "RNDIS over Ethernet" subclass devices (eg GL.iNet Mudi 7).
• In uncm(4), drop too large TX packets; validate NCM_FORMAT before use; switched to ifqueue(9) API; better checking of wNdpOutAlignment; close the control pipe before calling usb_rem_wait_task(9).
• Added a vertical (side) status line to tmux(1).
• Made ocspcheck(8) reject responses whose certificate status is not GOOD.
• Limit ocspcheck(8) HTTP response header size, and body size.
• Use the scheme for the verbose connection message as well.
• Made ocspcheck(8) select TLS based on the OCSP URL scheme.
• Multiple drm(4) bugfixes.
• In uonerng(4) claim both the control and data interfaces, so device only attaches once.
• Correct tmux(1) pane offsets when clipping both sides.
• In ixl(4) and iavf(4), load DMA map earlier, to avoid panic or stalled interface queue.
• Backported stack overwrite security fixes from upstream nsd(8) version 4.15.3.
• Don't print newline after reading password if readpassphrase(3) is interrupted by signal.
• Bump MAXTSIZ to 256M on mips64, a step towards building lang/zig port on mips64.
• Added rpki-client(8) safe guard: don't initially mark trust anchors as nonfunctional CAs.
• Made rpki-client(8) '-P' imply offline mode.
• In rpki-client(8) offline mode don't consider state related to non-functional CAs.
• Fixed ssh(1) channels code spinning when ChannelTimeout used.
• Made ypbind(8) privdrop to user _ypbind.
• Check that uhidev(4) USB_GET_REPORT size doesn't exceed ucr_data, preventing heap overflow.
• Save and restore qcdpc(4) EDO1455 panel state on suspend and resume; added power control.
• Handle multiple uncm(4) notifications per interrupt.
• Implemented filemode CMS prober using CBS in rpki-client(8).
• Implemented a CBS-based RFC 6488 parser in rpki-client(8).
• Use expire time of the signature path for BRKs in rpki-client(8).
• Improved apm(8) info for machines without a battery.
• Fix calculation of i/o size needed to read FSInfo struct in mount_msdos(8).
• Properly activate aq(4) when detected at boot time.
• Added RX queues/RSS/TSO support and update microcode for rge(4) RTL8127.
• Fixed pppoe(4) out-of-bounds memory write, stack disclosure, and SIGSEGV.
• Added unveil(2) to npppd(8); fixed stack leak.
• Stopped npppd(8) from allowing a non-privileged process to open any file.
• Multiple drm(4) bugfixes.
• Improved mandoc(1) error messages with '-mdoc -T' markdown mode.
• Updated libexpat to version 2.8.5.
• Fixed llvm compiler-rt __clear_cache() on mips64.
• Fix initialisation sequence required by virtio(4) 3.1.1.
• Fixed uncm(4) link establishment on Pixel 7a.
• Simplified video(4) kern.video.record logic to avoid bcopy with unchecked parameters.
• Updated to makedepend(1) 1.0.10.
• Updated to xserver(1) 21.1.25, libpng(3) 1.6.59, xclipboard(1) 1.1.6, xclock(1) 1.2.1, xfd(1) 1.1.6, xkbprint(1) 1.0.8, xload(1) 1.2.2, xmodmap(1) 1.0.12, xpr(1) 1.2.1, xwininfo(1) 1.1.7.
• Fixed an off-by-one error in bsd_decompress().
• Fixed ld.so(1) information leaks with AUX_openbsd_execmode.
• Made binutils aware of the AUX_openbsd_execmode variable.
• Cope with dates after 2040 on ADB macppc systems and macppc laptops.
• Cleanup and refactoring of rc.subr(8).
• More complete parsing sanity checks in rc.subr(8).
• If rc.d run script was updated, ensure rc.subr(8) uses original values until restart.
• unveil(2) and pledge(2) for ypmatch(1), ypwhich(1), and yppoll(8).
• Avoid infinite loop in pcidump(8) when encountering misbehaving devices.
• Add extra vmd(8) mmio region, allows i686 linux kernels work with less RAM.
• unveil(2) and pledge(2) for fgen(1) and ypbind(8).
• Reworked handling of the rpki-client(8) certificate expire time.
• Fixed race condition in rc.subr(8).
• Updated to pkgconf(1) 3.0.8.
• In pf(4), check AH extension header length.
• Added mwx(4) driver for Mediatek MT792x wifi devices.
• Better malloc(3) boundscheck and low-memory behaviour in wsdisplay(4) WSDISPLAYIO_LDFONT.
• Implemented mwx(4) MT7925 association to open APs in 11a/b/g modes.
• Add tmux(1) commands to copy mode to select, pipe and open OSC 133 command output.
• Don't allow mwx(4) deep sleep in ASSOC state, more stable connection and roaming.
• Added vmd(8) queue size checks and reject malformed descriptor chains.
• Enabled ssh(1) ssh-mldsa44-ed25519 as an allowed CA signature algorithm.
• Added truncation detection to the vmd(8) instruction decoder.
• In pf(4), check extension header length does not exceed packet length.
• Made mandoc(1) map '\:' to U+200B, to improve html output.
• Fixed mandoc(1) handling of special character escape sequences used as delimiters.
• Fixed mandoc(1) rendering of the \l (horizontal line) escape sequence.
• Made dhcpd(8) siscard packets with unsupported htype's.
• Show match count in tmux(1) copy mode.
• Added tmux(1) window-default-command option to override default-command per window.
• In mandoc(1) '-T utf8' output mode, made '\:' correctly output a line break not a glyph.
• Implemented mediaopt monitor for MT7925 with mwx(4).
• Enables urndis(4) in the installer on amd64.
• Fix refcnt bug in mwx(4) tx path, fixes hangs on MT7921.
• Added preliminary support of RTL8159 to ure(4).
• Fixed tmux(1) tty_clamp_area with status lines at the top and a smaller display.
• Added uncm(4) to i386 GENERIC config, and uncm(4) and urndis(4) to RAMDISK_CD.
• Fixed mandoc(1) HTML formatter when encountering nonsensical sequence of macros.
• Enabled uncm(4) in the installer on amd64 (allows firmware-less network installs).
• Added uncm(4), a driver for USB CDC NCM (i.e. USB phone tethering).
• Fixed GPIO wakeup masking during suspend.
• First bits of scan code added for the mwx(4) MT7925 chip.
• Do not lose a pending pane resize when entering the alternate tmux(1) screen.
• In tmux(1), adjust widths of a few codepoints incorrectly set to double width.
• Multiple bugfixes for drm(4), amdgpu(4), inteldrm(4), and radeondrm(4).
• Further restrict the characters allowed in a ssh(1) command-line-supplied user name.
• In drm(4), fixed drm_pending_vblank_event leak in error path for out_fence_ptr.
• Reserve a 16K-byte gap at start swap partitions, for upcoming disklabel changes.
• In sysv_shm, fixed ordering claim on vm_shm slot.
• Made mandoc(1) follow groff_mdoc(7) behaviour for width of a .Bl macro.
• Made rpki-client(8) use SOCK_NONBLOCK where possible; handle errors for fcntl().
• Improved mandoc(1) section identifier handling.