The release of the free UNIX-like operating system OpenBSD 7.5 has been announced. The OpenBSD project was founded by Theo de Raadt in 1995 after a conflict with the developers of NetBSD, which resulted in Theo being denied access to the NetBSD CVS repository. After that, Theo de Raadt and a group of like-minded individuals created a new open-source operating system based on the NetBSD source tree, with the main goals of portability (supporting 13 hardware platforms), standardization, correctness, proactive security, and built-in cryptographic tools. The size of the full installation ISO image of the base system OpenBSD 7.5 is 630 MB.
In addition to the operating system itself, the OpenBSD project is known for its components that have been adopted in other systems and proven to be among the most secure and high-quality solutions. Among them: LibreSSL (a fork of OpenSSL), OpenSSH, the packet filter PF, routing daemons OpenBGPD and OpenOSPFD, the NTP server OpenNTPD, mail server OpenSMTPD, terminal multiplexer (analog of GNU screen) tmux, identd daemon implementing the IDENT protocol, BSDL alternative to the GNU groff package — mandoc, protocol for organizing fault-tolerant systems CARP (Common Address Redundancy Protocol), lightweight HTTP server, and the file synchronization utility OpenRSYNC.
Key Improvements:
- The installer has added support for encrypting the root partition. In the automated installation mode (autoinstall), it is now possible to enable disk encryption by providing a plaintext password or supplying keys on a separate medium. Builds for the AMD64 architecture cdXX.iso and installXX.iso have been adapted for booting in EFI mode.
- A new system call, pinsyscalls, has been added, allowing access to system calls only from specific locations in the process's address space. The kernel and ld.so can register the exact entry point for each system call used by a program and the libc.so library, to subsequently block the submission of system calls from unregistered locations.
- Support for indirect system call access via the syscall function has been removed. In combination with pinsyscalls, this change allows for the prohibition of direct access to system calls without using the wrappers provided in libc. Packages that involve direct access to system calls, such as Perl and Go, have been modified to use only libc functions.
- On ARM64 systems, the use of Pointer Authentication (PAC) and Branch Target Identification (BTI) mechanisms has been expanded.
- The ppp network interface has been enhanced. support for IPv6.
- The netstat utility now includes output statistics on route caching efficiency (the 'netstat -s' output now displays hit and miss counters for the cache).
- The pf packet filter has been adjusted for changes in the network stack related to the parallelization of operations on multiprocessor systems. When running the tcpdump utility with the pflog network interface, it now shows packets dropped by rules with the default action of 'block'. For rules with the action 'pass', it displays blocked invalid packets. A validation check for the proper setting of options in IPv4 packets has been added to divert.
- Support for multiprocessor systems (SMP) has been improved. The timeout handlers in the network stack, packet counting for the loopback interface, and the vscsi_filtops module have been made mp-safe. Parallel execution of system calls bind and connect, as well as operations with UDP tables for IPv4 and IPv6, is now possible. Support for simultaneously sending UDP packets from different threads has been added.
- Handling of swap space overflow situations has been improved, and changes have been made to eliminate deadlocks.
- In the kernel for arm64 systems, caching of page table pool contents and PTE descriptors has been implemented, significantly speeding up operations on multicore systems.
- Improvements have been made to the VMM hypervisor. The implementation of the vionet device has been rewritten to support multithreading and zero-copy data transfer between the host and guest system without intermediate buffering. The stability of the hypervisor has been enhanced on systems with Intel VMX instructions. Additional protection has been added against recently identified vulnerabilities in processors related to speculative execution of instructions and leakage of residual data from registers.
- For amd64 systems, the sysctl machdep.retpoline has been added to manage the enabling of the retpoline mechanism for protection against Spectre-class attacks.
- The implementation of the drm (Direct Rendering Manager) framework has been synchronized with Linux kernel 6.6.19 (previous release was 6.1.55).
- Support for new hardware has been added and new drivers have been included for components of various SoCs, supporting Ethernet controllers and offloading network operations to the network cards.
- In the audio subsystem uaudio, attachment of multiple drivers for audio devices has been allowed.
- Drivers apldcp and apldrm have been added for display controllers used in Apple devices. For the Apple Powerbook, the ability to control keyboard backlighting has been implemented.
- The qwx driver for Qualcomm IEEE 802.11ax wireless chips has been added, created by porting the ath11k driver from the Linux kernel (included since branch 5.6). This driver enables the use of wireless adapters used in laptops such as Lenovo ThinkPad X13s and DELL XPS 9500. Firmware files must be installed for the driver to work.
- The pax utility has been enhanced to allow writing to pax archives, and the tar utility has added support for pax archives larger than 8 GB.
- Support for specifying port numbers for tunnel-related network interfaces, such as gif and gre, has been added to the ifconfig utility.
- In bgpd, the messaging mechanism and most protocol parsers have been transitioned to a new memory-safe API.
- In rpki-client, experimental support for the P-256 digital signature algorithm has been added. It is now possible to restrict the RPKI Trust Anchor's actions to specific autonomous system numbers. Support for RPKI signed prefix lists has also been added.
- In smtpd, support for RFC 7505 ('Null MX' for identification) has been added. domains, which do not accept mail) and the possibility of embedding multi-line tables and lists with filters in smtpd.conf has been provided.
- The ability to install a custom KDE Plasma 5.27 environment from the kde-plasma and kde-plasma-extra packages has been introduced (after KDE4 support ended, the support for using the KDE Plasma 5 desktop remained non-functional in OpenBSD). Versions offered for installation include KDE Plasma 5.27.10, KDE Applications 23.08.4, and KDE Frameworks 5.115.0.
- The LibreSSL and OpenSSH packages have been updated. A detailed overview of improvements can be found in the reviews of LibreSSL 3.9.0, OpenSSH 9.6, and OpenSSH 9.7.
- The number of ports for the AMD64 architecture reached: 12309 (up from 11845), for aarch64 — 12145 (up from 11508), for i386 — 10830 (up from 10603). Among the application versions in the ports:
- Asterisk 16.30.1, 18.21.0, 20.6.0
- Audacity 3.4.2
- CMake 3.28.3
- Chromium 122.0.6261.111
- FFmpeg 4.4.4
- Firefox 123.0.1, ESR 115.8.0
- GCC 8.4.0, 11.2.0
- GHC 9.6.4
- GNOME 45
- Go 1.22.1
- JDK 8u402, 11.0.22, 17.0.10, 21.0.2
- Krita 5.2.2
- LLVM/Clang 13.0.0, 16.0.6, 17.0.6
- LibreOffice 24.2.1.2
- Lua 5.1.5, 5.2.4, 5.3.6, 5.4.6
- MariaDB 10.9.8
- Mono 6.12.0.199
- Mutt 2.2.13 and NeoMutt 20240201
- Node.js 18.19.1
- OCaml 4.14.1
- OpenLDAP 2.6.7
- PHP 7.4.33, 8.0.30, 8.1.27, 8.2.16, 8.3.3
- Postfix 3.8.6
- PostgreSQL 16.2
- Python 2.7.18, 3.9.18, 3.10.13, 3.11.8
- Qt 5.15.12 (+ kde patches), 6.6.1
- R 4.2.3
- Ruby 3.1.4, 3.2.3, 3.3.0
- Rust 1.76.0
- SQLite 3.44.2
- Shotcut 23.07.29
- Sudo 1.9.15.5
- Suricata 7.0.3
- Tcl/Tk 8.5.19, 8.6.13
- TeX Live 2023
- Thunderbird 115.8.1
- Vim 9.1.139, Neovim 0.9.5
- Xfce 4.18.1
- Updated components from third-party developers included in OpenBSD 7.5:
- The Xenocara graphics stack based on X.Org 7.7 with xserver 21.1.11 + patches, freetype 2.13.0, fontconfig 2.14.2, Mesa 23.1.9, xterm 378, xkeyboard-config 2.20, fonttosfnt 1.2.3.
- LLVM/Clang 16.0.6 (+ patches)
- GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
- Perl 5.36.3 (+ patches)
- NSD 4.8.0
- Unbound 1.18
- Ncurses 5.7
- Binutils 2.17 (+ patches)
- Gdb 6.3 (+ patch)
- Awk 22.01.2024
- Expat 2.6.0.
- zlib 1.3.1 (+ patches).
Source: opennet.ru
