ProHoster > Blog > Internet News > Release OpenBSD 7.6

Release OpenBSD 7.6

The release of the free UNIX-like operating system OpenBSD 7.6 has been announced. The OpenBSD project was founded by Theo de Raadt in 1995 after a dispute with the developers of NetBSD, resulting in Theo losing access to the CVS repository of NetBSD. Following this, Theo de Raadt, along with a group of like-minded individuals, created a new open operating system based on the source code tree of NetBSD, focusing primarily on portability (supporting 13 hardware platforms), standardization, correctness, proactive security, and integrated cryptographic features. The size of the full installation ISO image of the base system OpenBSD 7.6 is 702 MB.

In addition to the operating system itself, the OpenBSD project is known for its components that have been adopted in other systems and proven to be among the most secure and high-quality solutions. Among them: LibreSSL (a fork of OpenSSL), OpenSSH, the packet filter PF, routing daemons OpenBGPD and OpenOSPFD, the NTP server OpenNTPD, mail server OpenSMTPD, terminal multiplexer (analog of GNU screen) tmux, identd daemon implementing the IDENT protocol, BSDL alternative to the GNU groff package — mandoc, protocol for organizing fault-tolerant systems CARP (Common Address Redundancy Protocol), lightweight HTTP server, and the file synchronization utility OpenRSYNC.

Key Improvements:

  • Support for the ARM64 architecture has been expanded. Support for the ARM8 EPAN (Enhanced Privileged Access Never) extension has been added, which blocks privileged access to memory pages used only for executing code. Support for the Qualcomm Snapdragon X Elite (X1E80100) processor has been integrated, and CPU detection for Cortex-A520AE (Hayes AE) and Cortex-A720AE (Hunter AE) has been implemented. Protection against Spectre-V4 class vulnerabilities has been realized for ARM64-based systems, and enhanced protection against Spectre-BHB vulnerabilities has also been added.
  • Support for AVX-512 instructions has been added for AMD64 architecture systems. Protection against the RFDS vulnerability in Intel Atom processors has been implemented.
  • Support for the Milk-V Pioneer board based on RISC-V architecture has been added.
  • The msyscall mechanism, used to mark memory areas from which system calls are allowed, has been removed. In its place, the mimmutable and pinsyscalls system calls were introduced.
  • Efforts have been made to improve support for energy-saving states S0 and transitioning to sleep mode on modern hardware. The 'suspend-to-idle' mode has been implemented on amd64 systems, which can be applied on hardware without S3 sleep mode support. Many driver issues preventing the use of sleep mode have been resolved.
  • A check for the presence of the ‘/’ character in file names has been added to the readdir system call to block potential attacks on applications when working with untrusted file systems.
  • Enhanced support for multi-processor systems (SMP). Added capabilities for parallel processing of incoming UDP packets and raw IPv4/IPv6 sockets on different CPU cores. Improved handling of locks for Unix4 and UDP sockets. AF_ROUTE sockets have been transitioned to a new lock management scheme. System calls like shutdown, sigsuspend, and kbind, as well as TCP timers and many sysctl options, have been freed from global locking.
  • Improvements have been made to the VMM hypervisor. Support for the AMD SEV (Secure Encrypted Virtualization) mechanism has been added to protect virtual machines from interference by the hypervisor or the host system administrator. Access to CPU capabilities from virtual machines has been improved. The 'status -r' command has been added to vmctl to display the status of only running virtual machines.
  • The implementation of the DRM (Direct Rendering Manager) framework has been synchronized with the Linux kernel 6.6.52 (previously 6.6.19). The inteldrm driver has been updated to support the GPU used in Intel processors based on the Meteor Lake microarchitecture.
  • The scandirat function has been ported from FreeBSD for iterating through directory contents.
  • The old DHCP client dhclient has been removed from the base system, replaced by the constantly running background process dhcpleased, which has been included since OpenBSD 6.9 and uses the ifconfig utility to enable autoconfiguration of network interfaces via DHCP (enabled by running 'ifconfig $if autoconf' or adding 'inet autoconf' to /etc/hostname.$if).
  • The use of the null character in shell scripts processed by the default command interpreter ksh is now prohibited. Presence of null characters in scripts will now lead to a termination with an error output, except in cases where they are included among the data attached at the end of the file after the code.
  • The tar utility has been transitioned to use the PAX format by default when creating archives. Using the PAX format will allow for longer file names, handle links, use accurate time information, and archive very large files.
  • The X11 stack Xenocara, used in OpenBSD to create a graphical environment, has integrated the libva library, enabling the use of the VA-API (Video Acceleration API) for hardware acceleration of video encoding and decoding in various formats. Hardware acceleration has been tested with drivers for Intel and AMD GPUs using the Firefox browser and the mpv media player. The necessary drivers for Intel GPUs are available in the ports graphics/intel-media-driver and graphics/intel-vaapi-driver, while the standard components from Mesa are used for AMD GPUs.
  • The option to run the KDE Plasma 6 desktop environment has been provided.
  • Support for new hardware has been added, along with new drivers related to various SoC components and support for Ethernet controllers. The igc and dwqe drivers have added support for hardware VLAN tagging, while the dwqe, vmx, igc, and vio(4) drivers now facilitate offloading network operations to the network cards.
  • The compiler has introduced the option "-fret-clean", which cleans the return address from the stack after the function call completes.
  • PPP interfaces are now operational in the routing domain (rdomain).
  • For IPv6, a new mode "sysctl net.inet6.ip6.forwarding = 2" has been added, allowing packet forwarding only for IPsec.
  • The getsockopt() function now supports the SO_ACCEPTCONN flag, allowing verification of whether the listen() function has been successfully called for the socket.
  • In iked, the implementation of the IKEv2 protocol for IPsec, support for authentication, authorization, and accounting through the RADIUS protocol has been added.
  • The radiusd RADIUS server has implemented support for DAE (Dynamic Authorization Extensions) and also allows accounting settings to be placed in radiusd.conf. Modules added include radiusd_ipcp for pool configuration and radiusd_file for authentication via a local file. The radiusctl command "ipcp delete" has been introduced to remove a specific session without dropping the connection. (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community.In OpenSMTPD, the smtpd-tables API for using tables in smtpd has been added, and the K_AUTH service has been implemented to extract credentials from tables.
  • A background process dhcp6leased has been added to obtain IPv6 prefixes from DHCPv6.
  • OpenSSH has been updated. A list of changes can be found in the announcements for OpenSSH 9.8 and OpenSSH 9.9. servers The number of ports for the AMD64 architecture reached 12,312 (up from 12,309), 12,148 for aarch64 (up from 12,145), and 10,534 for i386 (down from 10,830). Among the application versions in the ports:
  • Asterisk 16.30.1, 18.24.3, 20.9.3
  • Audacity 3.6.3
    • Asterisk 16.30.1, 18.24.3, 20.9.3
    • Audacity 3.6.3
    • CMake 3.30.1
    • Chromium 128.0.6613.137
    • Emacs 29.4
    • FFmpeg 4.4.5
    • GCC 8.4.0 and 11.2.0
    • GHC 9.6.6
    • GNOME 46
    • Go 1.23.1
    • JDK 8u402, 11.0.24, 17.0.12 and 21.0.4
    • KDE Applications 24.05.2
    • KDE Frameworks 6.5.0
    • KDE Plasma 6.1.4
    • Krita 5.2.3
    • LLVM/Clang 13.0.0, 16.0.6 and 17.0.6
    • LibreOffice 24.8.1.2
    • Lua 5.1.5, 5.2.4, 5.3.6 and 5.4.7
    • MariaDB 10.9.8
    • Mono 6.12.0.199
    • Mozilla Firefox 130.0.1 and ESR 128.2.0
    • Mozilla Thunderbird 128.2.3
    • Node.js 20.17.0
    • OpenLDAP 2.6.8
    • PHP 8.1.29, 8.2.23 and 8.3.11
    • Postfix 3.9.0
    • PostgreSQL 16.4
    • Python 2.7.18, 3.11.10
    • Qt 5.15.13 (+ patches from kde) and 6.6.3
    • R 4.4.1
    • Ruby 3.1.6, 3.2.5 and 3.3.5
    • Rust 1.81.0
    • SQLite 3.44.2
    • Shotcut 24.04.28
    • Sudo 1.9.15.5
    • Suricata 7.0.6
    • Tcl/Tk 8.5.19 and 8.6.13
    • TeX Live 2023
    • Vim 9.1.707 and Neovim 0.10.1
    • Xfce 4.18.1
  • Updated components from third-party developers included in OpenBSD 7.6:
    • The Xenocara graphics stack based on X.Org 7.7 with xserver 21.1.13 + patches, freetype 2.13.2, fontconfig 2.14.2, Mesa 23.3.6, xterm 393, xkeyboard-config 2.20, fonttosfnt 1.2.3.
    • LLVM/Clang 16.0.6 (+ patches)
    • GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
    • Perl 5.38.2 (+ patches)
    • NSD 4.9.1
    • Unbound 1.21.0
    • Ncurses 6.4
    • Binutils 2.17 (+ patches)
    • Gdb 6.3 (+ patches)
    • Awk as of July 28, 2024.
    • Expat 2.6.3
    • zlib 1.3.1 (+ patches)

Source: opennet.ru

Buy reliable website hosting with DDoS protection, VPS VDS servers 🔥 Buy reliable website hosting with DDoS protection, VPS VDS servers | ProHoster