the release of a free, cross-platform UNIX-like operating system . The OpenBSD project was founded by Theo de Raadt in 1995, after with the developers of NetBSD, which resulted in Theo being locked out of the NetBSD CVS repository. After that, Theo de Raadt and a group of like-minded individuals created a new open operating system based on the NetBSD source tree, with the main goals of portability ( 13 hardware platforms), standardization, reliability, active security, and integrated cryptographic tools. The size of the full installation the base system of OpenBSD 6.5 is 407 MB.
In addition to the operating system itself, the OpenBSD project is known for its components, which have been widely adopted in other systems and have proven to be among the most secure and high-quality solutions. Among them are: ( OpenSSL), , the packet filter , routing daemons , NTP server , mail server , terminal multiplexer (analogous to GNU screen) , the daemon with an implementation of the IDENT protocol, BSDL alternative to the GNU groff package — , a protocol for fault-tolerant systems CARP (Common Address Redundancy Protocol), lightweight , file synchronization utility .
Among the most notable changes: a portable version of bgpd has been introduced, adapted for use on other operating systems, root privileges have been eliminated from the use of Xenocara and tcpdump, the LDD linker has been enabled by default for amd64 and i386, support for MPLS has been significantly improved, protection against exploits using return-oriented programming (ROP) has been enhanced, a simple recursive DNS server unwind has been added, an undefined behavior detector has been integrated into the kernel, and a custom implementation of the rsync utility has been introduced.
Key :
- When building for the amd64 and i386 architectures, the LDD linker, developed by the LLVM project, is enabled by default. Support for building using Clang has been added for the mips64 architecture;
- New drivers pvclock for the KVM paravirtualized timer and ixl for Intel Ethernet 700 have been introduced. The uaudio driver has been replaced with a new implementation supporting USB Audio 2.0.
- The performance of the wireless device drivers bwfm, iwn, iwm, and athn has been improved. The wireless stack now includes support for RTM_80211INFO messages to provide detailed interface state information to the dhclient and route commands. The default behavior when connecting to wireless networks has been changed: if an autoconnect list is configured, OpenBSD will no longer connect to unknown open networks (to revert to previous behavior, an empty network can be added to the list);
- In the networking stack, new pseudo-device drivers bpe (Backbone Provider Edge) and mpip (MPLS IP layer 2) have been introduced. Additional support for configuring alternative routing domains has been added for MPLS interfaces. The vlan driver now operates bypassing queue processing, outputting directly to the parent network interface. The txprio mode has been added to ifconfig for managing priority encoding in the headers of tunneled packets (supported for vlan, gre, gif, and etherip drivers);
- In the bpf filter implementation, the ability to apply the drop mechanism without capturing packets has been introduced. This functionality is utilized in tcpdump for filtering packets at the initial stage of their reception by the device;
- The installer now supports to add a disk image to the RAMDISK of the kernel. Some components from older releases have been removed during the system update process;
- Improved system call , which provides isolation of access to the file system. The new version adds the ability to determine matches relative to the working directory of the current process when parsing relative paths. The use of stat and access for restricted components of file paths is prohibited. Applications ospfd, ospf6d, rebound, getconf, kvm_mkdb, bdftopcf, Xserver, passwd, spamlogd, spamd, sensorsd, snmpd, htpasswd, and ifstated have been secured using unveil;
- In Clang, tools for blocking the application of return-oriented programming (ROP) techniques have been improved, significantly reducing the number of polymorphic gadgets found in resulting executable files for i386 and amd64 architectures;
- In Clang, performance and security have been enhanced with the application of
protection mechanism , aimed at complicating the execution of exploits built using code reuse and return-oriented programming techniques. To accelerate operations, data is stored in registers whenever possible instead of the stack, and the processor cache is used more efficiently during returns. RETGUARD is now also used instead of traditional stack protection on amd64 and arm64 systems; - Utilities related to the network stack have been improved: MPLS packet filtering support has been added to pcap-filter. Routing priority configuration has been added in ospfd, ospf6d, and ripd. In
ripd, protection has been added based on the mechanism. The ifconfig tool has introduced sff and sffdump modes for obtaining diagnostic information from optical transmitters; - The first release of the new resolver has been introduced, processing recursive DNS queries and accepting connections only on the interface 127.0.0.1. , handling recursive DNS requests and accepting connections only on the interface 127.0.0.1.
Unwind is designed for use on client systems, such as laptops, moving between different wireless networks. If DNS traffic blocking is detected in the local network, unwind switches to using the recursively queried DNS server address passed via DHCP but continues to periodically attempt to resolve on its own and returns to self-resolution as soon as direct queries are successful. - The bgpd has undergone enhancements to reduce memory consumption, a simple rule optimizer has been added (merging filtering rules that only differ by filter sets), the BGP MPLS VPN configuration process has been modified, support for IPv6 BGP MPLS VPN has been added, the
- An option has been added to identify cases of undefined behavior in the OpenBSD kernel.
- The tcpdump utility has been completely freed from the use of root privileges;
- malloc performance has been improved in multithreaded applications;
- A preliminary version of the program has been included with its own implementation of the file synchronization utility rsync;
- The version of the OpenSMTPD mail server has been updated, in which a new matching criterion 'from rdns' has been added in smtpd.conf, allowing the selection of services based on reverse DNS resolution (hostname identification by IP). Regular expressions can be applied when querying the tables;
- The OpenSSH 8.0 package has been updated, and a detailed overview of the improvements can be viewed ;
- The LibreSSL package has been updated, and a detailed overview of the improvements can be found in the release announcements. and ;
- In Mandoc, the HTML output has been significantly improved, table rendering has been enhanced, and a flag '-O' has been added to open a page with the definition of the specified term;
- The capabilities of the Xenocara graphics stack have been expanded: the X server no longer requires installation with the setuid flag to run. The Mesa driver for radeonsi has included support for hardware acceleration for Southern Islands (Radeon HD 7000) and Sea Islands (Radeon HD 8000) GPUs.
- Ports in C++ for architectures not supported in Clang are now built using GCC from the ports. The number of ports for the AMD64 architecture was 10,602, for aarch64 — 9,654, for i386 — 10,535. Among the applications found in the ports, the following are noted:
- Asterisk 16.2.1
- Audacity 2.3.1
- CMake 3.10.2
- Chromium 73.0.3683.86
- FFmpeg 4.1.3
- GCC 4.9.4 and 8.3.0
- GNOME 3.30.2.1
- Go 1.12.1
- JDK 8u202 and 11.0.2+9-3
- LLVM/Clang 7.0.1
- LibreOffice 6.2.2.2
- Lua 5.1.5, 5.2.4 and 5.3.5
- MariaDB 10.0.38
- Mono 5.18.1.0
- Mozilla Firefox 66.0.2 and ESR 60.6.1
- Mozilla Thunderbird 60.6.1
- Node.js 10.15.0
- OpenLDAP 2.3.43 and 2.4.47
- PHP 7.1.28, 7.2.17 and 7.3.4
- Postfix 3.3.3 and 3.4.20190106
- PostgreSQL 11.2
- Python 2.7.16 and 3.6.8
- R 3.5.3
- Ruby 2.4.6, 2.5.5 and 2.6.2
- Rust 1.33.0
- Sendmail 8.16.0.41
- SQLite3 3.27.2
- Suricata 4.1.3
- Tcl/Tk 8.5.19 and 8.6.8
- TeX Live 2018
- Vim 8.1.1048 and Neovim 0.3.4
- Xfce 4.12
- Third-party components included in OpenBSD 6.5:
- The Xenocara graphics stack based on X.Org server 1.19.7 with patches, freetype 2.9.1, fontconfig 2.12.4, Mesa 18.3.5, xterm 344, xkeyboard-config 2.20;
- LLVM/Clang 7.0.1 (with patches)
- GCC 4.2.1 (with patches) and 3.3.6 (with patches)
- Perl 5.28.1 (with patches)
- NSD 4.1.27
- Unbound 1.9.1
- Ncurses 5.7
- Binutils 2.17 (with patches)
- Gdb 6.3 (with patches)
- Awk Aug 10, 2011
- Expat 2.2.6
Source: opennet.ru
