release of a free cross-platform UNIX-like operating system . The OpenBSD project was founded by Theo de Raadt in 1995 after with the developers of NetBSD, which resulted in Theo being locked out of the NetBSD CVS repository. After that, Theo de Raadt and a group of like-minded individuals created a new open operating system based on the NetBSD source tree, with the main goals of portability ( 12 hardware platforms), standardization, proper operation, active security, and integrated cryptographic tools. The full installation size of the OpenBSD 6.7 base system is 470 MB.
In addition to the operating system itself, the OpenBSD project is known for its components, which have been widely adopted in other systems and have proven to be among the most secure and high-quality solutions. Among them are: ( OpenSSL), , the packet filter , routing daemons , NTP server , mail server , terminal multiplexer (analogous to GNU screen) , the daemon with an implementation of the IDENT protocol, BSDL alternative to the GNU groff package — , a protocol for fault-tolerant systems CARP (Common Address Redundancy Protocol), lightweight , file synchronization utility .
Key :
- The FFS2 file system, which uses 64-bit timestamps and block numbers, is now enabled by default in new installations for almost all supported architectures instead of FFS (except for landisk, luna88k, and sgi).
- A new method for validating system call access has been added, further complicating the exploitation of vulnerabilities. This method allows system calls to be executed only if they are made from pre-registered memory regions. A new system call, msyscall(), has been proposed to mark memory areas and activate the protection.
- The number of partitions that can be created on a single disk has increased from 7 to 15.
- The option parsing code in cron has been rewritten to support getopt-like features such as "-ns" and the re-specification of the same flags. The "options" field in crontab has been renamed to "flags". A flag "-s" has been added in crontab, allowing only one instance of a job to run at a time. The operator "~" has been added to indicate a random time value.
- In the cwm window manager, the ability to set the window size as a percentage of the primary window size in a tiled layout has been implemented.
- The default architecture for powerpc has switched to using Clang and a platform-independent implementation of mplock has been utilized.
- In apmd, automatic transitions to sleep and suspend modes (-z/-Z) have been enhanced — the daemon now responds to battery charge change messages sent by the power management driver. Going into sleep mode occurs with a 60-second delay, allowing the user time to take control.
- A configuration variable $REQUEST_SCHEME has been added to the built-in HTTP server to retain the original protocol (http or https) during redirects, as well as an option "strip", allowing multiple chroot in /var/www for FastCGI servers.
- The top utility now supports scrolling using the 9 and 0 keys.
- A mechanism for freeing memory pages in reverse order has been introduced, significantly enhancing the efficiency of actively freeing a large number of pages.
- In the unbound DNS server, DNSSEC checking is enabled by default.
- System calls are freed from global blocking.
__thrsleep(2), __thrwakeup(2), close(2), closefrom(2), dup(2), dup2(2), dup3(2), flock(2), fcntl(2), kqueue(2), pipe(2), pipe2(2), and nanosleep(2), as well as the basic part of ioctl(2). - Hardware support has been expanded. A new iwx driver for Intel AX200 wireless chips has been added, and support for Intel 9260 and 9560 devices has been added in the iwm driver. A rge driver for Realtek 8125 PCI Express 2.5Gb has been introduced. Many new drivers have been proposed to improve performance on arm64 and armv7 boards, including support for the Raspberry Pi 4 board and improved support for Raspberry Pi 2 and 3.
- The sndio audio subsystem has been expanded. The sioctl_open API and the sndioctl utility for managing sound via sndiod have been added. The /dev/mixer has been removed, and all ports have been transitioned to sndio instead of the kernel mixer interface. Hardware volume control mechanisms are utilized in sndiod. Access to /dev/audio* and /dev/rmidi* has been prohibited for regular users to enhance security.
- In the wireless stack, connections to any available Wi-Fi network that does not support encryption have been discontinued, except for an explicit call to the 'ifconfig join' command. Background scanning of available networks is initiated when the 'ifconfig scan' command is executed by the root user. The scanning results cache has been increased. A new ifconfig flag 'nwflag nomimo' has been added to help eliminate packet loss in 11n mode when the device has unconnected antenna slots. Support for active scanning mode has been added to the bwfm driver. Automatic switching between wireless networks has been improved by lowering the priority for networks that failed to connect.
- A new pppac driver has appeared in the network stack, which implements the PPP Access Concentrator interface. The npppd.conf settings have been transitioned to use pppac instead of tun. When packet forwarding is disabled, a check for destination address matching in the packet against the network interface address has been added. Support for mobileip has been removed.
- Users without root privileges are prohibited from using ioctl to change the network interface address and modify pppoe interface parameters.
- The sysupgrade feature has been enhanced to initiate firmware updates (fw_update) before rebooting ahead of the upgrade.
- The unveil system call has been improved, providing isolation of file system access. The number of applications from the base system protected using unveil has been increased to 82. This includes vmstat, iostat, and systat being transitioned to unveil.
- Support for RSA-PSS has been added in crypto(3).
- Support for DoT (DNS over TLS) has been added to the DNS resolver unwind. The command "unwindctl status memory" has also been introduced.
- The implementation of ipsec has been significantly upgraded. Support for automatic traffic shifting between rdomain during encryption and decryption has been added to protect against side-channel attacks. In iked, support for changing rdomain has been introduced, and a 'rdomain' option has been added to iked.conf.
For iked and isakmpd, the default IPSEC_LEVEL_REQUIRE has been set, prohibiting the processing of unencrypted packets that match the stream. The Diffie-Hellman group settings for IKE SA have been updated with curve25519, ecp256, ecp384, ecp521, modp3072, and modp4096 algorithms. In iked, the default authentication method has been changed to digital signature authentication (RFC 7427). ESN settings have been added to iked.conf. An option "-p" has been introduced to select a non-standard UDP port number. - The capabilities of the terminal multiplexer tmux have been expanded with many new options added.
- The version of the OpenSMTPD mail server has been updated. Built-in filters now implement the keyword "bypass" to skip processing under certain conditions. The use of the current session's smtpd username has been allowed in filters. In smtpd.conf, the parameters now permit mail-from and rctp-to usage.
- The OpenSSH 8.2 package has been updated, which now supports FIDO/U2F two-factor authentication tokens. A detailed overview of the improvements can be seen. .
- The LibreSSL package has finalized the implementation of TLS 1.3 based on the new state machine and record processing subsystem. Currently, only the client side of TLS 1.3 is enabled by default, while the server side is planned to be activated by default in one of the future releases. A list of other changes can be found in the release announcements. and .
- The number of ports for the AMD64 architecture is 11268, for aarch64 — 10848, for i386 — 10715. Updated components from third-party developers included in OpenBSD 6.7:
- The Xenocara graphics stack based on X.Org 7.7 with xserver 1.20.8 + patches, freetype 2.10.1, fontconfig 2.12.4, Mesa 19.2.8, xterm 351, xkeyboard-config 2.20;
- LLVM/Clang 8.0.1 (with patches)
- GCC 4.2.1 (with patches) and 3.3.6 (with patches)
- Perl 5.30.2 (with patches)
- NSD 4.2.4
- Unbound 1.10.0
- Ncurses 5.7
- Binutils 2.17 (with patches)
- Gdb 6.3 (with patches)
- Awk from December 20, 2012.
- Expat 2.2.8
Source: opennet.ru
