After 11 months of development, FreeBSD 13.2 has been released. Installation images have been created for amd64, i386, powerpc, powerpc64, powerpc64le, powerpcspe, armv6, armv7, aarch64, and riscv64 architectures. Additionally, builds are prepared for virtualization systems (QCOW2, VHD, VMDK, raw) and cloud environments such as Amazon EC2, Google Compute Engine, and Vagrant.
Key changes:
- The ability to create snapshots of UFS and FFS file systems that have journaling enabled (soft updates) has been implemented. Support for background saving of dumps (running dump with the ‘-L’ flag) containing mounted UFS file systems with journaling enabled has also been added. Among the features that remain unavailable when using journaling is the background execution of integrity checks using the fsck utility.
- A functioning kernel-level driver wg has been accepted as part of the core with the implementation of a network interface for VPN WireGuard. To utilize the cryptographic algorithms required by the driver, the FreeBSD kernel crypto subsystem API was extended to include a wrapper that allows unsupported algorithms from the libsodium library to be used via the standard crypto API. During development, optimizations were also performed for even task distribution of encryption and decryption of packets to CPU cores, which reduced overhead when processing WireGuard packets.
The previous attempt to integrate WireGuard into FreeBSD was made in 2020 but ended in controversy, resulting in the removal of the already added code due to poor quality, careless buffer handling, the use of stubs instead of checks, incomplete protocol implementation, and GPL license violations. The new implementation was collaboratively prepared by the main development teams of FreeBSD and WireGuard with the participation of Jason Donenfeld, the author of VPN WireGuard, and John Baldwin, a well-known FreeBSD developer. Before adopting the new code, a complete review of the changes was conducted with the support of the FreeBSD Foundation.
- Support for the Netlink communication protocol (RFC 3549) has been implemented, which is used in Linux to facilitate interaction between the kernel and user-space processes. The project is limited to supporting the NETLINK_ROUTE family of operations for managing the state of the network subsystem in the kernel, which allows using the Linux utility ip from the iproute2 package to manage network interfaces. (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community., configure routing, and manipulate nexthop objects that hold state information used for routing packets to the desired destination.
- Address Space Layout Randomization (ASLR) is enabled by default for all executable files of the base system on 64-bit platforms. To selectively disable ASLR, you can use the commands “proccontrol -m aslr -s disable” or “elfctl -e +noaslr.”
- In ipfw, basic tables (Radix table) are used to look up MAC addresses, allowing the creation of tables with MAC addresses for traffic filtering. For example: ipfw table 1 create type mac ipfw table 1 add 11:22:33:44:55:66/48 ipfw add skipto tablearg src-mac ‘table(1)’ ipfw add deny src-mac ‘table(1, 100)’ ipfw add deny lookup dst-mac 1
- The kernel modules dpdk_lpm4 and dpdk_lpm6 have been added and are available for download through loader.conf, implementing the DIR-24-8 route search algorithm for IPv4/IPv6, which optimizes routing functions for hosts with very large routing tables (tests show a speed improvement of around 25%). The built-in route utility can be used to configure the modules (the FIB_ALGO option has been added).
- The ZFS file system implementation has been updated to the OpenZFS 2.1.9 release. The startup script zfskeys ensures the automatic loading of keys stored in the ZFS file system. A new RC script zpoolreguid has been added to assign a GUID identifier to one or more zpools (which is useful for virtualization environments with shared data).
- In the Bhyve hypervisor and the vmm module, support for attaching more than 15 virtual CPUs to the guest system has been implemented (controlled via sysctl hw.vmm.maxcpu). The bhyve utility has implemented emulation of the virtio-input device, allowing input events from the keyboard and mouse to be injected into the guest system.
- In KTLS, the implementation of the TLS protocol running at the FreeBSD kernel level has added support for hardware-accelerated TLS 1.3 by offloading certain operations related to the processing of encrypted incoming packets to the network card. Previously, such capability was available for TLS 1.1 and TLS 1.2.
- The growfs startup script has been enhanced to add a swap partition when expanding the root filesystem if such a partition was initially absent (for example, useful when installing a ready system image on an SD card). A new parameter, growfs_swap_size, has been added to rc.conf to manage the swap size.
- The hostid startup script now generates a random UUID if the /etc/hostid file is missing and the UUID cannot be obtained from the hardware. A new file, /etc/machine-id, has also been added with a compact representation of the host identifier (without dashes).
- New variables defaultrouter_fibN and ipv6_defaultrouter_fibN have been added to rc.conf, allowing you to add default routes to FIB tables different from the primary one.
- Support for SHA-512/224 hashes has been added to the libmd library.
- The pthread library has implemented support for the semantics of functions used in Linux.
- Support for decoding Linux system calls has been added to kdump. Both kdump and sysdecode now support tracing system calls in a Linux style.
- The killall utility has gained the ability to send signals to processes tied to a specific terminal (for example, 'killall -t pts/1').
- A new utility nproc has been added to display the number of computational units available to the current process.
- The pciconf utility has added support for decoding ACS (Access Control Services) parameters.
- A new configuration SPLIT_KERNEL_DEBUG has been added to the kernel, allowing debug information for the kernel and kernel modules to be written to separate files.
- The implementation of the vDSO (virtual dynamic shared objects) mechanism in ABI linux is nearly complete, providing a limited set of system calls accessible in user space without context switching. The ABI linux on ARM64 systems has been brought to parity with the implementation for the AMD64 architecture.
- Improved hardware support. Added performance monitoring (hwpmc) support for Intel Alder Lake CPUs. Updated the iwlwifi driver for Intel wireless cards to support new chips and the 802.11ac standard. Added the rtw88 driver for Realtek wireless cards with PCI interface. Enhanced the linuxkpi layer capabilities for use with FreeBSD Linux drivers.
- The OpenSSL library has been updated to version 1.1.1t, LLVM/Clang to version 14.0.5, and the SSH server and client have been updated to OpenSSH 9.2p1 (the previous version used OpenSSH 8.8p1). Versions of bc 6.2.4, expat 2.5.0, file 5.43, less 608, libarchive 3.6.2, sendmail 8.17.1, sqlite 3.40.1, unbound 1.17.1, and zlib 1.2.13 have also been updated.
Additionally, it has been announced that the following will be deprecated and removed starting from the FreeBSD 14.0 branch: OPIE one-time passwords, ce and cp drivers, ISA interface card drivers, the mergemaster and minigzip utilities, ATM components in netgraph (NgATM), the telnetd background process, and the VINUM class in geom.
Source: opennet.ru
