ProHoster > Blog > Internet News > Release OpenBSD 7.4

Release OpenBSD 7.4

The release of the free UNIX-like operating system OpenBSD 7.4 has been presented. The OpenBSD project was founded by Theo de Raadt in 1995 after a conflict with the NetBSD developers, which resulted in Theo being locked out of the NetBSD CVS repository. Following this, Theo de Raadt and a group of like-minded individuals created a new open operating system based on the NetBSD source tree, with the main development goals being portability (supporting 13 hardware platforms), standardization, correct operation, proactive security, and integrated cryptographic tools. The size of the full installation ISO image of the base system OpenBSD 7.4 is 630 MB.

In addition to the operating system itself, the OpenBSD project is known for its components that have been adopted in other systems and proven to be among the most secure and high-quality solutions. Among them: LibreSSL (a fork of OpenSSL), OpenSSH, the packet filter PF, routing daemons OpenBGPD and OpenOSPFD, the NTP server OpenNTPD, mail server OpenSMTPD, terminal multiplexer (analog of GNU screen) tmux, identd daemon implementing the IDENT protocol, BSDL alternative to the GNU groff package — mandoc, protocol for organizing fault-tolerant systems CARP (Common Address Redundancy Protocol), lightweight HTTP server, and the file synchronization utility OpenRSYNC.

Key Improvements:

  • For amd64 and i386 architectures, components have been added for updating the microcode for AMD processors. New microcode versions are installed automatically during boot. A port "ports/sysutils/firmware/amd" has been prepared for distributing binary files with the microcode. Installing the new microcode is done using the built-in utility fw_update. Similar microcode update support for Intel processors was implemented in 2018 and was offered in the OpenBSD 6.3 release.
  • For the kernel and user space, protections mechanisms IBT (Indirect Branch Tracking, amd64) and BTI (Branch Target Identification, arm64) have been included, designed to block disruptions to normal execution order (control flow) as a result of exploits that alter stored function pointers in memory (the implemented protection does not allow malicious code to jump to the middle of a function).
  • On systems with arm64 architecture, pointer authentication has been enabled for user space protection. This technology allows the use of specialized ARM64 instructions to verify return addresses using digital signatures stored in the unused upper bits of the pointer itself.
  • The settings for the system compiler clang, as well as clang and gcc from ports, have been modified to implement the aforementioned protection mechanisms, significantly enhancing the security of all base applications and most applications from ports against exploits that use return-oriented programming (ROP) techniques. When using ROP, the attacker does not attempt to place their code in memory but operates with existing pieces of machine instructions already in loaded libraries that end with a return control instruction (typically the endings of library functions). The exploit's operation is reduced to building a chain of calls to such blocks ('gadgets') to achieve the desired functionality.
  • A new system call kqueue1 has been added, differing from kqueue by the way it handles flags. Currently, kqueue1 only supports the O_CLOEXEC (close-on-exec) flag for automatic closure of file descriptors in the child process after the exec() call.
  • Support for the pseudo-device dt has been implemented for amd64 and i386 architectures to organize dynamic tracing of systems and applications. A system call utrace has been added to insert user records into the ktrace log.
  • Fixes have been ported from FreeBSD to eliminate undefined behavior when using MS-DOS file systems.
  • The softdep mounting option applied for delayed grouped metadata writes has been disabled.
  • Programs secured by the unveil system call are allowed to save core dumps in the current working directory.
  • For the ARM64 architecture, the ability to transition into deep idle states available in Apple M1/M2 chips has been implemented for energy savings and sleep mode realization.
  • A bypass protection against the Zenbleed vulnerability in AMD processors has been added.
  • Support for multiprocessor systems (SMP) has been improved. The arprequest() function, code for processing incoming ARP packets, and implementation for neighbor discovery in the IPv6 stack have been freed from locks.
  • The interface for synchronizing the packet filter tables pfsync has been rewritten to improve locking performance and compatibility with future efforts aimed at parallelizing the network stack.
  • The implementation of the drm (Direct Rendering Manager) framework is synchronized with the Linux kernel 6.1.55 (previous release was 6.1.15). Improved performance on systems with Intel processors based on Alder Lake and Raptor Lake microarchitectures.
  • Enhancements have been made to the VMM hypervisor. Support for a multi-threaded model for block and network virtio devices has been implemented in vmd. The block virtio device now supports vector input/output in zero-copy mode. Access to AMD processors' p-state modes has been restricted for guest systems. Owners are allowed to override the loaded kernel through vmctl. of virtual machines Owners are permitted to override the loaded kernel through vmctl.
  • A new header file uchar.h has been added containing the types char32_t and char16_t, along with the functions c32rtomb(), mbrtoc32(), c16rtomb(), and mbrtoc16(), as specified in the C11 standard.
  • An option "D" has been added to the malloc function to detect memory leaks using ktrace ("MALLOC_OPTIONS=D ktrace -tu program") and kdump ("kdump -u malloc …").
  • Support for the ${.VARIABLES} variable has been added to the make utility to output the names of all set global variables.
  • An option "-u" has been added to the kdump utility to select utrace tracing points based on a specified label.
  • The openrsync utility has gained the options "—size-only" and "—ignore-times".
  • Random offsets are now supported in cron and crontab when specifying value ranges with a given step, preventing simultaneous resource requests from different machines with the same cron rules. For example, specifying "0~59/30" or "~30" in the minute field will result in the command running twice an hour with sequentially randomly chosen intervals.
  • The wsconsctl utility has been enhanced with the ability to map buttons for two or three finger taps on the touchpad.
  • Support for new hardware has been added, and new drivers have been included.
  • Installation on systems with armv7 and arm64 processors has been improved.
  • Support for loading files from the EFI System Partition has been added.
  • The installer has improved support for software RAID (softraid). The ability to place the root partition in softraid on riscv64 and arm64 systems has been added. Softraid has been included in ramdisk for the powerpc64 architecture. For arm64, support for disk encryption (Guided Disk Encryption) has been implemented.
  • The malloc function now checks all blocks in the delayed memory release list to detect instances of writing to freed memory regions.
  • To execute the shutdown command, a user must now be added to the '_shutdown' group, which allows for the separation of privileges related to system shutdown and direct reading from disk devices.
  • Using the unveil system call, the patch utility is limited in access only to the current directory, the temporary file directory, and files listed in the command line.
  • A new sysctl net.inet6.icmp6.nd6_queued has been added to display the number of packets awaiting ND6 responses (similar to ARP).
  • When configuring an IPv6 address on a network interface, an announcement is sent to neighboring routers using the multicast address.
  • Initial support for TSO (TCP Segmentation Offload) and LRO (TCP Large Receive Offload) has been added for processing segments and merging packets on the network card side.
  • The loading of rules from the pf packet filter kernel has been accelerated by the pfctl utility. Processing of actions 'keep state' and 'nat-to' for returning ICMP error messages has been enabled.
  • Checksum calculations for IP, TCP, and UDP have been disabled for loopback interfaces.
  • Initial support added VPN IPsec, dependent on routing (route-based).
  • Support for Flowspec (RFC5575) has been added to bgpd (currently only supporting the announcement of flowspec rules). The implementation of ASPA (Autonomous System Provider Authorization) has been brought in line with the specifications draft-ietf-sidrops-aspa-verification-16 and draft-ietf-sidrops-aspa-profile-16, and has been transitioned to use AFI-independent lookup tables.
  • Performance of the rpki-client has been increased by 30-50%. Support for gzip and deflate compression has been added.
  • Packages LibreSSL and OpenSSH have been updated. A detailed overview of improvements can be found in the reviews for LibreSSL 3.8.0, OpenSSH 9.4, and OpenSSH 9.5.
  • The number of ports for the AMD64 architecture has reached 11845 (up from 11764), for aarch64 — 11508 (down from 11561), and for i386 — 10603 (up from 10572). Among the application versions in the ports are:
    • Asterisk 16.30.1, 18.19.0, 20.4.0
    • Audacity 3.3.3
    • CMake 3.27.5
    • Chromium 117.0.5938.149
    • Emacs 29.1
    • FFmpeg 4.4.4
    • GCC 8.4.0 and 11.2.0
    • GHC 9.2.7
    • GNOME 44
    • Go 1.21.1
    • JDK 8u382, 11.0.20, and 17.0.8
    • KDE Applications 23.08.0
    • KDE Frameworks 5.110.0
    • Krita 5.1.5
    • LLVM/Clang 13.0.0 and 16.0.6
    • LibreOffice 7.6.2.1
    • Lua 5.1.5, 5.2.4, 5.3.6, and 5.4.6
    • MariaDB 10.9.6
    • Mono 6.12.0.199
    • Mozilla Firefox 118.0.1 and ESR 115.3.1
    • Mozilla Thunderbird 115.3.1
    • Mutt 2.2.12 and NeoMutt 20230517
    • Node.js 18.18.0
    • OpenLDAP 2.6.6
    • PHP 7.4.33, 8.0.30, 8.1.24, and 8.2.11
    • Postfix 3.7.3
    • PostgreSQL 15.4
    • Python 2.7.18, 3.9.18, 3.10.13, and 3.11.5
    • Qt 5.15.10 and 6.5.2
    • R 4.2.3
    • Ruby 3.0.6, 3.1.4, and 3.2.2
    • Rust 1.72.1
    • SQLite 3.42.0
    • Shotcut 23.07.29
    • Sudo 1.9.14.2
    • Suricata 6.0.12
    • Tcl/Tk 8.5.19 and 8.6.13
    • TeX Live 2022
    • Vim 9.0.1897 and Neovim 0.9.1
    • Xfce 4.18
  • Third-party components included in OpenBSD 7.3 have been updated:
    • The Xenocara graphical stack based on X.Org 7.7 with xserver 21.1.8 + patches, freetype 2.13.0, fontconfig 2.14.2, Mesa 22.3.7, xterm 378, xkeyboard-config 2.20, fonttosfnt 1.2.2.
    • LLVM/Clang 13.0.0 (+ patches)
    • GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
    • Perl 5.36.1 (+ patches)
    • NSD 4.7.0
    • Unbound 1.18
    • Ncurses 5.7
    • Binutils 2.17 (+ patches)
    • Gdb 6.3 (+ patch)
    • Awk 12.9.2023
    • Expat 2.5.0.

Source: opennet.ru

Buy reliable website hosting with DDoS protection, VPS VDS servers 🔥 Buy reliable website hosting with DDoS protection, VPS VDS servers | ProHoster