OpenBSD 3.8

Released November 1, 2005
Copyright 1997-2005, Theo de Raadt.
ISBN 0-9731791-6-3
3.8 Song: "Hackers of the Lost RAID"

• Order a CDROM from our ordering system.
• See the information on The FTP page for a list of mirror machines.
• Go to the pub/OpenBSD/3.8/ directory on one of the mirror sites.
• Briefly read the rest of this document.
• Have a look at The 3.8 Errata page for a list of bugs and workarounds.
• See a detailed log of changes between the 3.7 and 3.8 releases.

All applicable copyrights and credits can be found in the applicable file sources found in the files src.tar.gz, sys.tar.gz, xenocara.tar.gz, or in the files fetched via ports.tar.gz. The distribution files used to build packages from the ports.tar.gz file are not included on the CDROM because of lack of space.

What's New

This is a partial list of new features and systems included in OpenBSD 3.8. For a comprehensive list, see the changelog leading to 3.8.

• Improved hardware support, including:
  • New aps driver for the built-in accelerometer found in some IBM ThinkPad laptops.
  • New art driver for Accom Networks Artery T1 and E1 cards.
  • New auixp driver for the ATI IXP series integrated AC'97 audio controller.
  • New ciss driver for Compaq Smart ARRAY 5 and 6 RAID controllers.
  • New epic driver for SMC 83C170 ethernet adapters.
  • New ichwdt driver for Intel 6300ESB ICH watchdog timer.
  • New pcn driver for the AMD Am79c97x (PCnet) ethernet adapters.
  • New safte driver for SCSI Accessed Fault-Tolerant Enclosures, and a rewritten ses driver for SCSI Enclosure Services, both allowing monitoring through sysctl and sensorsd.
  • New ueagle driver for Analog Devices Eagle ADSL modems.
  • New uipaq driver for iPAQ USB serial.
  • New viasio driver for VIA VT1211 LPC Super I/O hardware sensors.
  • New zaudio driver for the built-in Zaurus audio CODEC.
  • Improved com driver for serial port PCMCIA cards, such as cellular modems on Zaurus.
  • Improved support for many umass devices.
  • Updated driver from X.Org for the Intel i810 family graphics chipset, including support for the external VGA output on laptops.

• New tools:
  • bioctl(8), a RAID management interface.
  • ipsecctl(8), a simple IPsec management tool.
  • stat(1), displaying file status obtained from stat(2) or lstat(2).
  • hostapd(8), a wireless Host Access Point daemon.
  • ifstated(8), a daemon monitoring ethernet interfaces status.
  • watchdogd(8), companion to the hardware watchdog devices.
  • ztsscale(8), a tool to calibrate the Zaurus touch screen.
  • xidle(1), a tool to run a program on X inactivity.
  • gzsig(1), create and verify cryptographic signatures built into gzip file headers.
  • sasyncd(8), a daemon to synchronize IPSec SA's for failover gateways.

• New functionality:
  • mount_udf(8), providing UDF (DVD) filesystem support.
  • Network interface aggregation, using the virtual trunk(4) interface.
  • Partial wide character and locale support in the C and C++ libraries.
  • wd(4) disks have the security feature frozen before being attached to prevent malicious users setting a password that would prevent the contents of the drive from being accessed.
  • On the OpenBSD/sparc64 platform, StackGhost buffer overflow exploit protection has been added.
  • zaudio(4) changes the mute values if the headphones are plugged in or out.

• New functionality for ospfd(8), the Open Shortest Path First Daemon:
  • ospfd is now able to redistribute static, connected and default routes.
  • ospfctl is now able to display all relevant information.
  • Interoperability with cisco and Extreme has been improved.
  • Support for parsing and displaying parsed configuration file, similar to bgpd.
  • Support for cryptographic authentication has been added.
  • Interface finite state machine has been reworked, primarily to improve interoperability.
  • The performance of the shortest path first calculation has been improved.
  • Numerous bugs have been discovered and fixed during the last 6 months.

• New functionality for bgpd(8), the Border Gateway Protocol Daemon:
  • bgpd is now able to redistribute static and connected routes dynamically.
  • Full route label support; pf(4) can filter based on information bgpd attaches to the routes.
  • An additional per prefix weight has been added used to evaluate prefixes with equal AS path length.
  • New route decision tunable rde med compare always to force bgpd to compare the MED independent of the peer AS.
  • IPv6 support.

• Assorted improvements and code cleanup:
  • malloc(3) has been rewritten to use the mmap(2) system call, introducing unpredictable allocation addresses and guard pages, which helps in detecting heap based buffer overflows and prevents various types of attacks.
  • libc(3) source code has been converted to ANSI C.
  • realpath(3) is now thread safe.
  • Several pathname races and potential buffer handling problems have been fixed in pax(1).
  • Problems with signal delivery on OpenBSD/sparc and OpenBSD/sparc64 have been fixed.
  • Reliability of signal handlers using floating point on OpenBSD/i386 and OpenBSD/macppc has been improved.
  • NFS write performance has been improved greatly.
  • Countermeasures against various blind ICMP attacks have been implemented.

• OpenSSH 4.2:
  • Adds a new compression method that delays the start of zlib compression until the user has been authenticated successfully. The new method ("Compression delayed") is on by default in the server and eliminates the risk of any zlib vulnerability leading to a compromise of the server from unauthenticated users.
  • Added support for the improved arcfour cipher modes from draft-harris-ssh-arcfour-fixes-02. The improves the cipher's resistance to a number of attacks by discarding early keystream output.
  • Many improvements to connection multiplexing, including a new opportunistic multiplexing mode, automatic fallback to plain connections when multiplexing fails and support for multiplexed X11 and agent forwarding.
  • Many additional bug fixes and improvements, as described in the release announcement.

• Over 3200 ports, 3000 pre-built packages, improved package tools.

• As usual, many improvements in manual pages and other documentation.

• The system includes the following major components from outside suppliers:
  • X.Org 6.8.2 (+ patches, and i386 contains XFree86 3.3.6 servers (+ patches) for legacy chipsets not supported by X.Org)
  • Gcc 2.95.3 (+ patches) and 3.3.5 (+ patches)
  • Perl 5.8.6 (+ patches)
  • Apache 1.3.29, mod_ssl 2.8.16, DSO support (+ patches)
  • OpenSSL 0.9.7g (+ patches)
  • Groff 1.15
  • Sendmail 8.13.4, with libmilter
  • Bind 9.3.1 (+ patches)
  • Lynx 2.8.5rel.2 with HTTPS and IPv6 support (+ patches)
  • Sudo 1.6.8p9
  • Ncurses 5.2
  • Latest KAME IPv6
  • Heimdal 0.6.3 (+ patches)
  • Arla 0.35.7
  • Binutils 2.15 (+ patches)
  • Gdb 6.3

How to install

Following this are the instructions which you would have on a piece of paper if you had purchased a CDROM set instead of doing an alternate form of install. The instructions for doing an FTP (or other style of) install are very similar; the CDROM instructions are left intact so that you can see how much easier it would have been if you had purchased a CDROM instead.

• CD1:3.8/i386/INSTALL.i386
• CD1:3.8/vax/INSTALL.vax

• CD2:3.8/amd64/INSTALL.amd64
• CD2:3.8/macppc/INSTALL.macppc

• CD3:3.8/sparc/INSTALL.sparc
• CD3:3.8/sparc64/INSTALL.sparc64

• FTP:.../OpenBSD/3.8/alpha/INSTALL.alpha
• FTP:.../OpenBSD/3.8/cats/INSTALL.cats
• FTP:.../OpenBSD/3.8/hp300/INSTALL.hp300
• FTP:.../OpenBSD/3.8/hppa/INSTALL.hppa
• FTP:.../OpenBSD/3.8/luna88k/INSTALL.luna88k
• FTP:.../OpenBSD/3.8/mac68k/INSTALL.mac68k
• FTP:.../OpenBSD/3.8/mvme68k/INSTALL.mvme68k
• FTP:.../OpenBSD/3.8/mvme88k/INSTALL.mvme88k
• FTP:.../OpenBSD/3.8/sgi/INSTALL.sgi
• FTP:.../OpenBSD/3.8/zaurus/INSTALL.zaurus

Quick installer information for people familiar with OpenBSD, and the use of the "disklabel -E" command. If you are at all confused when installing OpenBSD, read the relevant INSTALL.* file as listed above!

OpenBSD/i386:

Play with your BIOS options to enable booting from a CD. The OpenBSD/i386 release is on CD1. If your BIOS does not support booting from CD, you will need to create a boot floppy to install from. To create a boot floppy write CD1:3.8/i386/floppy38.fs to a floppy and boot via the floppy drive.

Use CD1:3.8/i386/floppyB38.fs instead for greater SCSI controller support, or CD1:3.8/i386/floppyC38.fs for better laptop support.

If you can't boot from a CD or a floppy disk, you can install across the network using PXE as described in the included INSTALL.i386 document.

If you are planning on dual booting OpenBSD with another OS, you will need to read INSTALL.i386.

To make a boot floppy under MS-DOS, use the "rawrite" utility located at CD1:3.8/tools/rawrite.exe. To make the boot floppy under a Unix OS, use the dd(1) utility. The following is an example usage of dd(1), where the device could be "floppy", "rfd0c", or "rfd0a".

# dd if=<file> of=/dev/<device> bs=32k

Make sure you use properly formatted perfect floppies with NO BAD BLOCKS or your install will most likely fail. For more information on creating a boot floppy and installing OpenBSD/i386 please refer to FAQ 4.3.1.

OpenBSD/vax:

Boot over the network via mopbooting as described in INSTALL.vax.

OpenBSD/amd64:

The 3.8 release of OpenBSD/amd64 is located on CD2. Boot from the CD to begin the install - you may need to adjust your BIOS options first. If you can't boot from the CD, you can create a boot floppy to install from. To do this, write CD2:3.8/amd64/floppy38.fs to a floppy, then boot from the floppy drive.

If you can't boot from a CD or a floppy disk, you can install across the network using PXE as described in the included INSTALL.amd64 document.

If you are planning to dual boot OpenBSD with another OS, you will need to read INSTALL.amd64.

OpenBSD/macppc:

Put CD2 in your CDROM drive and poweron your machine while holding down the C key until the display turns on and shows OpenBSD/macppc boot.

Alternatively, at the Open Firmware prompt, enter boot cd:,ofwboot /3.8/macppc/bsd.rd

OpenBSD/sparc:

The 3.8 release of OpenBSD/sparc is located on CD3. To boot off of this CD you can use one of the two commands listed below, depending on the version of your ROM.

ok boot cdrom 3.8/sparc/bsd.rd
or
> b sd(0,6,0)3.8/sparc/bsd.rd

If your SPARC system does not have a CD drive, you can alternatively boot from floppy. To do so you need to write CD3:3.8/sparc/floppy38.fs to a floppy. For more information see FAQ 4.3.1. To boot from the floppy use one of the two commands listed below, depending on the version of your ROM.

ok boot floppy
or
> b fd()

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

If your SPARC system doesn't have a floppy drive nor a CD drive, you can either setup a bootable tape, or install via network, as told in the INSTALL.sparc file.

OpenBSD/sparc64:

Put CD3 in your CDROM drive and type boot cdrom.

If this doesn't work, or if you don't have a CDROM drive, you can write CD3:3.8/sparc64/floppy38.fs or CD3:3.8/sparc64/floppyB38.fs (depending on your machine) to a floppy and boot it with boot floppy. Refer to INSTALL.sparc64 for details.

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

You can also write CD3:3.8/sparc64/miniroot38.fs to the swap partition on the disk and boot with boot disk:b.

If nothing works, you can boot over the network as described in INSTALL.sparc64.

OpenBSD/alpha:

Write FTP:3.8/alpha/floppy38.fs or FTP:3.8/alpha/floppyB38.fs (depending on your machine) to a diskette and enter boot dva0. Refer to INSTALL.alpha for more details.

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

OpenBSD/cats:

After updating the firmware to at least ABLE 1.95 if necessary, boot FTP:3.8/cats/bsd.rd from an ABLE-supported device (such as a CD-ROM or an existing FFS or EXT2FS partition).

OpenBSD/hp300:

Boot over the network by following the instructions in INSTALL.hp300.

OpenBSD/hppa:

Boot over the network by following the instructions in INSTALL.hppa or the hppa platform page.

OpenBSD/luna88k:

Copy bsd.rd to a Mach or UniOS partition, and boot it from the PROM. Alternatively, you can create a bootable tape and boot from it. Refer to the instructions in INSTALL.luna88k for more details.

OpenBSD/mac68k:

Boot MacOS as normal and extract the Macside "BSD/Mac68k Booter" utility from FTP:3.8/mac68k/utils onto your hard disk. Configure the "BSD/Mac68k Booter" with the location of your bsd.rd kernel and boot into the installer. Refer to the instructions in INSTALL.mac68k for more details.

OpenBSD/mvme68k:

You can create a bootable installation tape or boot over the network.
The network boot requires a MVME68K BUG version that supports the NIOT and NBO debugger commands. Follow the instructions in INSTALL.mvme68k for more details.

OpenBSD/mvme88k:

You can create a bootable installation tape or boot over the network.
The network boot requires a MVME88K BUG version that supports the NIOT and NBO debugger commands. Follow the instructions in INSTALL.mvme88k for more details.

OpenBSD/sgi:

Burn cd38.iso on a CD-R, put it in the CD drive of your machine and select Install System Software from the System Maintenance menu.

If your machine doesn't have a CD drive, you can setup a DHCP/tftp network server, and boot using "bootp()/bsd.rd". Refer to the instructions in INSTALL.sgi for more details.

OpenBSD/zaurus:

Using the Linux built-in graphical ipkg installer, install the openbsd38_arm.ipk package. Reboot, then run it. Read INSTALL.zaurus for a few important details.

Notes about the source code:

src.tar.gz contains a source archive starting at /usr/src. This file contains everything you need except for the kernel sources, which are in a separate archive. To extract:

# mkdir -p /usr/src
# cd /usr/src
# tar xvfz /tmp/src.tar.gz

sys.tar.gz contains a source archive starting at /usr/src/sys. This file contains all the kernel sources you need to rebuild kernels. To extract:

# mkdir -p /usr/src/sys
# cd /usr/src
# tar xvfz /tmp/sys.tar.gz

Both of these trees are a regular CVS checkout. Using these trees it is possible to get a head-start on using the anoncvs servers as described here. Using these files results in a much faster initial CVS update than you could expect from a fresh checkout of the full OpenBSD source tree.

How to upgrade

If you already have an OpenBSD 3.7 system, and do not want to reinstall, upgrade instructions and advice can be found in the Upgrade Guide.

Ports Tree

A ports tree archive is also provided. To extract:

# cd /usr
# tar xvfz /tmp/ports.tar.gz
# cd ports

The ports/ subdirectory is a checkout of the OpenBSD ports tree. Go read the ports page if you know nothing about ports at this point. This text is not a manual of how to use ports. Rather, it is a set of notes meant to kickstart the user on the OpenBSD ports system.

The ports/ directory represents a CVS (see the manpage for cvs(1) if you aren't familiar with CVS) checkout of our ports. As with our complete source tree, our ports tree is available via anoncvs. So, in order to keep current with it, you must make the ports/ tree available on a read-write medium and update the tree with a command like:

# cd [portsdir]/; cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_3_8

[Of course, you must replace the local directory and server name here with the location of your ports collection and a nearby anoncvs server.]

Note that most ports are available as packages through FTP. Updated packages for the 3.8 release will be made available if problems arise.

If you're interested in seeing a port added, would like to help out, or just would like to know more, the mailing list ports@openbsd.org is a good place to know.