OpenBSD 4.8

Released Nov 1, 2010
Copyright 1997-2010, Theo de Raadt.
ISBN 978-0-9784475-6-4
4.8 Song: "El Puffiachi"

• Order a CDROM from our ordering system.
• See the information on The FTP page for a list of mirror machines.
• Go to the pub/OpenBSD/4.8/ directory on one of the mirror sites.
• Briefly read the rest of this document.
• Have a look at The 4.8 Errata page for a list of bugs and workarounds.
• See a detailed log of changes between the 4.7 and 4.8 releases.

All applicable copyrights and credits can be found in the applicable file sources found in the files src.tar.gz, sys.tar.gz, xenocara.tar.gz, or in the files fetched via ports.tar.gz. The distribution files used to build packages from the ports.tar.gz file are not included on the CDROM because of lack of space.

What's New

This is a partial list of new features and systems included in OpenBSD 4.8. For a comprehensive list, see the changelog leading to 4.8.

• New/extended platforms:
  • i386 and amd64:
    • ACPI-based suspend/resume works on most machines with Intel/ATI video. Machines using NVidia graphics will not resume the graphics. cardbus(4) and pcmcia(4) will still have some problems, too.

• Improved hardware support, including:
  • New acpisony(4) driver for Sony ACPI control.
  • New itherm(4) driver for Intel 3400 temperature sensor.
  • New se(4) driver for SiS 190 10/100/Gigabit Ethernet devices.
  • New uguru(4) driver for ABIT temperature, voltage and fan sensors.
  • New owctr(4) driver for 1-Wire counter devices.
  • New pgs(4) driver for Programmers Switch found on some macppc machines.
  • Support for 82576 fiber and 82577/82578 (PCH) based devices has been added to em(4).
  • Support for 24-bit encodings and USB 2.0 playback has been added to uaudio(4).
  • Support for Winbond/Nuvoton W83627DHG-P has been added to wbsio(4).
  • Support for RTL8168E has been added to re(4).
  • Support for 800x480 has been added to udl(4).
  • Support for M-audio Audiophile 192k has been added to envy(4).
  • Support for Intel Core i3/i5 internal graphics (Ironlake) has been added to inteldrm(4) and agp(4).
  • The ss(4) and usscanner(4) drivers have been removed.
  • Improved robustness of several SCSI/SAS/RAID HBA drivers, including mpi(4), mpii(4) and ciss(4).

• New tools:
  • iked(8), an Internet Key Exchange version 2 (IKEv2) daemon.
  • ldapd(8), a Lightweight Directory Access Protocol (LDAP) daemon.

• Filesystem midlayer improvements:
  • fix internal locking in (still experimental!) NTFS.

• OpenBGPD, OpenOSPFD and other routing daemon improvements:
  • bgpd(8) control sockets are now specified in the config file. This removes the -s and -r arguments to bgpd.
  • Extended the BGP MPLS VPN support to allow Layer-3 MPLS VPNs to be terminated on OpenBSD with the help of mpe(4), ldpd(8), and bgpd(8).
  • bgpd(8) supports multiple FIBs and it is possible to assign them to RIBs for redistribution.
  • bgpd now supports to use neighbor-as in AS filter statements and added two new filters -- max-as-seq and max-as-len -- to limit the length of a sequence of a single AS or the total length of an AS path.
  • Added softreconfig support in bgpd for peers changing the RIB.
  • Fixed multiprotocol MRT dumps and added 4-byte AS-Number support in bgpd(8).
  • Added support for ping6 and traceroute6 in bgplg(8) and bgplgsh(8)
  • ospfd(8) has better LSA pruning and config reload support.
  • ospf6d(8) now supports LSAs larger than the link MTU, has improved interoperability with other OSPFv3 implementations, can redistribute the default route, and will correctly handle IPv6 prefixes advertised by neighbours on the same link but not configured on the router itself.
  • Various improvements in ldpd(8) including correct penultimate hop popping, better session handling, and a improved config file parser.

• Generic network stack improvements:
  • ifconfig(8) and route(8) get better Multiprotocol Label Switching support.
  • traceroute(8) now supports extended ICMP headers which allows printing of MPLS labels.
  • Support for RFC 4941 privacy extensions for stateless address autoconfiguration has been added to inet6(4) and can be enabled via ifconfig(8).
  • ifconfig(8) now supports random selection of MAC addresses.
  • tcpdump(8) now decodes Multicast Listener Discovery version 2 and Internet Key Exchange version 2 traffic.
  • enc(4) and ipsec(4) are now aware of routing domains.
  • dhcpd(8) and dhclient(8) and are now capable of running in different routing domains.
  • Added MPLS support and a simple keepalive mechanism to gre(4).
  • Added MPLS support to gif(4).
  • Support for 802.1ad-style QinQ nested VLANs with the addition of svlan(4) (service VLAN) interfaces.
  • Added a RTM_DESYNC routing message as indicator that route messages got dropped because of insufficent buffer space. ospfd(8) uses this message to keep the internal view of the routing table in sync.

• SCSI improvements:
  • better cd(4) detaching.
  • better st(4) sense data and buf handling.
  • eliminate excessive delays when starting DVD playing.
  • ask only for minimal (i.e. 18 bytes) sense data, fixing usb devices.
  • migrate to using bufq.
  • always try READ CAPACITY 16 on devices claiming to be SCSI-3.
  • many performance and reliability improvements as a result of new SCSI midlayer:
    • introduce round-robin scheduling of resources for outstanding device commands to prevent a single device from monopolising the bus.
    • significant reduction in memory consumption used for tracking devices attached to buses.
    • eliminate many unnecessary splbio/splx calls in SCSI drivers.
    • eliminate many use after free's exposed by new SCSI midlayer.
    • eliminate scsi_scsi_cmd(), simplifying calling inside SCSI midlayer.
    • eliminate struct scsi_device.
    • eliminate many uninitialized data references and invalid scsi_done() calls exposed by new SCSI midlayer.
    • eliminate use of EAGAIN.
    • eliminate almost all uses of NO_CCB and XS_NO_CCB.

• Assorted improvements:
  • mbtowc(3) multi-byte/wide-character conversion functions have been added to the C library, and setlocale(3) now supports the en_US.UTF-8 locale.
  • posix_madvise(2), posix_memalign(3), strndup(3), and strnlen(3) have been added to the C library.
  • The event(3) library was updated to version 1.4.14b.
  • The pthreads(3) library now implements the pthread_rwlock_timed{rd,wr}lock interfaces.
  • AES-NI support has been integrated into the OpenSSL crypto(3) library.
  • MIDI control in non-server mode was added to aucat(1), including seeking within .wav files
  • A new record-what-you-hear feature was added to aucat(1).
  • The minimum extra latency of the aucat(1) server was lowered to a single block, improving usability of low-latency programs without stability compromise.
  • disklabel(8) now supports unique disk identifiers.
  • ftp(1) now handles redirection to relative URLs in the Location: header of HTTP responses.
  • lint(1) now recognizes the C99 data types _Bool and _Complex and some related gcc extensions.
  • make(1) now allows variables in SysV modifiers, and implements the :QL (quote list) modifier.
  • man(1) now allows to combine the -s option with -m or -M.
  • Improved directory editing in mg(1).
  • newfs(8) has been tweaked to better support large file systems.
  • od(1) now supports the POSIX -A option to select an input address base.
  • sendbug(1) now includes the output of usbdevs -v into the template.
  • smtpd(8) now supports the SIZE and ENHANCEDSTATUSCODES extensions and the "plain" backend for maps, and performance was improved when handling large amounts of mail.
  • snmpd(8) now supports the IP-FORWARD-MIB.
  • wsconsctl(8) now handles more than one keyboard, mouse and display.
  • Many memory leaks have been fixed in various userland utilities.
  • amd64, i386, hppa, sparc64, socppc and macppc platforms were switched over to gcc4.
  • newfs(8) now makes FFS2 the default for partitions larger than INT_MAX blocks.
  • dhcpd(8) now includes the server id in NAK messages, as required by some relays.
  • disklabel(8) now aligns the start and end of FFS partitions on bsize boundaries where it can, to improve performance on 4096-byte block devices.
  • by default, read and write caching is now turned on for non-USB scsi disks.
  • getdirentries(2) now checks to ensure that it doesn't wrap or truncate directory information on architectures where LONG is a different size from LONG LONG.
  • disklabel(8) now ensures correct physical bounds and disk size are used when building a disklabel from saved ascii disklabel.
  • it is again possible to build a bsd.rd that has DDB.
  • pms(4) now works much better with various trackpads and over suspend/resume cycles.
  • fdisk(8) now aligns the OpenBSD partition on a power of 2 block boundary to improve performance on 4096-byte block devices.
  • nfsd(8) now logs start up errors to the system log as well as the console.
  • nfsd(8) now errors out if given an invalid number of servers to run.

• Install/Upgrade process changes:
  • If the system time is off by more than 120 seconds, ask if the user wants to set it accordingly.
  • disklabel(8) now allows to customize auto allocated labels using the -R option.
  • Default network install method changed from FTP to HTTP.
  • Automatically set /etc/pkg.conf `installfrom' entry to the public mirror used while installing or upgrading.
  • sysmerge(8) now automatically installs missing users and groups.
  • Eliminate more excessively chatty remarks during install.
  • Handle disk UID partitions better.

• OpenSSH 5.6:
  • New features:
    • Added a ControlPersist option to ssh_config(5).
    • Hostbased authentication may now use certificate host keys.
    • ssh-keygen(1) now supports signing certificate using a CA key that has been stored in a PKCS#11 token.
    • ssh(1) will now log the hostname and address that we connected to at LogLevel=verbose after authentication is successful to mitigate "phishing" attacks.
    • Expand %h to the hostname in ssh_config Hostname options.
    • Allow ssh-keygen(1) to import and export of PEM and PKCS#8 keys.
    • sshd(8) will now queue debug messages for bad ownership or permissions on the user's keyfiles encountered during authentication.
    • ssh(1) connection multiplexing now supports remote forwarding with dynamic port allocation and can report the allocated port back to the user.
    • sshd(8) now supports indirection in matching of principal names listed in certificates. sshd(8) now has a new AuthorizedPrincipalsFile option.
    • Additional sshd_config(5) options are now valid inside Match blocks:
      • AuthorizedKeysFile
      • AuthorizedPrincipalsFile
      • HostbasedUsesNameFromPacketOnly
      • PermitTunnel
  • The following significant bugs have been fixed in this release:
    • The PKCS#11 code now retries a lookup for a private key if there is no matching key with CKA_SIGN attribute enabled (bz#1736).
    • Unbreak strdelim() skipping past quoted strings.
    • sftp(1): fix swapped args in upload_dir_internal() (bz#1797).
    • Fix a longstanding problem where if you suspend scp(1) at the password/passphrase prompt the terminal mode is not restored.
    • Fix a PKCS#11 crash on some smartcards by validating the length returned for C_GetAttributValue (bz#1773).
    • sftp(1): fix ls in working directories that contain globbing characters in their pathnames (bz#1655).
    • Print warning for missing home directory when ChrootDirectory=none. (bz#1564).
    • sftp(1): fix a memory leak in do_realpath() error path (bz#1771).
    • ssh-keygen(1): Standardise error messages when attempting to open private key files to include "progname: filename: error reason" (bz#1783).
    • Replace verbose and overflow-prone Linebuf code with read_keyfile_line() (bz#1565).
    • Include the user name on "subsystem request for ..." log messages.
    • ssh(1) and sshd(8): remove hardcoded limit of 100 permitopen clauses and port forwards per direction (bz#1327).
    • sshd(8): ignore stderr output from subsystems to avoid hangs if a subsystem or shell initialisation writes to stderr (bz#1750).
    • Skip the initial check for access with an empty password when PermitEmptyPasswords=no (bz#1638).
    • sshd(8): fix logspam when key options (from="..." especially) deny non-matching keys (bz#1765).
    • ssh-keygen(1): display a more helpful error message when $HOME is inaccessible while trying to create .ssh directory (bz#1740).
    • ssh(1): fix hang when terminating a mux slave using ~ (bz#1758).
    • ssh-keygen(1): refuse to generate keys longer than OPENSSL_[RD]SA_MAX_MODULUS_BITS (bz#1516).
    • Suppress spurious tty warning when using -O and stdin is not a tty (bz#1746).
    • Kill channel when pty allocation requests fail (bz#1698).

• Mandoc 1.10.5:
  • The mandoc(1) utility is now used to build all manuals in the base system and in Xenocara from mdoc(7) and man(7) sources.
  • New integrated roff preprocessor with minimal support for conditional requests, nested roff requests, string definitions, roff registers, also parsing and ignoring macro definitions.
  • Improved support for manual pages generated by pod2man(1).
  • Many parser improvements, in particular mdoc(7) support for word keeps, synopsis mode in arbitrary sections, graceful handling of badly nested blocks, and improved parsing of column displays.
  • New PostScript and PDF output frontends.
  • Many ASCII and HTML output formatting improvements, for example proper synopsis indentation and improved end-of-sentence detection.
  • Considerably improved syntax checking and error reporting.

• Over 6,400 ports, major robustness and speed improvements in package tools.
• Many pre-built packages for each architecture:

  i386: 6218 sparc64: 5950 alpha: 5827

  sh: 1100 amd64: 6166 powerpc: 5996

  sparc: 4130 arm: 5628 hppa: 5632

  vax: 1528 mips64: 3632 mips64el: 4486

  Some highlights:
  • Gnome 2.30.2.
  • KDE 3.5.10.
  • Xfce 4.6.2.
  • MySQL 5.1.48.
  • PostgreSQL 8.4.4.
  • Postfix 2.7.1.
  • OpenLDAP 2.3.43.
  • Mozilla Firefox 3.6.8 and 3.5.11.
  • Mozilla Thunderbird 3.1.1.
  • OpenOffice.org 3.2.1.
  • Emacs 21.4 and 22.3
  • Vim 7.2.444.
  • PHP 5.2.13.
  • Python 2.4.6, 2.5.4 and 2.6.5.
  • Ruby 1.8.6.369.
  • Mono 2.6.4.

• As usual, steady improvements in manual pages and other documentation.

• The system includes the following major components from outside suppliers:
  • Xenocara (based on X.Org 7.5 with xserver 1.8 + patches, freetype 2.3.12, fontconfig 2.8.0, Mesa 7.8.2, xterm 258 and more)
  • Gcc 2.95.3 (+ patches), 3.3.5 (+ patches) and 4.2.1 (+patches)
  • Perl 5.10.1 (+ patches)
  • Our improved and secured version of Apache 1.3, with SSL/TLS and DSO support
  • OpenSSL 0.9.8k (+ patches)
  • Groff 1.15
  • Sendmail 8.14.3, with libmilter
  • Bind 9.4.2-P2 (+ patches)
  • Lynx 2.8.6rel.5 with HTTPS and IPv6 support (+ patches)
  • Sudo 1.7.2
  • Ncurses 5.7
  • Latest KAME IPv6
  • Heimdal 0.7.2 (+ patches)
  • Arla 0.35.7
  • Binutils 2.15 (+ patches)
  • Gdb 6.3 (+ patches)

How to install

Following this are the instructions which you would have on a piece of paper if you had purchased a CDROM set instead of doing an alternate form of install. The instructions for doing an FTP (or other style of) install are very similar; the CDROM instructions are left intact so that you can see how much easier it would have been if you had purchased a CDROM instead.

• CD1:4.8/i386/INSTALL.i386

• CD2:4.8/amd64/INSTALL.amd64
• CD2:4.8/macppc/INSTALL.macppc

• CD3:4.8/sparc64/INSTALL.sparc64

• FTP:.../OpenBSD/4.8/alpha/INSTALL.alpha
• FTP:.../OpenBSD/4.8/armish/INSTALL.armish
• FTP:.../OpenBSD/4.8/hp300/INSTALL.hp300
• FTP:.../OpenBSD/4.8/hppa/INSTALL.hppa
• FTP:.../OpenBSD/4.8/landisk/INSTALL.landisk
• FTP:.../OpenBSD/4.8/loongson/INSTALL.loongson
• FTP:.../OpenBSD/4.8/mvme68k/INSTALL.mvme68k
• FTP:.../OpenBSD/4.8/mvme88k/INSTALL.mvme88k
• FTP:.../OpenBSD/4.8/sgi/INSTALL.sgi
• FTP:.../OpenBSD/4.8/socppc/INSTALL.socppc
• FTP:.../OpenBSD/4.8/sparc/INSTALL.sparc
• FTP:.../OpenBSD/4.8/vax/INSTALL.vax
• FTP:.../OpenBSD/4.8/zaurus/INSTALL.zaurus

Quick installer information for people familiar with OpenBSD, and the use of the "disklabel -E" command. If you are at all confused when installing OpenBSD, read the relevant INSTALL.* file as listed above!

OpenBSD/i386:

Play with your BIOS options to enable booting from a CD. The OpenBSD/i386 release is on CD1. If your BIOS does not support booting from CD, you will need to create a boot floppy to install from. To create a boot floppy write CD1:4.8/i386/floppy48.fs to a floppy and boot via the floppy drive.

Use CD1:4.8/i386/floppyB48.fs instead for greater SCSI controller support, or CD1:4.8/i386/floppyC48.fs for better laptop support.

If you can't boot from a CD or a floppy disk, you can install across the network using PXE as described in the included INSTALL.i386 document.

If you are planning on dual booting OpenBSD with another OS, you will need to read INSTALL.i386.

To make a boot floppy under MS-DOS, use the "rawrite" utility located at CD1:4.8/tools/rawrite.exe. To make the boot floppy under a Unix OS, use the dd(1) utility. The following is an example usage of dd(1), where the device could be "floppy", "rfd0c", or "rfd0a".

# dd if=<file> of=/dev/<device> bs=32k

Make sure you use properly formatted perfect floppies with NO BAD BLOCKS or your install will most likely fail. For more information on creating a boot floppy and installing OpenBSD/i386 please refer to FAQ 4.3.2.

OpenBSD/amd64:

The 4.8 release of OpenBSD/amd64 is located on CD2. Boot from the CD to begin the install - you may need to adjust your BIOS options first. If you can't boot from the CD, you can create a boot floppy to install from. To do this, write CD2:4.8/amd64/floppy48.fs to a floppy, then boot from the floppy drive.

If you can't boot from a CD or a floppy disk, you can install across the network using PXE as described in the included INSTALL.amd64 document.

If you are planning to dual boot OpenBSD with another OS, you will need to read INSTALL.amd64.

OpenBSD/macppc:

Put CD2 in your CDROM drive and poweron your machine while holding down the C key until the display turns on and shows OpenBSD/macppc boot.

Alternatively, at the Open Firmware prompt, enter boot cd:,ofwboot /4.8/macppc/bsd.rd

OpenBSD/sparc64:

Put CD3 in your CDROM drive and type boot cdrom.

If this doesn't work, or if you don't have a CDROM drive, you can write CD3:4.8/sparc64/floppy48.fs or CD3:4.8/sparc64/floppyB48.fs (depending on your machine) to a floppy and boot it with boot floppy. Refer to INSTALL.sparc64 for details.

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

You can also write CD3:4.8/sparc64/miniroot48.fs to the swap partition on the disk and boot with boot disk:b.

If nothing works, you can boot over the network as described in INSTALL.sparc64.

OpenBSD/alpha:

Write FTP:4.8/alpha/floppy48.fs or FTP:4.8/alpha/floppyB48.fs (depending on your machine) to a diskette and enter boot dva0. Refer to INSTALL.alpha for more details.

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

OpenBSD/armish:

After connecting a serial port, Thecus can boot directly from the network either tftp or http. Configure the network using fconfig, reset, then load bsd.rd, see INSTALL.armish for specific details. IOData HDL-G can only boot from an EXT-2 partition. Boot into linux and copy 'boot' and bsd.rd into the first partition on wd0 (hda1) then load and run bsd.rd, preserving the wd0i (hda1) ext2fs partition. More details are available in INSTALL.armish.

OpenBSD/hp300:

Boot over the network by following the instructions in INSTALL.hp300.

OpenBSD/hppa:

Boot over the network by following the instructions in INSTALL.hppa or the hppa platform page.

OpenBSD/landisk:

Write miniroot48.fs to the start of the CF or disk, and boot normally.

OpenBSD/loongson:

Write miniroot48.fs to a USB stick and boot bsd.rd from it or boot bsd.rd via tftp. Refer to the instructions in INSTALL.loongson for more details.

OpenBSD/mvme68k:

You can create a bootable installation tape or boot over the network.
The network boot requires a MVME68K BUG version that supports the NIOT and NBO debugger commands. Follow the instructions in INSTALL.mvme68k for more details.

OpenBSD/mvme88k:

You can create a bootable installation tape or boot over the network.
The network boot requires a MVME88K BUG version that supports the NIOT and NBO debugger commands. Follow the instructions in INSTALL.mvme88k for more details.

OpenBSD/sgi:

To install on an O2, burn cd48.iso on a CD-R, put it in the CD drive of your machine and select Install System Software from the System Maintenance menu.

On other systems, or if your machine doesn't have a CD drive, you can setup a DHCP/tftp network server, and boot using "bootp()/bsd.rd.IP##" using the kernel matching your system type. Refer to the instructions in INSTALL.sgi for more details.

OpenBSD/socppc:

After connecting a serial port, boot over the network via DHCP/tftp. Refer to the instructions in INSTALL.socppc for more details.

OpenBSD/sparc:

Boot from one of the provided install ISO images, using one of the two commands listed below, depending on the version of your ROM.

ok boot cdrom 4.8/sparc/bsd.rd
or
> b sd(0,6,0)4.8/sparc/bsd.rd

If your SPARC system does not have a CD drive, you can alternatively boot from floppy. To do so you need to write floppy48.fs to a floppy. For more information see FAQ 4.3.2. To boot from the floppy use one of the two commands listed below, depending on the version of your ROM.

ok boot floppy
or
> b fd()

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

If your SPARC system doesn't have a floppy drive nor a CD drive, you can either setup a bootable tape, or install via network, as told in the INSTALL.sparc file.

OpenBSD/vax:

Boot over the network via mopbooting as described in INSTALL.vax.

OpenBSD/zaurus:

Using the Linux built-in graphical ipkg installer, install the openbsd48_arm.ipk package. Reboot, then run it. Read INSTALL.zaurus for a few important details.

Notes about the source code:

src.tar.gz contains a source archive starting at /usr/src. This file contains everything you need except for the kernel sources, which are in a separate archive. To extract:

# mkdir -p /usr/src
# cd /usr/src
# tar xvfz /tmp/src.tar.gz

sys.tar.gz contains a source archive starting at /usr/src/sys. This file contains all the kernel sources you need to rebuild kernels. To extract:

# mkdir -p /usr/src/sys
# cd /usr/src
# tar xvfz /tmp/sys.tar.gz

Both of these trees are a regular CVS checkout. Using these trees it is possible to get a head-start on using the anoncvs servers as described here. Using these files results in a much faster initial CVS update than you could expect from a fresh checkout of the full OpenBSD source tree.

How to upgrade

If you already have an OpenBSD 4.7 system, and do not want to reinstall, upgrade instructions and advice can be found in the Upgrade Guide.

Ports Tree

A ports tree archive is also provided. To extract:

# cd /usr
# tar xvfz /tmp/ports.tar.gz
# cd ports

The ports/ subdirectory is a checkout of the OpenBSD ports tree. Go read the ports page if you know nothing about ports at this point. This text is not a manual of how to use ports. Rather, it is a set of notes meant to kickstart the user on the OpenBSD ports system.

The ports/ directory represents a CVS (see the manpage for cvs(1) if you aren't familiar with CVS) checkout of our ports. As with our complete source tree, our ports tree is available via anoncvs. So, in order to keep current with it, you must make the ports/ tree available on a read-write medium and update the tree with a command like:

# cd [portsdir]/; cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_4_8

[Of course, you must replace the local directory and server name here with the location of your ports collection and a nearby anoncvs server.]

Note that most ports are available as packages through FTP. Updated packages for the 4.8 release will be made available if problems arise.

If you're interested in seeing a port added, would like to help out, or just would like to know more, the mailing list ports@openbsd.org is a good place to know.