OpenBSD 2.3 changes

OpenBSD 2.3 released (May 19, 1998)

This is a partial list of the major machine independent changes (i.e., these are the changes people ask about most often). Machine specific changes have also been made, and are sometimes mentioned in the pages for the specific platforms if you are interested in further port-specific details. Many ports have had architecture-specific enhancements relative to NetBSD, but when they do not they certainly have plenty of platform-independent changes, starting with those listed below..

Note: Problems for which patches exist are marked in red.

For changes in other releases, click below:
2.0, 2.1, 2.2, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7,
3.8, 3.9, 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 5.0, 5.1, 5.2, 5.3, 5.4,
5.5, current.

Changes made between OpenBSD 2.2 and 2.3

A security problem due to buffer mismanagement exists in lprm(1). A patch exists.
A security problem due to a buffer overflow exists in uucpd(8) (which is not enabled by default in our releases). A patch exists.
On the i386, fix installboot(8) so it works reliably on various filesystem layouts that did not work before.
Support lots of file descriptors in named(8), for when many virtual interfaces exist.
Fix installboot(8) on the sparc Sun4 models.
In disklabel(8)'s -E mode, set the bootblock sizes so that the hp300 install does not freak out.
In mktemp(3), repair a bug in the filename incrementing loop.
Various other install script fixes.
Fix /etc/fbtab handling in init(8).
Make disklabel(8) mentions IDE (which is an alias for ESDI).
For the i386, have the install procedure ask if the xf86 driver should be enabled by default.
Make install procedure prompt & set the initial root password.
When root logs in for the first time, let him find that he has an interesting piece of mail about how the system works.
Fix ipsec encap notifies.
Configure xdm(1) and the fwvm window manager sensibly enough for default users to not feel utterly lost.
Fix 'u'ndo support in disklabel(8)'s -E mode, and also add a new 'r' command.
Repair the pkg_add(1) sufficiently for the 2.3 release...
Fix a race condition in unmount(2).
Add support for the XR16850 serial chip (128 byte fifos).
mkisofs 1.11.2
Disable console ddb by default. sysctl can re-enable it.
Fix backtraces in gdb on m68k platforms.
Support 3c905B (well, actually, our support falls over. We need a card to do further work).
Modify i386 PS/2 driver to be read/write; this permits new XFree86 source to put mice into advanced modes of operation.
Remove KTH Kerberos "eavesdropping" message from telnet(1) and telnetd(8).
Fix bug oflow in ping(8) -R option.
In tar(1), only preserve the uid/gid if the -p flag is given.
sudo version 1.5.5
Do not prepend /usr/local/bin to the PATH in zdiff(1), zforce(1), zgrep(1), zmore(1), znew(1), or rcsfreeze(1).
Fix DNS fake-iquery bug.
In the le ethernet driver, if the detected ethernet address is ff:ff:ff:ff:ff ... fail.
Fixes for various (minor) Y2K problems.
Switch a.out ports in the tree (sparc, m68k, i386) to use the newer version of gdb that is part of the binutils tree.
Significantly improve the system install scripts.
Add disklabel spoofing to the hp300 port.
Add xlockmore(1) to the X11 tree.
Fix ru_majflt counting in the VM system.
Add AFS token fetching capability to various parts of the source tree.
In login(1), handle cleanup of environment variables correctly.
In ftp(1), for HTTP requests pass the hostname so that virtual hosts work.
In utimes(2) and futimes(2), handle tv_sec values of -1 more carefully, as they are really illegal cases.
Import kx into our X11 source tree.
Add a SIOCGIFDATA ifreq-style ioctl which will get the ifdata informational structure attached to each interface.
Add httpd(8) to the OpenBSD tree. It is apache 1.2.6.
Import xpm into our X11 source tree.
Support QLogic PCI scsi controllers (at least on the i386).
Fix rmd160(3) (and also the IPSEC algorithm) to properly handle data beyond its block boundary.
Emulate SunOS otimes(2) system call so that Netscape doesn't explode.
Fix rarpd(8) interaction with routed(8); too much routing information would pile up un-read on the AF_ROUTE socket and rarpd(8) would get too grumpy.
Remove libtelnet.so.* from the distribution. People compiling kerberos into their system were generating significantly different shared libraries; thus it is wrong to make this a shared library.
Make edquota(8) handle numeric names as uids only after checking that an account named so does not exist.
Add UID_MAX and GID_MAX to <machine/limits.h> on each architecture.
Fix ch(4) operation on ncr(4) scsi controllers.
On the sparc, switch to an alternate font if the console is < 800*600 resolution.
Add ISAPNP driver for the 3c509 cards.
Change SIOCGIFNETMASK, SIOCGIFDSTADDR, and SIOCGIFBRDADDR to return information for named/addressed mappings rather than simply named mappings, so that these calls can work on interface aliases.
Add (complete?) support for KerberosIV to our X11R6.
In mktemp(1), document why this should be used for temporary filename generation.
In telnet(1), fix connecting to IP addresses; this was recently broken by the new KTH kerberos telnet integration.
Make -R path work a well as -Rpath in cc(1).
In the ksh(1) manpage, clarify the behaviour of the CDPATH variable.
Add support for more PCI NE2000 cards.
Make %Y override an earlier %y in strptime(3).
Add support for atalk to ifconfig(8).
Make the functions described in ethers(3) more careful.
Fix support for VFS loadable kernel modules.
In get*ent() family of routines in libc, use fgetln(3) instead of fgets(3) so that parsing of overly long lines is more correct.
Add options(4). This manpage describes what all the kernel options do. If you spot an error in it, notify us immediately.
In strptime(3), make %C influence %y regardless of ordering.
Fix a NULL deference bug in make(1) when using the -j flag.
Fix %m, %I, %S, %y, %C, and %j conversions in strptime(3).
Merge Kirk McKusick's soft update code. This code is still experimental and under a non-commercial license. It will be included in the next release as an optional compile flag; we cannot ship it enabled by default.
Flesh out the man pages and explain the security problems behind mktemp(3) and other similar functions, plus explain how to handle these problems better.
Fully working KerberosIV encryption in telnet(1) and telnetd(8).
Fixes to a few more games.
CVS version 1.9.26
Fix mktemp(3) problems in two more YP tools.
Fix an interaction bug in inetd(8) due to SIGPIPE blocking; caused a bad effect in rlogind(8) or other inetd(8) children.
Configure cc(1) to pass the -R flag on to ld(1).
Add lynx 2.8 to the system.
Add support for 82553 and 82555B PHY in the fxp driver.
Fix tmpfile(3) to fchown() the file after unlink() (taking umask() into consideration, too). This is required by standards.
Fix vnd and ccd drivers to work properly with soft updates.
Fix a crash case in compress(1).
Add -s and -c options to last(1).
Add support for -s section and -S subsection to man(1).
Change the configuration of man(1) so that man4 is read much later; this makes it easier to see pages in man8 with similar names.
Fix KerberosIV password changing.
On the sparc, support 128KB lebuffer devices.
On the sparc, print hotfix information at the right place in the dmesg log.
Fix passwd(1) so that YP passwords do not get edited in the local password file.
Significant efforts made at fleshing out the device driver man page tree better.
Upgrade to gcc 2.8.1
Rename 2.2 to 2.3 tree-wide, for the upcoming release.
Improve IPSEC performance.
Add many new machine-dependent man4 man pages.
XFree86 3.3.2 is now in our X11 source tree.
Add another missing ntohl() in ipnat(8).
Use a p_os field to sub-divide operating system emulation capabilities (like for SVR4 binaries).
Spend almost a week finding and fixing minor goobers discovered by gcc 2.8 throughout the source tree.
Fix syslog(3) sockaddr initialization.
Add support for TIOCM* family of ioctl(2) values to the sparc serial driver.
New photurisd(8) that complies with draft-simpson-photuris-18.txt.
Fix a race bug in mkstemp(3) itself that would make mkstemp(3) have occasionally fail strangely.
Fix a few more mktemp(3) problems in f77 libraries, and other assorted GNU software.
Upgrade to gcc 2.8.0
Upgrade to libg++ 2.8.0
Make ping(8) work with very large packet sizes on all types of interfaces.
Correct behaviour -x and -p flags in tar(1) to be traditional.
Remove one of the two copies of math.h in the source tree.
Improve blowfish performance by a factor of 2, and hence increase the rounds by 1 in passwd.conf.
Handle unknown hostnames in mountd(8) better.
Inside the kernel, change struct file's members f_count and f_msgcount to longs, and then add checking for overflows as well.
Add XDM-AUTHORIZATION to X11.
In old gas, move to late resolution of symbols because gcc 2.8 will require this.
Fix a configuration file parsing bug in ipf(8).
In libpcap and tcpdump, use our system ethers(5) parsing routines.
Make netstat -r report better information about non-standard netmasks.
Fix some bugs in the 3c[59]xx device driver.
The 3rd revision of the patch for the mmap() security problem is available, and has been placed on top of the 2nd revision.
Add a command to ddb that reports out the extent tables.
Add a clarifying statement to all the Kerberos code that explains how it came to be that this code was released from the USA's crypto stranglehold.
In the RPC code, ensure that __svc_fdsetsize is always manipulated as a bitcount.
Clarify crypt(3) manpage as to how many characters each transform actually considers in its calculation.
Do not permit TCP connections to any of the broadcast addresses.
Do not let a user set their password to "s/key".
Permit the disabling of skey system-wide.
Convert the xdr(3) and rpc(3) manpages to mandoc format.
In mail.local(8), document how to use quotas on a mail spool.
Add -p option to uname(1), to display detailed CPU information.
Support for the ST16650 32-byte FIFO uart.
Do not copy from off the end of an nfs boot mbuf.
Some more repair in the games.
Support -rpath dir, -shared, -soname, --whole-archive, and --no-whole-archive in the old ld used on many of our platforms.
CVS version 1.9.24
For OLF/ELF binaries, remember the OS tag in execve(), so that emulation code can reference it later.
Make the kernel compile properly (with full warnings) under gcc 2.8.
Do not permit a read+write mmap() operation on a read-only file descriptor open on a device. This is a security problem in OpenBSD 2.2, and is described and fixed with a patch.
Rename /etc/nat.rules to /etc/ipnat.rules.
Add kerberos kauthd(8).
On the i386, move XFree86 aperture driver into the kernel. The new sysctl(8) variable machdep.allowaperture decides if this driver is active or not. (This variable can only be modified at high securelevel).
Remove the ftp(1) `stdout redirection' hack and replace it with a -o filename option (which also understands a filename of "-" to mean stdout).
Pull in all the NetBSD changes to the old version of gas over the last year or so.
Fix two bugs in adduser(8).
Change chflags(2) and fchflags(2) to take a u_int for the second parameter.
New fancy OpenBSD logo for your use.
Add XPG4 -r option to du(1).
Support -[width] option in fmt(1).
New quirk for another Archive VIPER scsi tape drive.
Fix another signal handler bug in mail(1).
The mac68k 2.2 CD release had a few problems. These problems have been resolved in the FTP release. For more details...
Make lpd(8) use keepalives so that it can detect dead network printers.
Support the WINBOND pci ethernet cards.
Fixed "%c" in strftime(3).
Various fixes to some of the games, ie. rain, worms, wump.
If link0 is set on a loopback interface (ie. lo1) make the address/netmask sets on it make supernets instead of subnets.
Place separate so_ruid and so_euid fields in struct socket, so that in_pcb.c can still do its job, but also so that identd(8) can be fast and return the proper uid.
In the sparc 2.2 release, the SS4/SS5 kernel was not very reliable. A simple reliability patch is now available.
Fix a map corruption bug in ypxfr(8).
Make stty(1) recognize STRIPDISC.
In compress(1), if the st_flags is 0, do not attempt a chflags(2) call.
Make ruserok() significantly more paranoid when parsing the .rhosts file. This along with another issue is a security problem in OpenBSD 2.2, and is described and fixed with a patch.
raise IPPORT_USERRESERVED significantly. Random port numbers will now look much more random than they did before.
New -a logdev argument for syslogd(8), useful for setting up additional /dev/log devices in various chroot spaces.
Permit restore(8) to work on a filesystem that has a basic blocksize smaller than the blocksize of the filesystem that was dumped.
Make MIPS ldconfig emulate the -m flag better.
The web pages now have a new section on security advisories.
New compat_ibcs2(8) manpage.
Fix rarpd(8) to work properly in the presence of massive routing traffic.
A start at full lint library support.
smtpd(8) integration spiffied up. Everything you need is now in the system.
Emulate that disgusting linux connect() braindamage even better.
Fix some bugs in vacation(1).
Fix /etc/yp/domainname support in ypbind(8).
In the 2.2 release, the sparc scsi driver caused problems for the Sun 4/300 machines. Patches are now available.
Add FS_CCD partition type so that the ccd driver can ensure it has the right components.
Add /etc/sysctl.conf which specifies sysctl variables to change at boottime.
Fix a free page count bug in the vm system.
Create two new sysctl options: ddb.panic decides whether the kernel should enter ddb when it panics, and ddb.console controls if it is possible to enter ddb from the console via a hot-key.
Add scan_ffs(8), a very useful tool for reconstructing disks.
Add strptime(3).
Buffer overflow fix in the MIPS ld.so. Replacement binaries for the pmax and arc platforms are available.
Avoid DNS lookup timing effects in ping -R.
Fix the __{CTOR,DTOR}_LIST__ declarations in c++rt0.c
Two bugs existed in the 2.2 pmax release which all users should be aware of. Patches are now available.
Be more careful about sourcerouted packets, including never forwarding them. This is a security problem in OpenBSD 2.2, and is described and fixed with a patch.
Teach the kernel about newer PCI device types.
Workaround a race condition in syslogd's handling of SIGHUP.
Some man page fixes so that man -k is happier.
Low-memory bug fix in setenv(3).
Self-extending kernel maps in the vm subsystem.
In rc.local, bail on starting cfsd(8) if mountd(8) is not running.
Require commands started from in /etc/rc to be executable -- not just readable.
Glob extensions for XPG4.
Cleanups in wump(6).
Check both old and new shells in rpc.yppasswdd(8).
Add -a flag to which(1).
On binutils platforms, make ldd(1) work on static executables.
IPF 3.2.3. When you upgrade to this version, you must also upgrade the userland utilities (ipf, ipnat, etc.). You also need to get the latest MAKEDEV and run "sh MAKEDEV ipl" in /dev to create new device entries.
Fix a race in mkdir(1).
More cdrom ioctls in Linux emulation.
Fix select(2) use in sudo(8) so that it can handle large fd_set sizes.
In termcap databases, map the keyboard backspace key to DEL instead of BS as that is how it really is.
Fix argument handling in expand(1).
If tar(1) extracts as root, preserve uid/gid as is traditional.
Repaired the expansion of the kernel panic string.
Much more complete KerberosIV documentation.
Start at bus_dma support.
Properly error out if yp_match() or yp_first() is asked to lookup long keys.
Groff 1.11a
Properly ignore whitespace between a conversion and %n in *scanf(3).
Import of tzcode1998b and tzdata1998b.
Use new ypwhich(1) flag in ypinit(8) script to get maps from the real master server.
Support -h host flag to ypwhich(1).
pppd 2.3.3
Handle unparseable ulimit specifications as an error, not as the value 0.
ncurses 4.1-980103
In w(1), handle processes that set argv[0] to NULL, by printing p_pcomm.
Make pkg_install(1) feed a -p option to tar.
sudo version 1.5.4.
Merge some slight standardization fixes for *printf(3) from FreeBSD (some unlikely cases get handled better).
Bring gethostent() back to life, even though it is a bad interface.
In disklabel(8), make IDE drive type handling more obvious and intuitive.
Support all kinds of keyboards in pcvt, like pccons does.
Support for FAT32 partitions.
For scsi tape drives, be silent in the presence of ILI errors.
Fix a vnode creation race.
Fix a output error in finger(1).
Do not permit dumping corefiles over symbolic links. (We have wanted this changed for a long time, but it required Lite2 vfs.)
Permit extra / terminators in some path-based system calls.
Fix some problems regarding transfer of secure yp maps.
New rc.conf(7) manpage.
Make sure it is clear that so_linger is in seconds.
Add sysctl net.inet.icmp.bmcastecho to block the smurf problem.
Some fixes to fdisk(8) and disklabel(8).
Workaround a problem that happens if a TCP socket is shutdown(2)'d more than once.
Some more manpage cleanups.
Some slight changes to the PCI device subsystem to make it probe devices nicer (mostly dmesg printing).
Make md5(1), rmd160(1), and sha1(1) use getopt().
Make {f,}chflags(.., -1) return error EINVAL.
Make mmap() return void * instead of caddr_t, and add the MAP_FAILED define required by new standards.
Fix some gzip buf oflows.
Correct an splx botch in the tunnel driver.
Add sysctl ddb.panic_ddb; indicates whether to drop into ddb on a panic.
Swap quit and exit commands in fdisk.
Correct exit code of nohup(1).
lockf() implementation.
Handle DST changeovers automatically in cron.
IBCS2 emulation also requires fcntl() F_FREESP support.
The new KTH KerberosIV integration (and security audit) is almost complete.
If mountd(8) discovers getfh(2) not supported, it now aborts nicely.
Support fcntl() GETLK,SETLK,UNLK variants in SunOS emulation.
Fix a bug in make(1) regarding SYSV style : substitution on null variables.
Check the values of the ftp PORT command even more carefully.
Fail better for over-long usernames.
Change ftp(1) so that tries to use passive mode, and falls back to active mode. Provide environment variables to fall back. This is incredibly cool.
Provide workaround for the Cyrix 6x86 COMA bug. (A workaround for 2.2 is not available).
Implement fcntl() of F_FREESP in SVR4 emulation. Does this belong in ibcs2 also?
Fix Linux accept/recvmsg if kernel is compiled with other compat options.
In numerous programs, avoid fd_set overflows.
Fix MAKEDEV script regarding /dev/fd/* for some architectures.
Fix a kernel bug related to "route change ...".
Support IP_HDRINCL in Linux emulation.
Update the pkg_* tools a bit.
Honour TMPDIR in the locate(8) tools.
Make route(8) non-setuid.
In ftpd, default to RFC non-conforming behaviour for the PORT command, but provide a runtime switch for those who like holes.
Addition of Obtuse smtpd(8) and smtpfwd(8) v2.0.
Due to timing constraints, mac68k X11 binaries did not make it onto the 2.2 CDROM. But it is now available for ftp.
Do not clear the setuid/setgid file mode bits for a call to {,f,l}chmod(-1, -1).
Enable new FreeBSD ppp(8) daemon. There are now two ppp daemons in the source tree, they have quite different feature sets.
Fixed a panic problem in the i386 apm driver. A patch is available for 2.2.
Repair a number of retry operation problems in the wdc driver that mostly affected sleeping laptops.
Handle the controlling tty ioctl in linux emulation.
Handle SIOCGIFMETRIC and SIOCGIFMTU in linux emulation.
Handle nanosleep() in linux emulation.
Use recursive vnode locks to solve a page-in panic reported by chuck & chuck.
Handle SIOCGIFHWADDR ioctl in linux emulation.
Handle the cdrom ejecting ioctl in linux emulation.
Correct an XPG violation in stdlib.h.
Fix a problem in -current regarding open() of O_TRUNC and O_SHLOCK.
Fix numerous problems with new KTH kerberos.
A workaround for the Intel P5 F00F lockup problem. A patch is available for 2.2.
Fix minor numbers for /dev/ch* in the MAKEDEV scripts.
Add a kern.nosuidcoredump sysctl.
Enhance the performance of pwd_mkdb(8) by expanding the db(3) cache based on input filesize.
Use cp -R instead of cp -r for local copies in rcp(1).
Flesh out scsi(8) a tiny bit more.
In linux compat, handle the CDROM ioctl() calls.
Indicate connect direction for tcp sockets in fstat(1).
Fix scsi CDIOCREADSUBCHANNEL.
Prevent ipf/ipnnat configuration changes when securelevel > 1.
Fix an overflow in top(1).
Fix a deadlock on cd9660.
Update to ncurses-4.1-971129
On the i386, handle the nasty problem with distinguishing SVR4 and Linux binaries. A patch is available for 2.2.
Newer ncr device driver.
Fix SunOS emulation of TIOCGPGRP.
Add some more XPG4.2 *_t types.
Import perl 5.004_04.
Add hosts.equiv(3) and .rhosts(3) man page.
Add asprintf(3) and vasprintf(3).
Fix /etc/rc scripts to require IPF if NAT is requested.
Moving towards KTH kerberos 4-0.9.7.
Fix -amin option in find(1).
Fix arp(8) ethernet address parsing for the illegal cases.
Massive performance optimization of the ccd device (RAID-like striping disk driver).
Work around stupid linux emulation behaviour involving non-blocking connect(2).
Update to ncurses 4.1.
Fix a mget prompting error in ftp(1).
add -t option to disklabel(8).
Some man page cleanups.
Fix a memory leak in the kernel process group manipulation code.
Import of FreeBSD's ppp(8) program.
Update sudo(8).
Fixed bug in 'systat vm' output.
Fix the internals of open(2) when O_TRUNC and either O_SHLOCK or O_EXLOCK are set. (That was a nasty kernel bug).
Clean /var earlier in the /etc/rc script.
make readlink(1) terminate its buffer correctly. This affects CDROM builds so a patch is available for 2.2.
Make fstat(2) on AF_UNIX socket return proper st_[acm]time field values.
Implement FIONBIO in ibcs2 emulation code.
Consider only the 0177777 bits of the umask(2) value, as documented.
Added mode rangecheck in chmod(2) and fchmod(2).
Fix some Y2K problems in the nroff tmac macros.
Minor logging feature changes in fingerd(8).
in chat(8), replace Mini Getopt from hell with real getopt().
Add SHUT_RD, SHUT_WR, and SHUT_RDWR values for shutdown(2) as specified by XPG4.2.
Make the -Ss flag in rpcgen(1) work right.
Range-check the "how" argument for shutdown(2).
Change various system calls to take void * instead of caddr_t.
Fix a line continuation bug in sed(1).
Add inetd(8) -R rate flag, and crank default rate to 256.
Clear CLOCAL mode in pppd if modem is set but modem_chat is not.
Make the if_de driver support more cards.
Make msync(2) POSIX compliant.
Fix a ONLCR + FLUSHO situation in tty.c
Support -mmin, -amin, and -cmin in find(1).
Support an "object" keyword in config(8).
Make "expr a : /" work.
Make dumpfs(8) report if soft updates are requested by the superblock.
Add getsid(2) system call as mandated by XPG4.2.
Some minor fixes for the libc/db/btree code.
Flesh out compat_freebsd a fair bit more.
Some compat_svr4 fixes.
Update getNAME(8) and fix makewhatis(8) to use it more optimally.
Fix EXTPROC in pty code.
Correct TCP's handling of RST.
Add more things to afterboot(8).
Fix tty suspend during sh -c "less file".
double MAX_KMAPENT and MAX_KMAP
sendmail 8.8.8
add uu_lock(), uu_unlock() and uu_lockerr() to libutil.
Start named(8) earlier in /etc/rc.
Support execution sections in syslog.conf.
4.4BSD lite2 vfs integration.
usleep(3) returns int, and add useconds_t type as required by XPG4.2
Fixed ps(1) LIM and STAT columns.
makewhatis(8) manpage added.
Fix rpc.rquotad support if the quotas file resides on another filesystem.
Truncate large uid and gid values in ranlib(1), in the same way as this is handled in ar(1).
Document how crypt(3) handles blowfish and MD5 passwords.
Fix some memory leaks in the RPC code.
Fix an as(1) parsing bug relating to the .ascii directive.
Handle C++ and other languages in yacc(1) far better.
Be more careful with getpwent() information inside rcp(1).
Replace kernel printf with Torek's libc printf.
Make disklabel -E deal with multiple partitions which overlap.
If a non-existent user logs in and asks for s/key authentication, fake a proper s/key prompt.
SIGWINCH handling in systat(1).
Add blowfish and cast encryption to IPSEC.
In tftpd(8), permit syslog() to work when running chroot(2)'d.
a buffer underrun in ctags(1).
Make kdump(1) handle the newer emulations.
Add svr4 jioctl() compat interface.