Soon, unwind will have support wildcard in blacklist.

Here, a change that makes any domain in the blacklist that starts with '.', which is not a legal name due to an empty label, is treated as any subdomain on that zone.

This means that .example.com blocks all requests to any subdomain of example.com, but allows example.com.

Changes: https://marc.info/?l=openbsd-cvs&m=173244784522937&w=2

Version 0.106 of Game of Trees has been released (and the port updated).

• prevent gotd from exiting with pending notifications if client disconnects
• convert got to the new imsg API
• gotwebd: improve performance of repository age calculations
• gotwebd: ensure child processes inherit non-default config

Version 0.105 of Game of Trees has been released (and the port updated).

Version 0.104 of Game of Trees has been released (and the port updated).

* got 0.104; 2024-10-22
  see git repository history for per-change authorship information
- gotd.conf: document the macro syntax
- tog: prevent a segfault upon unexpected object type in ref list view
- fix pack file creation in the presence of tagged tag objects
- plugged some memory leaks
- fix a crash when unstaging a file which has been removed from disk
- gotwebd: fix out of bounds access while handling the configuration

The LibreSSL project, a closely associated subproject of the OpenBSD project, has announced the availability of their new stable release, LibreSSL 4.0.0, which comes with a number of improvements and a sprinkling of fixes.

The release announcement reads,

Subject:    LibreSSL 4.0.0 Released
From:       Brent Cook <busterb () gmail ! com>

We have released LibreSSL 4.0.0, which will be arriving in the
LibreSSL directory of your local OpenBSD mirror soon. This is the
first stable release for the 4.0.x branch, also available with OpenBSD 7.6

It includes the following change from LibreSSL 3.9.2:

  * Portable changes
    - Added initial Emscripten support in CMake builds.
    - Removed timegm() compatibility layer since all uses were replaced
      with OPENSSL_timegm(). Cleaned up the corresponding test harness.
    - The mips32 platform is no longer actively supported.
    - Fixed Windows support for dates beyond 2038.

The work of improving ssh security by segregating functionality into separate binaries contiues, this time by introducing sshd-auth as a separate binary.

The commit message summarizes why this makes sense,

Splitting this code into a separate binary ensures that the crucial
pre-authentication attack surface has an entirely disjoint address
space from the code used for the rest of the connection. It also
yields a small runtime memory saving as the authentication code will
be unloaded after thhe authentication phase completes.

The code is in snapshots as we type.

Read the whole thing after the fold -

Omar Polo (op@) has announced the release of version 7.6.0p0 of OpenSMTPD.

The changes (including the table protocol change on which we reported earlier) are:

 - Introduced a new K_AUTH service to allow offloading the credentials
   to a proc table for non-crypt(3) authentication.  Helps with use
   cases like LDAP or custom auth.

 - Implement report responses for proc-filters too.

 - Changed the table protocol to a simpler text-based one.  Existing
   proc tables needs to be updated since old ones won't work.  The new
   protocol is documented in smtpd-tables(7).

 - Fixed the parsing of IPv6 addresses in file-backed table(5)

 - Document expected MDA behavior and the environment set by OpenSMTPD.

 - Set ORIGINAL_RECIPIENT in the environment of MDA scripts for
   compatibility with postfix.

 - Updated the bundled libtls.

See the release announcement for full details.

The OpenBSD project has announced OpenBSD 7.6, its 57^th release.

The new release contains a number of significant improvements, including but not limited to:

• There is initial support for Qualcomm Snapdragon X Elite [arm64] laptops.
• Initial support for Suspend-to-Idle has been added on amd64 and i386, enabling suspend on machines which do not support S3.
• UDP parallel input has been enabled. [See earlier report]
• Libva's VA-API (Video Acceleration API) was imported into xenocara. [See earlier report]
• The default write format for tar(1) has changed to "pax". [See earlier report]
• pfctl(8) and systat(1) now display fragment reassembly statistics. [See earlier report]
• A configurable passphrase timeout for disk decryption at boot (a potential battery lifesaver) has been added. [See earlier report]
• Local-to-anchor tables are now available in pf(4) rules. [See earlier report]
• rport(4), a driver providing point-to-point interfaces for layer 3 connectivity between rdomain(4) instances, has been added.
• dhcp6leased(8), a DHCPv6 client daemon for IPv6 PD has been added. [See earlier report]
• dhclient(8) has been removed (now that dhcpleased(8) is well established). [See earlier report]
• OpenSSH 9.9, featuring:
  • sshd(8) has been split into multiple binaries. [See earlier report]
  • Options to penalize undesirable behavior [See earlier report]
  • support for a new hybrid post-quantum key exchange [See earlier report]

and of course there is the full changelog which details the changes made over this latest six month development cycle.

Installation Guide details how to get the system up and running with a fresh install, while those who already run earlier releases should follow the Upgrade Guide, in most cases using sysupgrade(8) to upgrade their systems.

Now please dive in and enjoy the new release, and while the installer runs, please do donate to the project to support further development and more future goodies for us all!

There has been a significant change to the behaviour of sysupgrade(8):

CVSROOT:	/cvs
Module name:	src
Changes by:	florian@cvs.openbsd.org	2024/09/24 01:33:35

Modified files:
	usr.sbin/sysupgrade: sysupgrade.8 sysupgrade.sh 

Log message:
Remove -r toggle and generally be less smart.

The default is to install the next release. Snapshots are only
installed when invoked with -s.