-
Notifications
You must be signed in to change notification settings - Fork 43
/
Copy pathplus56.html
1383 lines (1376 loc) · 157 KB
/
plus56.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!doctype html>
<html lang=en id=plus>
<meta charset=utf-8>
<title>OpenBSD 5.6 Changelog</title>
<meta name="description" content="OpenBSD 5.6 changes">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" type="text/css" href="openbsd.css">
<link rel="canonical" href="https://www.openbsd.org/plus56.html">
<style>
strong {
color: var(--red);
font-weight: normal;
}
h3 {
color: var(--blue);
}
</style>
<h2 id=OpenBSD>
<a href="index.html">
<i>Open</i><b>BSD</b></a>
5.6 Changelog
</h2>
<hr>
<p>
This selection is intended to include all important
and all user-visible changes.
For a complete record of all changes, please see the "source-changes"
mailing list, called "OpenBSD CVS"
in the <a href="https://marc.info/?l=openbsd-cvs">archives</a>,
or use <a href="anoncvs.html#CVS">CVS</a>.
<p>
Note: <strong>Problems for which patches exist are marked in red</strong>.
<p>
For changes in other releases, click below:<br>
<a href="plus20.html">2.0</a>,
<a href="plus21.html">2.1</a>,
<a href="plus22.html">2.2</a>,
<a href="plus23.html">2.3</a>,
<a href="plus24.html">2.4</a>,
<a href="plus25.html">2.5</a>,
<a href="plus26.html">2.6</a>,
<a href="plus27.html">2.7</a>,
<a href="plus28.html">2.8</a>,
<a href="plus29.html">2.9</a>,
<a href="plus30.html">3.0</a>,
<a href="plus31.html">3.1</a>,
<a href="plus32.html">3.2</a>,
<a href="plus33.html">3.3</a>,
<a href="plus34.html">3.4</a>,
<a href="plus35.html">3.5</a>,
<a href="plus36.html">3.6</a>,
<br>
<a href="plus37.html">3.7</a>,
<a href="plus38.html">3.8</a>,
<a href="plus39.html">3.9</a>,
<a href="plus40.html">4.0</a>,
<a href="plus41.html">4.1</a>,
<a href="plus42.html">4.2</a>,
<a href="plus43.html">4.3</a>,
<a href="plus44.html">4.4</a>,
<a href="plus45.html">4.5</a>,
<a href="plus46.html">4.6</a>,
<a href="plus47.html">4.7</a>,
<a href="plus48.html">4.8</a>,
<a href="plus49.html">4.9</a>,
<a href="plus50.html">5.0</a>,
<a href="plus51.html">5.1</a>,
<a href="plus52.html">5.2</a>,
<a href="plus53.html">5.3</a>,
<br>
<a href="plus54.html">5.4</a>,
<a href="plus55.html">5.5</a>,
<a href="plus57.html">5.7</a>,
<a href="plus58.html">5.8</a>,
<a href="plus59.html">5.9</a>,
<a href="plus60.html">6.0</a>,
<a href="plus61.html">6.1</a>,
<a href="plus62.html">6.2</a>,
<a href="plus63.html">6.3</a>,
<a href="plus64.html">6.4</a>,
<a href="plus65.html">6.5</a>,
<a href="plus66.html">6.6</a>,
<a href="plus67.html">6.7</a>,
<a href="plus68.html">6.8</a>,
<a href="plus69.html">6.9</a>,
<a href="plus70.html">7.0</a>,
<a href="plus71.html">7.1</a>,
<br>
<a href="plus72.html">7.2</a>,
<a href="plus73.html">7.3</a>,
<a href="plus74.html">7.4</a>,
<a href="plus75.html">7.5</a>,
<a href="plus76.html">7.6</a>,
<a href="plus77.html">7.7</a>,
<a href="plus.html">current</a>.
<br>
<p>
<h3>Changes made between OpenBSD 5.5 and 5.6</h3>
<p>
<ul>
<!-- 2014/08/07 -->
<li>Fixed <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> to avoid allocating and then leaking a fresh fragment structure when a zero-length fragment is received (CVE-2014-3507).
<li>Fixed <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>: made sure the output buffer is always NUL terminated if buf_len was initially greater than zero; reject OIDs that are too long, too short, or not in proper base-127 (CVE-2014-3508).
<li>Corrected <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> test (reversed during merge of fix for CVE-2014-3509).
<li>Fixed <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> DTLS handshake message size checks (CVE-2014-3506).
<li>Stopped <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> trying to output FCGI_STDERR into error.log if there is no data.
<li>Try to parse "Status: $code" in the first response from the <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> fcgi daemon, use that code as HTTP response code (fallback to 200). Possible fix for redirects in cvsweb.
<!-- 2014/08/06 -->
<li>Fixed <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> TLS downgrade (CVE-2014-3511).
<li>Fixed DTLS anonymous EC(DH) denial of service in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> (CVE-2014-3510).
<li>Made <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> correctly report "internal server error" if the very first fcgi STDOUT record has length 0.
<li>Changed <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> grammar to remove a shift/reduce conflict. "listen on $ip port 443 ssl" turns into "listen on $ip ssl port 443".
<li>Added support for NOTE_EOF (for <a href="https://man.openbsd.org/kqueue.2">kqueue(2)</a> EVFILT_READ filters) on NFS files.
<li>Limit the body size in client requests (eg. POST data) to 1M by default in <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a>; added a configuration option to change the limit.
<li>Prevented <a href="https://man.openbsd.org/X.7">X(7)</a> server crash on zaurus (and possibly other architectures) where there is no <a href="https://man.openbsd.org/pci.4">pci(4)</a>.
<li>Provided <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> configuration options that allow the SSL certificate, key and ciphers to be specified for each server.
<li>Clear the <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> public key when it is no longer needed.
<li>Configured the default <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> ciphers as HIGH:!aNULL in <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>.
<li>Restored previous <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> behaviour that allows a PEM block to be fed through the base64 decoder.
<li>Corrected some dma cleanup error paths in <a href="https://man.openbsd.org/vax/qe.4">qe(4/vax)</a>.
<li>POST support added to <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>.
<li>Added CONTENT_TYPE environment variables (without the HTTP_prefix) to <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>, for use with cgi scripts .
<li>Fixed bug in server_write that broke <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> keep-alive support.
<li><a href="https://man.openbsd.org/httpd.8">httpd(8)</a> now adjusts read/write watermarks according to the TCP send buffer. Fixes sending of large files.
<!-- 2014/08/05 -->
<li>Load the <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> public/private keys in the parent process, then provide them to the privsep process via imsg. Allows keys to be moved out of <a href="https://man.openbsd.org/chroot.8">chroot(8)</a>.
<li>Added <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> support for loading the public/private key from memory, rather than directly from file.
<li>If a driver (eg <a href="https://man.openbsd.org/umct.4">umct(4)</a>) opens an interrupt pipe without callback function, made sure the correct transfer is aborted.
<li>Added <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> options for max requests per connection and timeout limit.
<li>Brought back <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> TCP/IP configuration options.
<li>Limited the number of Keep-Alive requests per <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> connection to 100.
<li>Improved <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> logging to allow per-server/location log files; log files can now be owned by root.
<li>Added <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> option to specify the <a href="https://man.openbsd.org/chroot.8">chroot(8)</a> directory.
<!-- 2014/08/04 -->
<li>Enabled <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> in <a href="https://man.openbsd.org/rc.d.8">rc.d(8)</a> for wider testing.
<li>Temporarily moved default location of the <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> SSL/TLS server key and certificate from /var/www/ to /var/www/conf/.
<li>Added "HTTPS = on" CGI variable to <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>.
<li>Redirect <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> to https:// if SSL/TLS is enabled.
<li>Added TLS/SSL support to <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>, based on the recent <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> commits.
<li>Changed <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> grammar from "log [style]" to "log style [style]".
<li>Provided an <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> function that returns a server connection context.
<li>Provided an <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> utility function for loading a private/public keypair.
<li><a href="https://man.openbsd.org/httpd.8">httpd(8)</a> will now print error message if the log files cannot be opened.
<li>Improved ressl_{read,write} handling of non-blocking reads/writes in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>
<li>Added initial <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> support for log files in /var/www/logs/.
<li>Implemented <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> PATH_INFO and added DOCUMENT_ROOT.
<!-- 2014/08/03 -->
<li><a href="https://man.openbsd.org/httpd.8">httpd(8)</a> now also writes log messages (eg 404 Not Found) on error.
<li>Extended <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> to dynamically pass HTTP request headers as protocol-specific HTTP_* CGI meta-variables.
<li>Add <a href="https://man.openbsd.org/ral.4">ral(4)</a> to GENERIC and RAMDISK on macppc.
<li>Fixed sys/dev/usb/ehci.c r1.162 to stop returning initialised memory on error in ehci_alloc_sqtd().
<li>Fixed sys/dev/ic/bwi.c r1.106. Prevents packet loss.
<li>Split <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> fastcgi socket path and document root options; added the SCRIPT_FILENAME CGI param with a prepended root. Fixes php-fpm that expects SCRIPT_FILENAME.
<li>Added missing <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> log call for fastcgi requests.
<li>Added another <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> log mode "connection" for a <a href="https://man.openbsd.org/relayd.8">relayd(8)</a>-style log entry after each connection.
<li><a href="https://man.openbsd.org/httpd.8">httpd(8)</a> now prefers getnameinfo() with NI_NUMERICHOST over inet_ntop (to include IPv6 scope ID).
<!-- 2014/08/02 -->
<li><a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> locations now inherit access log settings from the server.
<li>Made sure <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> reads fcgi padding data if any is received.
<li>Made <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> properly read from the fcgi bufferevent until it is empty.
<li>Allow <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> to specify a fastcgi TCP socket on localhost.
<li>Fixed <a href="https://man.openbsd.org/scandir.3">scandir(3)</a>-based directory auto index on NFS in <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>.
<!-- 2014/08/01 -->
<li>Use the log buffer to defer <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> logging until the connection is closed or the request completed.
<li>Added common and combined access logging to <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>.
<li>Rewrote <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> fcgi_add_param and hand over a lot more http headers etc. to the cgi script.
<li>Correctly parse fastcgi records if <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> doesn't get the whole record in one bufferevent_read().
<!-- 2014/07/31 -->
<li>Allow <a href="https://man.openbsd.org/softraid.4">softraid(4)</a> rebuilds to work correctly when the volume metadata has a different data offset to that currently in use.
<li>Unbroke <a href="https://man.openbsd.org/aac.4">aac(4)</a>, by re-adding uvm_extern.h for ptoa().
<li><a href="https://man.openbsd.org/httpd.8">httpd(8)</a> now only writes the HTTP header for the first fastcgi chunk.
<li><a href="https://man.openbsd.org/httpd.8">httpd(8)</a> fastcgi improvements: submit QUERY_STRING, if it exists; use a proper function to create an HTTP header; use server_file_error() to detect EOF and fastcgi stream errors; disable keep-alive/persist until there is a reliable way to get the content length.
<li>Use exact on-disk inode size with ext2 filesystems.
<li>Properly evaluate <a href="https://man.openbsd.org/rc.d.8">rc.d(8)</a> values only after running _rc_quirks(), because these can modify flags.
<li>In <a href="https://man.openbsd.org/rc.d.8">rc.d(8)</a> debug mode, properly sort and drop duplicate entries to make output less confusing.
<li>Allow <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> to specify a non-default fastcgi socket.
<li>Renamed <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> "docroot" variable to "path" (as it will be used for either files or the fastcgi socket).
<li>Added <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> configuration variable "fastcgi" to enable it per server or location.
<li>Initial fastcgi implementation for <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>.
<!-- 2014/07/30 -->
<li>Made <a href="https://man.openbsd.org/sysmerge.8">sysmerge(8)</a> properly warn when an example changes and the corresponding file is found under /etc.
<li>Add <a href="https://man.openbsd.org/tradcpp.1">tradcpp(1)</a> version 0.4, a standalone traditional whitespace-preserving <a href="https://man.openbsd.org/cpp.1">cpp(1)</a>.
<li>Added <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> "location" keyword, to specify path-specific configuration in servers; made it work with name-based virtual servers.
<li>Reserve an extra file descriptor per <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> connection, instead of per request. Fixes fd accounting with persistent connections.
<!-- 2014/07/29 -->
<li>Added extended directory index options "[no] index" and "[no] auto index" to <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a>.
<li>Reverted checks about RTF_LOCAL <a href="https://man.openbsd.org/route.4">route(4)</a> (userland tools are not yet ready for this).
<!-- 2014/07/28 -->
<li>Last (known) <a href="https://man.openbsd.org/msgbuf_write.3">msgbuf_write(3)</a> vs EOF fix incorporated into <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a>.
<li>Fixed I/O <a href="https://man.openbsd.org/ktrace.1">ktrace(1)</a> of <a href="https://man.openbsd.org/sendsyslog.2">sendsyslog(2)</a>.
<li>Pass a default media to the <a href="https://man.openbsd.org/sparc/le.4">le(4/sparc)</a> child. Allows SPARCbook system default to AUI without requiring a manual media change.
<li>Removed buggy <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> SRP code (never enabled in OpenBSD).
<li><strong>5.4, 5.5 and -current RELIABILITY FIX: Fixed possible memory exhaustion in <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a> and <a href="https://man.openbsd.org/dhcpd.8">dhcpd(8)</a>, occurring on DHCP options with 0 length.</strong><br>A source code patch is available for <a href="errata54.html#013_dhcp">5.4</a> and <a href="errata55.html#009_dhcp">5.5</a>.
<li>Merged <a href="https://man.openbsd.org/dhcpd.8">dhcpd(8)</a> packet.c r1.7 into <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a> and <a href="https://man.openbsd.org/dhcrelay.8">dhcrelay(8)</a>, to remove DoS attack vector.
<li>Match any relevant driver (not just whitelist) for <a href="https://man.openbsd.org/X.7">X(7)</a> "aperture needed" detection.
<!-- 2014/07/27 -->
<li>Fixed <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> so RSA, DH, and ECDH temporary key callbacks are correctly passed the number of keybits for the key.
<li>Made <a href="https://man.openbsd.org/pkg_add.1">pkg_add(1)</a> log libraries in a proper way.
<li>Stopped <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a> assuming in -Tutf8 output mode that a non-breaking space character has width 0.
<!-- 2014/07/26 -->
<li>Fixed hangs during suspend when stopping secondary cpu.
<li>Reverted "adjust -C algorithm" from <a href="https://man.openbsd.org/amd64/apmd.8">apmd(8/amd64)</a>, which broke suspend/resume on some machines.
<li>Fixed (very hard to reach) DoS attack vector against <a href="https://man.openbsd.org/dhcpd.8">dhcpd(8)</a>.
<!-- 2014/07/25 -->
<li>Differentiate <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> servers by address and port, not just by address.
<li>Use a URL in the Location header of <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> 3xx responses.
<li>Append mandatory Date header to each <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> response.
<li>In <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>, canonicalise the request path once without the docroot; prepend the docroot only only when it's needed.
<li>Prevent <a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a> keys remaining in memory after they have been expired or deleted.
<li>Stopped <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> leaking the docroot in the error message if the default index file is missing.
<li>Fixed <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> address matching of multiple server blocks with non-virtual hosts.
<li>Added support to <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> for "virtual hosts" (aka. server blocks).
<li>Added "root" configuration option to <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a>.
<!-- 2014/07/24 -->
<li>Sped up boot sequence by deferring scan of xt keyboard code set by <a href="https://man.openbsd.org/pckbd.4">pckbd(4)</a>.
<li>Made <a href="https://man.openbsd.org/mandoc/man8/man.cgi.8">man.cgi(8)</a> sort result pages first by section number, then by name.
<li>Provide <a href="https://man.openbsd.org/eeprom.8">eeprom(8)</a> on the sparc installation media.
<li>Build machinery added to build <a href="https://man.openbsd.org/eeprom.8">eeprom(8)</a> for the installation media on relevant arches.
<li>Unbreak <a href="https://man.openbsd.org/route.4">route(4)</a> flush: skip local (RTF_LOCAL) routes when flushing.
<li>Reverted ssp-strong from <a href="https://man.openbsd.org/gcc.1">gcc(1)</a> on arm, which exposed too many bugs in <a href="https://man.openbsd.org/ports.7">ports(7)</a>.
<li>Plugged <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> memleak, to free the HTTP descriptor containing all the headers etc. of a connection.
<li>Provided a dropdown entry "All Architectures" to <a href="https://man.openbsd.org/mandoc/man8/man.cgi.8">man.cgi(8)</a> and made it the default.
<!-- 2014/07/23 -->
<li>When <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> is canonicalising the path, fail on truncation.
<li>Made <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> redirect with 301 if a directory name was requested without the trailing slash.
<li>First attempt at having <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> verify request path and access permissions.
<li>In <a href="https://man.openbsd.org/getaddrinfo_async.3">getaddrinfo_async(3)</a> and similar, made queries fail when the hostname param is an empty string.
<li>In <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> level_add_node(), do not free objects on cleanup which are still being referenced by other objects.
<li>Made sure <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> PEM_def_callback() correctly handles negative buffer sizes.
<li>Removed lynx from the base system (available in <a href="https://man.openbsd.org/packages.7">packages(7)</a> instead).
<li><a href="https://man.openbsd.org/Mandoc.1">Mandoc(1)</a> security fix: after decoding numeric or one-character escape sequences, HTML-encode resulting character.
<li>Correctly shutdown the servers when the <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> process is terminating. Prevents a crash on exit.
<li>On octeon, correctly drain and destroy the bufq upon detach.
<!-- 2014/07/22 -->
<li>Adjusted <a href="https://man.openbsd.org/apmd.8">apmd(8)</a> -C algorithm to be more aggressive in scaling up cpu speed.
<li>Reverted recent "memory poison" commit until after release (triggering too many use-after-free bugs).
<li><a href="https://man.openbsd.org/mandoc/man8/man.cgi.8">man.cgi(8)</a> security fixes, to prevent XSS attacks.
<li>In <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> DES_random_key(), force the generated key to the correct parity; use it to generate DES keys in the EVP_CTRL_RAND_KEY method handlers.
<li>Enable <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> in the builds for more testing (not finished but can serve static files).
<li>Added initial <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> example for <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>.
<!-- 2014/07/21 -->
<li>Added the <a href="https://man.openbsd.org/X.7">X(7)</a> "aperture needed" test to <a href="https://man.openbsd.org/vgafb.4">vgafb(4)</a>, to match vga@pci.
<li>Corrected the initialiser for tunnconf_default_pptp in <a href="https://man.openbsd.org/npppd.8">npppd(8)</a>.
<li>Reduced amount of messages from key_load_private_pem during <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> hostbased auth.
<li>Made <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a> preserve manpath and arch in .Xr links.
<li>Reverted <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> up/down wheel emulation.
<li>Stopped the installer setting (obsolete) <a href="https://man.openbsd.org/sysctl.8">sysctl(8)</a> net.inet6.ip6.accept_rtadv and net.inet6.icmp6.rediraccept.
<li>Made <a href="https://man.openbsd.org/mandoc/man8/man.cgi.8">man.cgi(8)</a> match RFC 2616, so the "Location: response-header" field is an absolute URI.
<li>Dropped explicit <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> support for F13-F20; match the <a href="https://man.openbsd.org/xterm.1">xterm(1)</a> <a href="https://man.openbsd.org/terminfo.5">terminfo(5)</a> entry.
<!-- 2014/07/20 -->
<li>Stopped kprintf in <a href="https://man.openbsd.org/gcc.1">gcc(1)</a> accepting the <number>$ flags (as <a href="https://man.openbsd.org/printf.9">printf(9)</a> doesn't support them).
<li>When amd64/i386/loongson hibernate, look up correct device when using <a href="https://man.openbsd.org/softraid.4">softraid(4)</a>.
<li>Updated to pixman 0.32.6
<li>Support hibernating to <a href="https://man.openbsd.org/softraid.4">softraid(4)</a> crypto volumes on amd64/i386/loongson.
<li>Fix <a href="https://man.openbsd.org/tcpdump.8">tcpdump(8)</a> display of logical link control data in IEEE802 frames.
<li><a href="https://man.openbsd.org/acpi.4">acpi(4)</a> now ignores region marked as "Preserve" if all bits will be modified. Fixes hang on some Sony and Asus laptops.
<li>Always allocate <a href="https://man.openbsd.org/bwi.4">bwi(4)</a> ring descriptors below the 1GB boundary. Fixes "intr fatal TX/RX" errors.
<li>On <a href="https://man.openbsd.org/bwi.4">bwi(4)</a>, make bwi_dma_mbuf_create() use the correct loop counter in error case.
<li>Load <a href="https://man.openbsd.org/bwi.4">bwi(4)</a> firmware once, not every time the interface is brought up. Fixes a panic.
<li>Fixed array overflow in <a href="https://man.openbsd.org/telnet.1">telnet(1)</a> command line handling
<li>When <a href="https://man.openbsd.org/spamd.8">spamd(8)</a> is started by <a href="https://man.openbsd.org/rc.d.8">rc.d(8)</a>: no longer start in background mode; return from rc_start() if <a href="https://man.openbsd.org/spamd.8">spamd(8)</a> failed to start; execute <a href="https://man.openbsd.org/spamd-setup.8">spamd-setup(8)</a> without explicitly waiting for <a href="https://man.openbsd.org/spamd.8">spamd(8)</a>.
<li>Fixed auto-upgradable file detection by <a href="https://man.openbsd.org/sysmerge.8">sysmerge(8)</a>.
<!-- 2014/07/19 -->
<li>Aligned <a href="https://man.openbsd.org/telnet.1">telnet(1)</a> with the manpage by making the "-a" use <a href="https://man.openbsd.org/getlogin.2">getlogin(2)</a>; ignore value if it returns a nonexistent user.
<li>Flensed the <a href="https://man.openbsd.org/telnet.1">telnet(1)</a> code base of support for ancient protocols and systems.
<li>On loongson, fixed Lemote reboot issue and <a href="https://man.openbsd.org/usb.4">usb(4)</a> problems on Gdium models.
<li><a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a> security fixes: validate name of file before opening; only allow relative filenames starting with "man" or "cat" and not containing "/.." or "../"; validate the manpath up front, report a Bad Request if it is not listed in manpath.conf; in case of configuration errors, only report "Internal Server Error".
<!-- 2014/07/18 -->
<li>Fixed <a href="https://man.openbsd.org/strtonum.3">strtonum(3)</a> range, to unbreak "-pass fd:0" in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<li>Cleaned up portable <a href="https://man.openbsd.org/arc4random.3">arc4random(3)</a> fork detection code; let it take advantage of systems with healthy <a href="https://man.openbsd.org/getentropy.2">getentropy(2)</a>.
<li>Stopped <a href="https://man.openbsd.org/mandoc/man8/man.cgi.8">man.cgi(8)</a> using the HTTP_HOST CGI variable (made HTTP redirect Location: relative). Reduces attack surface.
<li>Removed dev/log AF_UNIX sockets from various <a href="https://man.openbsd.org/chroot.2">chroot(2)</a> spaces, since <a href="https://man.openbsd.org/syslog.3">syslog(3)</a> messages are now sent via <a href="https://man.openbsd.org/sendsyslog.2">sendsyslog(2)</a>.
<li>Fixed <a href="https://man.openbsd.org/pkg_add.1">pkg_add(1)</a> sorted output.
<li>When <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a> MAN_DIR or manpath.conf do not exist or are empty, <a href="https://man.openbsd.org/exit.3">exit(3)</a> in a controlled way.
<li>Fixed privilege separation in <a href="https://man.openbsd.org/npppd.8">npppd(8)</a>.
<li>In <a href="https://man.openbsd.org/bnx.4">bnx(4)</a>, implemented EFBIG handling for heavily fragmented packets on the tx path.
<!-- 2014/07/17 -->
<li>In <a href="https://man.openbsd.org/dump.8">dump(8)</a>, allow files-to-dump to be a duid.
<li>On sgi, optimised use of external L2 cache handling on the few Indy/Indigo2 systems which have it.
<li>Unbroke <a href="https://man.openbsd.org/rc.d.8">rc.d(8)</a> script for <a href="https://man.openbsd.org/smapd.8">smapd(8)</a> after the rc_do->_rc_do and rc_wait->_rc_wait renaming.
<li>Zero out the random buffer for <a href="https://man.openbsd.org/sysctl.3">sysctl(3)</a> and the entropy buffer.
<li>Made sure the biglock is held on i386 when running interrupt handlers (which rely on it).
<li>Reflect stdio-forward ("ssh -W host:port ...") failures in <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> exit status (bz#2255).
<li>In x509_vfy.c, free sktmp when it's no longer needed. Fixes many memory leaks in <a href="https://man.openbsd.org/ssl.3">ssl(3)</a>.
<!-- 2014/07/16 -->
<li>Added <a href="https://man.openbsd.org/mpbios.4">mpbios(4)</a> to RAMDISK_CD on i386/amd64, so bsd.mp is selected when installing to Soekris net6501.
<li>Implemented file descriptor accounting in <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> for single-pass HTTP connections, persistent connections with multiple requests, and body-less HEAD requests.
<!-- 2014/07/15 -->
<li>Added <a href="https://man.openbsd.org/sshd.8">sshd(8)</a> support for unix domain socket forwarding.
<!-- 2014/07/14 -->
<li>Updated to xf86-video-neomagic 1.2.8.
<li>Enable ext2fs support on RAMDISK_CD.
<li>Converted <a href="https://man.openbsd.org/ftp.1">ftp(1)</a> to libressl.
<li>Removed <a href="https://man.openbsd.org/securelevel.7">securelevel(7)</a> variable from <a href="https://man.openbsd.org/rc.8">rc(8)</a>.
<li>powerdown=YES removed from <a href="https://man.openbsd.org/reboot.8">reboot(8)</a>.
<li>Updated to <a href="https://man.openbsd.org/xterm.1">xterm(1)</a> version 309.
<!-- 2014/07/13 -->
<li>Fixed timeouts in <a href="https://man.openbsd.org/relayd.8">relayd(8)</a> when one connection is spliced and one non-spliced.
<li>Added configuration handling for certificate and key files to libressl.
<li><a href="https://man.openbsd.org/KASSERTMSG.9">KASSERTMSG(9)</a>: new function for a kernel assertion with message.
<li>Fixed sched_stop_secondary_cpus() to properly drain run queues from CPUs.
<li>Display zero page hit and miss counters in <a href="https://man.openbsd.org/vmstat.8">vmstat(8)</a> -s.
<li>Show an error if cmd_find_session can't find the current <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> session.
<li>Made <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> close a connection when it receives an EOF.
<li>If a client is killed while suspended with ^Z, <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> will no longer try to resume it.
<li>Removed all crypt choices other than bcrypt from <a href="https://man.openbsd.org/adduser.8">adduser(8)</a>.
<li>When using NAT or redirects, recalculate the checksum of reassembled IPv6 fragments before the packet is refragmented.
<li>Fixed path MTU discovery with <a href="https://man.openbsd.org/ping6.8">ping6(8)</a> through <a href="https://man.openbsd.org/pf.4">pf(4)</a> using nat or rdr.
<li>Introduced the PS_NOBROADCASTKILL flag that excludes processes from receiving <a href="https://man.openbsd.org/kill.1">kill(1)</a> -1 broadcast signals.
<li><a href="https://man.openbsd.org/KERNEL_ASSERT_LOCKED.9">KERNEL_ASSERT_LOCKED(9)</a> function added, working towards removal of the kernel lock.
<li>Initial support to read GPT partition tables in the kernel on i386/amd64 (requires option GPT).
<li>Ensured <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> finishes writing the output before closing the connection.
<li>Fixed tight renew loop regression in <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a>.
<li><a href="https://man.openbsd.org/httpd.8">httpd(8)</a> will now close the connection after the response is completed (no Keepalive yet).
<li>Added <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> support for media types (compatible with <a href="https://man.openbsd.org/nginx.8">nginx(8)</a> mime.types file).
<li>Added ext4 read support.
<li>Brought man.cgi default mode closer to what <a href="https://man.openbsd.org/man.1">man(1)</a> does.
<li>Close connection/remove event handler when <a href="https://man.openbsd.org/ypldap.8">ypldap(8)</a> msgbuf_write() hits an EOF.
<li>Introduced <a href="https://man.openbsd.org/mount.8">mount(8)</a> -N option and a "net" mount option, and matching <a href="https://man.openbsd.org/fsck.8">fsck(8)</a> -N flag.
<li>Updated <a href="https://man.openbsd.org/glxinfo.1">glxinfo(1)</a> and <a href="https://man.openbsd.org/glxgears.1">glxgears(1)</a> to version in mesa demos 8.2.0.
<li>Better <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> error messages.
<!-- 2014/07/12 -->
<li>Added <a href="https://man.openbsd.org/httpd.8">httpd(8)</a>, a simple web server (preliminary version).
<li><a href="https://man.openbsd.org/dmesg.8">dmesg(8)</a> now indicates if aperture driver is required by <a href="https://man.openbsd.org/X.7">X(7)</a>. Used by installer for <a href="https://man.openbsd.org/sysctl.8">sysctl(8)</a> machdep.allowaperture setting.
<li>Fixed <a href="https://man.openbsd.org/usb.4">usb(4)</a> connect freeze on octeon, by clearing the host port interrupt.
<li>Resize inpcb hashtable automatically.
<li>Removed <a href="https://man.openbsd.org/udfu.4">udfu(4)</a>.
<li>Updated to xf86-video-modesetting 0.9.0.
<li>On octeon, fixed root hub descriptors by matching <a href="https://man.openbsd.org/ehci.4">ehci(4)</a>'s descriptors.
<li>In <a href="https://man.openbsd.org/sysmerge.8">sysmerge(8)</a>, use <a href="https://man.openbsd.org/sha256.1">sha256(1)</a> for compared files.
<li>Rework <a href="https://man.openbsd.org/zyd.4">zyd(4)</a>'s register read/write methods to eliminate race conditions.
<li>Fixed <a href="https://man.openbsd.org/netstart.8">netstart(8)</a> after autoconf6 change so "rtsol" lines in <a href="https://man.openbsd.org/hostname.if.5">hostname.if(5)</a> work again.
<li>Always create a local <a href="https://man.openbsd.org/route.4">route(4)</a> for every configured IPv4 address on the machine; made sure the local <a href="https://man.openbsd.org/route.4">route(4)</a> is removed during an address change (stops <a href="https://man.openbsd.org/pppoe.4">pppoe(4)</a> corrupting the routing tree); do not add a local route if the specified address is 0.0.0.0 (prevents tree corruption).
<li>Use <a href="https://man.openbsd.org/imsg.3">imsg(3)</a> between the privileged and the non-privileged <a href="https://man.openbsd.org/npppd.8">npppd(8)</a> processes.
<li>Fixed <a href="https://man.openbsd.org/whatis.1">whatis(1)</a>, to correctly match words instead of any substrings; provide an internal mode for <a href="https://man.openbsd.org/mandoc/man8/man.cgi.8">man.cgi(8)</a>.
<li>Removed <a href="https://man.openbsd.org/qli.4">qli(4)</a> (never enabled and was unfinished).
<li>Made <a href="https://man.openbsd.org/rc.conf.8">rc.conf(8)</a> a parsed configuration file; stop sourcing it as a shell script.
<li>Updated to libICE 1.0.9 and libXft 2.3.2.
<li>Add a function to drop all clean pages on the <a href="https://man.openbsd.org/uvm.9">uvm(9)</a> page daemon queues; call it when we hibernate.
<li>Moved macppc <a href="https://man.openbsd.org/abtn.4">abtn(4)</a> driver from workq to taskq.
<li>Only detach the <a href="https://man.openbsd.org/usb.4">usb(4)</a> device that has been disconnected, to fix a regression.
<!-- 2014/07/11 -->
<li>Implemented checksum offload for <a href="https://man.openbsd.org/divert.4">divert(4)</a>.
<li>Allowed <a href="https://man.openbsd.org/acpitz.4">acpitz(4)</a> to accept a temperature reading of 0 degC (fixes some machines with "failed to read _TMP" errors).
<li>Stopped <a href="https://man.openbsd.org/acpitz.4">acpitz(4)</a> reporting bogus temperature values (temperatures > 4,000 degC) and therefore shutting down the machine.
<li>Initial version of libressl; provide LIBRESSL_VERSION_NUMBER to detect versions distinct from OPENSSL_XXX.
<li>Limit <a href="https://man.openbsd.org/relayd.8">relayd(8)</a> HTTP header length to 8K (based on the default of 4-8K common in web servers).
<li>In <a href="https://man.openbsd.org/boot.9">boot(9)</a>, purged curproc-overriding hacks.
<li><a href="https://man.openbsd.org/bluetooth.4">bluetooth(4)</a> support removed (code did not work properly anyway).
<li>Better <a href="https://man.openbsd.org/m4.1">m4(1)</a> error handling in mkstemp/unlink/fdopen logic.
<li>Started reducing the attack surface of <a href="https://man.openbsd.org/lynx.1">lynx(1)</a> (gopher, news, and dired left enabled for now).
<li>Enabled interrupt routines on octeon.
<li>Added <a href="https://man.openbsd.org/relayd.conf.5">relayd.conf(5)</a> options for disallowing client-initiated renegotiations and to prefer the server's cipher list.
<li>Added <a href="https://man.openbsd.org/relayd.8">relayd(8)</a> support for EDH to provide perfect forward secrecy for older <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> clients.
<li>Stopped DHCPINFORM in <a href="https://man.openbsd.org/dhcpd.8">dhcpd(8)</a> looking up the lease database, filling the yiaddr field, or including lease time parameters.
<li>Introduced IFXF_AUTOCONF6 interface and removed net.inet6.ip6.accept_rtadv from <a href="https://man.openbsd.org/sysctl.8">sysctl(8)</a>.
<li>Allow IFXF_AUTOCONF6 to be set and cleared via <a href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a>.
<li>On <a href="https://man.openbsd.org/rtsold.8">rtsold(8)</a>, turned AFXF_AUTOCONF6 on.
<li>Placed the first examples into the new /etc/examples directory.
<li>Documentation update for libcrypto and <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<li>Prevent infinite loop during <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> configuration file parsing (PR #2985).
<li>In ssl3_get_cert_verify(), accommodate <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> RSA keys larger than 4096-bit (PR #319).
<li>Fixed copy for CCM, GCM and XTS (<a href="https://man.openbsd.org/ssl.8">ssl(8)</a> PR #3272).
<li>Added machine independent <a href="https://man.openbsd.org/reboot.9">reboot(9)</a> function.
<li>Removed redundant check and wrong fix from <a href="https://man.openbsd.org/fsck_msdos.8">fsck_msdos(8)</a>: fat.c checks already take care of cluster chains.
<li>In <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> asn1_get_length(), tolerate leading zeroes in BER encoding (PR #2746).
<li>In <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> EVP_PBE_alg_add don't use the underlying NID for the cipher, as it may have a non-standard key size (PR #3206).
<li>By popular demand, added back hamc-sha1 to <a href="https://man.openbsd.org/sshd.8">sshd(8)</a> protocols (still used by many clients).
<li>Fixed <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> OID encoding for single components (PR #2556).
<li>More <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> memory leaks and unchecked allocations fixed (PR #3403).
<li>Made sure BN_sqr never returns negative numbers (<a href="https://man.openbsd.org/ssl.8">ssl(8)</a> PR #3400).
<li>Let <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> accept CCS again after "finished" has been sent by the client. Avoids failed renegotiations (PR #3400).
<li>In <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> dtls1_clear_queues(), free buffered_add_data.q correctly (PR #3286).
<li>Fixed version number processing in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> cms_sd_set_version() (PR #3249).
<li>Removed <a href="https://man.openbsd.org/rdist.1">rdist(1)</a>.
<li>Avoid panic on alpha when using network card with a small number of tx descriptors per packet, a lot of memory, and a heavily fragmented packets.
<li>When looking for the issuer of a <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> X.509 certificate, only return an expired certificate if no valid certificates have been found (PR #3359).
<li>In <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> ssl3_get_client_key_exchange() parsing a GOST session key, invoke the regular ASN.1 parser (PR #3335).
<li>Removed RFC4620 Node Information Query support from the kernel.
<li>Made <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> CMS_decrypt_set1_pkey() return an error if no recipient type matches, instead of returning a random key (PR #3348).
<li>Fixed missing initialisation in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> (PR#3289 and #3345).
<li>Simplified <a href="https://man.openbsd.org/relayd.8">relayd(8)</a> code that handles the HTTP headers. Fixes some issues (e.g. handling of multiple "Set-Cookie" headers).
<li>Don't hold the kernel lock while halting a processor.
<li>New CPU_BUSY_CYCLE() function, so the CPU can reduce power consumption in busy loops.
<li>Synchronised zaurus's <a href="https://man.openbsd.org/boot.9">boot(9)</a> with all others by having it call if_downall().
<li>Added -u option to <a href="https://man.openbsd.org/dhcpd.8">dhcpd(8)</a>. Binds UDP port to answer DHCPINFORM from clients on non-ethernet interfaces (eg. <a href="https://man.openbsd.org/tun.4">tun(4)</a> or <a href="https://man.openbsd.org/pppx.4">pppx(4)</a>).
<li>Converted <a href="https://man.openbsd.org/bus_dmamem_map.9">bus_dmamem_map(9)</a> to <a href="https://man.openbsd.org/km_alloc.9">km_alloc(9)</a>, to fail (not sleep) if the allocator cannot obtain a lock when BUS_DMA_NOWAIT is specified.
<li>Updated to <a href="https://man.openbsd.org/Xserver.1">Xserver(1)</a> version 1.15.2.
<li>Corrected readlink termination in <a href="https://man.openbsd.org/csh.1">csh(1)</a>.
<!-- 2014/07/10 -->
<li>Using -U command-line option, allow <a href="https://man.openbsd.org/ftp.1">ftp(1)</a> to change its user agent for HTTP(S) URL requests.
<li>Flush the buffercache to 16MB on hibernate and restore its previous max size (kern.bufcachepercent) on resume. Better hibernate performance.
<li>Set cold to 1 before executing the DVACT_POWERDOWN handlers when halting or rebooting a machine. Avoids panic on macppc with <a href="https://man.openbsd.org/uhci.4">uhci(4)</a> cardbus.
<li>Fixed panic seen when unplugging a cardbus <a href="https://man.openbsd.org/ehci.4">ehci(4)</a>, <a href="https://man.openbsd.org/ohci.4">ohci(4)</a> or <a href="https://man.openbsd.org/uhci.4">uhci(4)</a>.
<li>Taught <a href="https://man.openbsd.org/fsck_msdos.8">fsck_msdos(8)</a> that uninitialised values (-1) in FSInfo are valid.
<li><a href="https://man.openbsd.org/newfs_msdos.8">newfs_msdos(8)</a> fixes: always put boot signature at end of 512 byte sector, even on disks with larger sector sizes; do not point at a cluster that is in use; avoid out of boundary access when checking invalid long filenames; validate number of FATs; validate critical file system info.
<li>Improved <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> scheduler: can now return envelopes of different types in a single run (interlaced to avoid batch effects); send envelopes at a rate that the queue can sustain; limit the number of envelopes in a holdq (excess returned to pending queue).
<li>Return RSN (WPA) information to userland during <a href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a> wireless scan; show whether a wireless network uses WEP or WPA.
<li><a href="https://man.openbsd.org/m4.1">m4(1)</a> will now annotate regexp error messages with the source string.
<li>Stop using a shutdown hook for <a href="https://man.openbsd.org/softraid.4">softraid(4)</a> and explicitly shutdown the disciplines right after vfs_shutdown().
<li>Added bus and root hub routines to octeon, to prevent panic at attach.
<li>Made <a href="https://man.openbsd.org/usbdevs.8">usbdevs(8)</a> correctly report devices connected to <a href="https://man.openbsd.org/xhci.4">xhci(4)</a>.
<li>Fixed missing allocation checks and potential NULL pointer dereference in the error path in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> PEM_X509_INFO_read_bio().
<li><a href="https://man.openbsd.org/vic.4">vic(4)</a> now records the size of the rx rings so we can wrap around them correctly. Fixed a panic.
<li>Added internal buffering for <a href="https://man.openbsd.org/dump.8">dump(8)</a>. Ensures all requested data is actually read from the device when they have non-512 byte sectors.
<li>Removed bogus preprocessor statements (trying to pick the largest integer type for BF_LONG, MD[45]_LONG and SHA_LONG) from <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<li>Removed compression from <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<!-- 2014/07/09 -->
<li>Simplified the way <a href="https://man.openbsd.org/divert.4">divert(4)</a> sends packets to userspace.
<li>When <a href="https://man.openbsd.org/relayd.8">relayd(8)</a> is copying structures via imsg, ensured contents do not contain bogus pointer values.
<li>Merged in mesa 10.2.3.
<li>In <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> ocsp_lib.c, reset host, port and path to null after freeing so the caller doesn't accidentally free them again.
<li>Removed <a href="https://man.openbsd.org/mkstr.1">mkstr(1)</a> and <a href="https://man.openbsd.org/xstr.1">xstr(1)</a>.
<li>Replace <a href="https://man.openbsd.org/relayd.8">relayd(8)</a> protocol directives for HTTP with a new generic filtering language (grammar inspired by <a href="https://man.openbsd.org/pf.4">pf(4)</a>).
<li>Fixed resume time page table issue on amd64 if the piglet was located above 1GB physical (caused by using an incorrect page size mask).
<li>Cleaned up and simplified <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> SSL_CIPHER_description by always using <a href="https://man.openbsd.org/asprintf.3">asprintf(3)</a>.
<li>Added daemon_timeout variable to <a href="https://man.openbsd.org/rc.d.8">rc.d(8)</a> and <a href="https://man.openbsd.org/rc.subr.8">rc.subr(8)</a> (sets maximum time to wait for actions to return).
<li>Fixed crash in <a href="https://man.openbsd.org/ssh-add.1">ssh-add(1)</a> while loading more than one key.
<li>Fixed classless-{ms-,}static-routes in <a href="https://man.openbsd.org/dhcpd.8">dhcpd(8)</a> to comply RFC 3442.
<li>Added "no-dsn" listener option <a href="https://man.openbsd.org/smtpd.conf.5">smtpd.conf(5)</a>, which disables DSN extension.
<li>Suspend kernel's stack smash guard to avoid panicking during unpack.
<li>Fixed i386/amd64 hibernate issue where kernel lock acquisition was started but not completed.
<li>Removed <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> "export" cipher handling.
<li><a href="https://man.openbsd.org/ncheck_ffs.8">ncheck_ffs(8)</a> now accepts duid for the filesystem argument.
<li><a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> config parser improvements: fail if the same option is specified multiple times on a listener; prompt for queue encryption key after (not during) <a href="https://man.openbsd.org/smtpd.conf.5">smtpd.conf(5)</a> parsing; added ip addresses to localnames table.
<li><a href="https://man.openbsd.org/bpf.4">bpf(4)</a> code simplification.
<li>Set <a href="https://man.openbsd.org/sysctl.8">sysctl(8)</a> default of net.inet6.icmp6.nodeinfo to 0, disabling responses to RFC4620 IPv6 Node Information Queries.
<li>Fixed <a href="https://man.openbsd.org/boot.8">boot(8)</a> -d on amd64 and i386.
<!-- 2014/07/08 -->
<li>Updated to <a href="https://man.openbsd.org/lynx.1">lynx(1)</a> version 2.8.8rel2, keeping local changes.
<li>Downgraded more <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> error() to debug(). Suppresses spurious errors with hostbased authentication enabled.
<li>More useful <a href="https://man.openbsd.org/sftp.1">sftp(1)</a> error message when GLOB_NOSPACE occurs (bz#2254).
<li>While filling the rx ring, stopped <a href="https://man.openbsd.org/bnx.4">bnx(4)</a> and <a href="https://man.openbsd.org/msk.4">msk(4)</a> being too smart in avoiding overuse of file descriptors.
<li>Marked the weakened <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> 40-bit export ciphers as invalid.
<li><a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> now sends correct imsg when enabling profiling at runtime.
<li>Removed <a href="https://man.openbsd.org/asa.1">asa(1)</a>.
<li>Fixed a double free bug in parsing <a href="https://man.openbsd.org/npppd.conf.5">npppd.conf(5)</a>.
<li>Stopped <a href="https://man.openbsd.org/npppd.8">npppd(8)</a> accessing freed memory when it is exiting.
<li>Define SMALL_REGISTER_BANK in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> on arm and vax. Generates faster code (vax 30% faster).
<li>Various <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> queue improvements.
<li>Made sure to clear the WAIT flag when cancelling the <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> MTA connector timeout.
<li>Pulled the rx ring accounting out of the <a href="https://man.openbsd.org/mbuf.9">mbuf(9)</a> layer. Simplifies the allocation paths.
<!-- 2014/07/07 -->
<li>On <a href="https://man.openbsd.org/em.4">em(4)</a>, bus_dmamap_sync the rx ring once per em_rxeof call, rather than for every rx descriptor.
<li>Stopped <a href="https://man.openbsd.org/em.4">em(4)</a> stalling the entire tx path when it encounters a heavily fragmented packet.
<li>Cleaned up <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a> ERROR messages related to document structure and macros.
<li>Run <a href="https://man.openbsd.org/getuid.2">getuid(2)</a>, <a href="https://man.openbsd.org/getgid.2">getgid(2)</a>, <a href="https://man.openbsd.org/getresuid.2">getresuid(2)</a>, <a href="https://man.openbsd.org/setreuid.2">setreuid(2)</a> and <a href="https://man.openbsd.org/setuid.2">setuid(2)</a> without the kernel lock.
<li>Stopped <a href="https://man.openbsd.org/pckbc.1">pckbc(1)</a> printing warnings for mouse interrupts when running bsd.rd.
<li>In <a href="https://man.openbsd.org/pkg_add.1">pkg_add(1)</a>, restored the progress meter for large files.
<li>Stopped <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a> unnecessarily deleting any content from .Rs blocks.
<li>Implemented .dei and .ami in <a href="https://man.openbsd.org/roff.7">roff(7)</a>.
<li><a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> now allows enabling profiling at runtime.
<!-- 2014/07/06 -->
<li>If <a href="https://man.openbsd.org/acpi.4">acpi(4)</a> finds a bogus interrupt, don't panic but print a message, to workaround dodgy BIOS.
<li>Marked <a href="https://man.openbsd.org/getentropy.2">getentropy(2)</a> with NOLOCK (it doesn't need the kernel lock).
<li>After <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a> skips an escape sequence with incomplete arguments, stop it discarding the rest of the string.
<li>Fixed expansion of escape sequences with incomplete arguments by <a href="https://man.openbsd.org/roff.7">roff(7)</a>.
<li>Fixed handling of escape sequences taking numeric arguments by <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a>.
<li>Avoid <a href="https://man.openbsd.org/radeon.4">radeon(4)</a> segfault on device open when accel is not working.
<!-- 2014/07/05 -->
<li>Fixed <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> remote-forward cancel regression.
<li><a href="https://man.openbsd.org/ftp.1">ftp(1)</a> fixes: URL-decode user and password info before base64 encoding it for the Authorization header; eliminated COOKIE_MAX_LEN constant; renamed the "user:pass" variable from "cookie" to "credentials"; empty password is no longer an error; fixed leak of username/password memory.
<!-- 2014/07/04 -->
<li>Cleaned up -offset and -width in <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a>: bugfix so last one wins; do not ignore ".Bl -width" without argument.
<li><a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> will now always attempt to use tls for relaying to the primary server when acting as a backup mx.
<li><a href="https://man.openbsd.org/tcpdump.8">tcpdump(8)</a> now always prints the OSPF router id.
<!-- 2014/07/03 -->
<li>Changed <a href="https://man.openbsd.org/kvm_getprocs.3">kvm_getprocs(3)</a> (<a href="https://man.openbsd.org/sysctl.3">sysctl(3)</a> and <a href="https://man.openbsd.org/kvm.3">kvm(3)</a> backends) to report thread's "most active" scheduler state.
<li>Fixed <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a> formatting of empty .Bl -inset item heads; show the list type in the error message.
<li>Added a <a href="https://man.openbsd.org/sshd_config.5">sshd_config(5)</a> PermitUserRC option to control whether ~/.ssh/rc is executed (bz#2160).
<li>Allow explicit ::1 and 127.0.0.1 forwarding bind addresses when GatewayPorts=no. Allows client to choose address family (bz#2222).
<li>When <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> is rekeying, skip file/DNS lookups if it is the same as the key sent during initial key exchange (bz#2154).
<li><a href="https://man.openbsd.org/radeon.4">radeon(4)</a> now gets clocks from Open Firmware on macppc and sparc64.
<li><a href="https://man.openbsd.org/bge.4">bge(4)</a> can now cope with heavily fragmented packets when the DMA map lacks space.
<li>Stopped <a href="https://man.openbsd.org/uvm.9">uvm(9)</a> releasing the kernel lock between issuing a wakeup and clearing the PG_BUSY and PG_WANTED flags.
<li>Made <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> "too many authentication failures" message format similar to other authentication messages (bz#2199).
<li>Reverted to r1.129 of sys/kern/subr_pool.c, as pool_init() is called before rwlocks can be used on some archs.
<li><a href="https://man.openbsd.org/ssh_config.5">ssh_config(5)</a> LocalCommand and ControlPath variables now expand to unique identifers (bz#2220).
<!-- 2014/07/02 -->
<li>When hashing or removing hosts using <a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>, no longer choke on @revoked markers or remove @cert-authority markers (bz#2241).
<li>Standardised <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> on NI_MAXHOST for <a href="https://man.openbsd.org/gethostname.3">gethostname(3)</a> string lengths. Fixes bz#2239.
<li>Use EVP_Digest() for one-shot hash instead of creating, updating, finalising and destroying a context in <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> (bz#2231).
<li>Made stdout line-buffered; saves partial output getting lost when <a href="https://man.openbsd.org/ssh-add.1">ssh-add(1)</a> fatal()s part-way through (bz#2234).
<li>Only cleanup agent socket in the main <a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a> process, not in any subprocesses (bz#2236).
<li>Made ed25519 key titles fit properly in the <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> randomart border (bz#2247).
<li>Be more careful when recreating single-precision (float) argument to service precise exceptions on m88k.
<li>Improved <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a> messages about empty macros (reporting the macro names involved).
<li>Fixed fpu_compare() on m88k, so <a href="https://man.openbsd.org/gcc.1">gcc(1)</a> correctly compare numbers to infinity.
<li>Hold kernel lock when invoking process_domem() on alpha and m88k. Fixes <a href="https://man.openbsd.org/ptrace.2">ptrace(2)</a> operation on MP kernels.
<li>Added support for adjusting the receive filter to allow for promiscuous mode/multicast traffic by <a href="https://man.openbsd.org/armv7/imx.4">imx(4/armv7)</a>.
<li>Revised change made in pk7_doit.c r1.20 in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>. Fixes detached signature processing.
<li>Made sure <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> session sockets are not cleared in the <a href="https://man.openbsd.org/daily.8">daily(8)</a> tmp cleanup.
<li>Fixed the column numbers associated with in_line_argn() macros in <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a>.
<li><a href="https://man.openbsd.org/kdump.1">kdump(1)</a> now properly processes <a href="https://man.openbsd.org/minherit.2">minherit(2)</a> flags.
<!-- 2014/07/01 -->
<li>Improved "skipping paragraph macro" messages in <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a>.
<li>Fixed regression in <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> protocol 1 to avoid fatal(); more useful status codes.
<li>Implemented obsolete <a href="https://man.openbsd.org/mdoc.7">mdoc(7)</a> macros .En .Es .Fr and .Ot for backward compatibility.
<li>Clean up the warnings related to <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a> document structure.
<li>Allow link-local address to be configured by "ifconfig up" if the <a href="https://man.openbsd.org/inet6.4">inet6(4)</a> address was configured beforehand.
<li>Fixed panic seen when trying to remove a <a href="https://man.openbsd.org/route.4">route(4)</a> with a 0.0.0.0 destination.
<li>Turned <a href="https://man.openbsd.org/pkg_add.1">pkg_add(1)</a> out-of-order extraction back on; activated out-of-order archives based on history.
<!-- 2014/06/30 -->
<li><a href="https://man.openbsd.org/scsi.8">scsi(8)</a> io can now run through the midlayer without the kernel biglock.
<li>Fixed <a href="https://man.openbsd.org/roff.7">roff(7)</a> control flow keywords \{ and \} when they immediately follow a request or macro name.
<li><a href="https://man.openbsd.org/pfctl.8">pfctl(8)</a> af-to rules no longer need to specify the address family after "pass".
<li>Suppressed spurious <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> error message when loading key with a passphrase.
<li>Attach HFSC only after it's been initialised. Fixes the "integer divide fault trap" bug.
<!-- 2014/06/29 -->
<li>Major cleanup in <a href="https://man.openbsd.org/roff.7">roff(7)</a> .de parsing routine, to correctly handle names terminated by escape sequences.
<!-- 2014/06/27 -->
<li>Fixed loading of private keys by <a href="https://man.openbsd.org/ssh.1">ssh(1)</a>.
<li>Move to a smaller rbytes buffer and skip a random part in <a href="https://man.openbsd.org/malloc.3">malloc(3)</a>, to introduce noise in the <a href="https://man.openbsd.org/arc4random.3">arc4random(3)</a> calling pattern.
<li>Fixed remote forwarding in <a href="https://man.openbsd.org/sshd.8">sshd(8)</a> with same listen port but different listen address.
<li>Avoid buffer overflow when there are too many boot arguments, and on reaching maximum line length.
<!-- 2014/06/26 -->
<li>Do not redirect STDERR of <a href="https://man.openbsd.org/security.8">security(8)</a> to /dev/null, so errors in the <a href="https://man.openbsd.org/security.8">security(8)</a> script are seen.
<li>Fully remove relevant <a href="https://man.openbsd.org/carp.4">carp(4)</a> addresses when IFXF_NOINET6 is set or when the rdomain is changed.
<!-- 2014/06/25 -->
<li>Workaround compatibility problems between Intel <a href="https://man.openbsd.org/ahci.4">ahci(4)</a> and Intel SSDs, by retrying device detection.
<li><a href="https://man.openbsd.org/pfctl.8">pfctl(8)</a> now disallows translation rules containing addresses of { <a href="https://man.openbsd.org/inet.4">inet(4)</a> <a href="https://man.openbsd.org/inet6.4">inet6(4)</a> } when the rule doesn't specify one.
<li>When the <a href="https://man.openbsd.org/nsd.8">nsd(8)</a> daemon is launched via <a href="https://man.openbsd.org/rc.d.8">rc.d(8)</a>, use a correct exit code (per <a href="https://man.openbsd.org/rc.subr.8">rc.subr(8)</a>).
<!-- 2014/06/24 -->
<li>Improved messages with <a href="https://man.openbsd.org/roff.7">roff(7)</a> ".so": show the filename argument that was passed; on failure, report the file/line number.
<li>If an <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> chacha operation does not consume all of the generated key stream, save it for subsequent writes.
<li>Made TCP_NODELAY work in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<!-- 2014/06/23 -->
<li>Removed the noaccesstime synonym for noatime in <a href="https://man.openbsd.org/mount.8">mount(8)</a>.
<li>When <a href="https://man.openbsd.org/scp.1">scp(1)</a> is copying local to remote and it fails during read, don't send uninitialised heap to the remote end.
<li>Don't fatal() <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> when hostname canonicalisation fails with a ProxyCommand in use.
<li>New <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> key API: refactored key-related functions to be more library-like (existing API now a set of wrappers).
<li>Fixed bug in <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> KRL generation: multiple consecutive revoked certificate serial number ranges could be serialised to an invalid format.
<li>Made <a href="https://man.openbsd.org/gcc.1">gcc(1)</a> version 4 emit warning when it is ignoring alignment constraints.
<li>Fixed possible crash on encountering invalid msdosfs filesystems.
<li>Disabled IPv6 on interfaces by default (a link-local address is no longer assigned by default).
<li>Use <a href="https://man.openbsd.org/bus_space.9">bus_space(9)</a> on <a href="https://man.openbsd.org/acpi.4">acpi(4)</a> SystemMemory, to correctly access memory mapped registers.
<li>Made "<a href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a> <if> inet6 eui64" reset the NOINET6 flag (unconditionally), to ensure link-local address is assigned.
<li>Allow <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> keys and send-keys to send to invisible panes.
<li>Fixed <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> so it counts mouse clicks correctly.
<!-- 2014/06/22 -->
<li>Stopped building procfs on i386.
<li>In <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> BIO_get_port(), only accept valid port numbers.
<!-- 2014/06/21 -->
<li>Made sure <a href="https://man.openbsd.org/uvm.9">uvm(9)</a> kmthread never loops without making progress.
<li><a href="https://man.openbsd.org/kill.2">kill(2)</a> an untraced process (instead of looping) if the kernel generates a deadly trap signal and it is ignored.
<li>Specify the correct strength bits for 3DES cipher suites in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<!-- 2014/06/20 -->
<li>Protect <a href="https://man.openbsd.org/explicit_bzero.3">explicit_bzero(3)</a> from a link-time optimisation.
<li>In <a href="https://man.openbsd.org/ssl.3">ssl(3)</a>, wrap <a href="https://man.openbsd.org/getenv.3">getenv(3)</a> OPENSSL_ALLOW_PROXY_CERTS in an <a href="https://man.openbsd.org/issetugid.2">issetugid(2)</a> check. Stops <a href="https://man.openbsd.org/setuid.2">setuid(2)</a> applications from being fooled.
<li>Prefix error messages from <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a> with "mandoc: ", so users know where messages came from.
<li>Made "S" and "E" mean the start and end to capture-pane in <a href="https://man.openbsd.org/tmux.1">tmux(1)</a>.
<li>Fixed incorrect bounds check in amd64 assembly version of <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> bn_mul_mont().
<!-- 2014/06/19 -->
<li>Made <a href="https://man.openbsd.org/tcpdump.8">tcpdump(8)</a> -v display any bad checksums contained in the header and what the checksum should be.
<li>More tweaking of <a href="https://man.openbsd.org/makewhatis.8">makewhatis(8)</a> set_basedir(): do not error out when <a href="https://man.openbsd.org/getcwd.3">getcwd(3)</a> fails; fixed the man-root-dir indicator in say().
<li>In <a href="https://man.openbsd.org/arc4random.3">arc4random(3)</a>, hard fail with SIGKILL if <a href="https://man.openbsd.org/getentropy.2">getentropy(2)</a> returns -1.
<li>Converted CRYPTO_memcmp to timingsafe_memcmp in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<li>Improved error checking in <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> by_dir.c: set error code on error; check <a href="https://man.openbsd.org/malloc.3">malloc(3)</a> return; added missing unlock.
<li>Fixed memory leak in <a href="https://man.openbsd.org/md5.1">md5(1)</a> digest_file() on <a href="https://man.openbsd.org/ferror.3">ferror(3)</a>.
<li>Implemented the <a href="https://man.openbsd.org/membar.9">membar(9)</a> API for powerpc.
<li>Copy newline when at EOL when <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> is in <a href="https://man.openbsd.org/vi.1">vi(1)</a> mode.
<li>Made <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> reset the mouse buttons when the mouse wheel is used.
<li>Some terminals send spurious releases for mouse wheel in SGR mouse mode, <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> now suppresses these.
<li>Fixed black screen on lenovo ideapad yoga 2 pro using when using <a href="https://man.openbsd.org/intel.4">intel(4)</a>.
<!-- 2014/06/18 -->
<li>Restored previous <a href="https://man.openbsd.org/arc4random.3">arc4random(3)</a> behaviour, where <a href="https://man.openbsd.org/fork.2">fork(2)</a> children would mix in some randomness from the parent process.
<li>Stopped <a href="https://man.openbsd.org/OpenBSD-current/man8/makewhatis.8">makewhatis(8)</a> displaying "unable to open mandoc.db" error messages when updating/deleting individual files.
<li>Ensured <a href="https://man.openbsd.org/fsck_msdos.8">fsck_msdos(8)</a> will always keep length of cluster chain up to date. Avoids out of boundary accesses.
<li>Fixed off by one in msdosfs pm_inusemap().
<li>Fixed the use of 16384-bit RSA keys by <a href="https://man.openbsd.org/ssh.1">ssh(1)</a>.
<!-- 2014/06/17 -->
<li>Changed SSL_COMP_add_compression_method() in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>, so error cases actually return "error" rather than "success".
<li>Disallow __sysctl() in the <a href="https://man.openbsd.org/sshd.8">sshd(8)</a> <a href="https://man.openbsd.org/systrace.1">systrace(1)</a> sandbox (as there is now a dedicated <a href="https://man.openbsd.org/getentropy.2">getentropy(2)</a> system call for <a href="https://man.openbsd.org/arc4random.3">arc4random(3)</a>).
<li>Implemented the <a href="https://man.openbsd.org/membar.9">membar(9)</a> API for hppa.
<li>Added configuration bit in <a href="https://man.openbsd.org/vio.4">vio(4)</a> flags, to workaround qemu < 2.0 bug that prevented VLANs from working.
<li>Be more aggressive flushing L2 cache entries on mips64 RM7000 systems.
<!-- 2014/06/16 -->
<li>Set uart based on the io clock rate on octeon II (CN6xxx), as the rate differs from the cpu clock.
<li>Use MAP_INHERIT_ZERO in <a href="https://man.openbsd.org/arc4random.3">arc4random(3)</a>, to zero out the RNG state if the process forks.
<li>Enabled <a href="https://man.openbsd.org/pci.4">pci(4)</a> power management on lemote.
<li>Reverted "Always create a local route for every configured IPv4 address" (caused regressions).
<li>Allow the autoinstaller to fetch sets from multiple locations.
<!-- 2014/06/15 -->
<li>Fixed vnode leak in <a href="https://man.openbsd.org/systrace.4">systrace(4)</a>.
<li>In <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> aes_gcm_cleanup(), clean the entire context (no longer leaving AES key untouched).
<li>Fixed hang with virtio event_idx feature, to cure occasional network freeze in <a href="https://man.openbsd.org/vio.4">vio(4)</a>.
<li>Updated to xcb-util-renderutil 0.3.9.
<!-- 2014/06/14 -->
<li>Avoid infinite loop in <a href="https://man.openbsd.org/fsck_msdos.8">fsck_msdos(8)</a> if cluster chain is a cyclic list.
<li>Fixed memory leaks in <a href="https://man.openbsd.org/fsck_msdos.8">fsck_msdos(8)</a> bootblock handling.
<li>Fixed <a href="https://man.openbsd.org/fsck_msdos.8">fsck_msdos(8)</a> regression in r1.16 of boot.c: write fsinfo, not block into FSInfo region.
<li>Fixed <a href="https://man.openbsd.org/fsck_msdos.8">fsck_msdos(8)</a> regression in r1.20 of fat.c by properly incrementing a pointer.
<li>Added more bounded attributes to the buffer and md5/sha headers in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<!-- 2014/06/13 -->
<li>Removed <a href="https://man.openbsd.org/wait.2">wait(2)</a> support for "union wait" (deprecated since 4.3BSD) and WSTOPPED (means something else now in POSIX).
<li>Stopped <a href="https://man.openbsd.org/vax/ze.4">ze(4/vax)</a> rx ring pointer stalling when running "all multicast" or <a href="https://man.openbsd.org/bpf.4">bpf(4)</a> in promiscuous mode.
<li>Switched <a href="https://man.openbsd.org/dump.8">dump(8)</a> "blockswritten" to int64_t, so it won't wrap at 2TB.
<li>Correctly calculate the key block length in t1_enc.c and s3_enc.c when using <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> "export" ciphers.
<li>Added ChaCha20-Poly1305 based ciphersuites to <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<li><a href="https://man.openbsd.org/ssl.8">ssl(8)</a> can now change cipher state with an EVP_AEAD, encrypt/decrypt TLS using the EVP_AEAD.
<li>Added <a href="https://man.openbsd.org/getentropy.2">getentropy(2)</a> system call.
<li>Indicate in the <a href="https://man.openbsd.org/sysctl.1">sysctl(1)</a> LIVELOCKS column if there is a pending (deferred) <a href="https://man.openbsd.org/mbuf.9">mbuf(9)</a> update.
<li>Fixed tcp-mss-adjust in <a href="https://man.openbsd.org/pipex.4">pipex(4)</a> and <a href="https://man.openbsd.org/npppd.8">npppd(8)</a>.
<!-- 2014/06/12 -->
<li>Removed support for the "opaque PRF input" extension from <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> (draft expired 7 years ago and never became an RFC).
<li>Added timingsafe_memcmp() to <a href="https://man.openbsd.org/memcmp.3">memcmp(3)</a>.
<li>Added MAP_INHERIT_ZERO support to <a href="https://man.openbsd.org/minherit.2">minherit(2)</a>. Provides child process with fresh, zero-initialised anonymous memory.
<li>Fixed <a href="https://man.openbsd.org/ptrace.2">ptrace(2)</a> hanging hppa and mips64 MP systems, by grab the kernel lock before cleaning up single-step breakpoints.
<li>Updated to <a href="https://man.openbsd.org/nginx.8">nginx(8)</a> version 1.6.0 (including syslog support backported from the 1.7 branch).
<li>Disable the "switch to insertion sort" optimisation in <a href="https://man.openbsd.org/qsort.3">qsort(3)</a>. Avoids quadratic behaviour for certain inputs.
<li>Changed <a href="https://man.openbsd.org/pkg_add.1">pkg_add(1)</a> to display the full url (if possible) for unsigned packages.
<!-- 2014/06/11 -->
<li>Fixed memory leak in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> d1_lib.c.
<li>Restored the original behaviour of RTM_ADD and RTM_DELETE by always generating one message per locally configured <a href="https://man.openbsd.org/ip.4">ip(4)</a> address.
<li>Always create a local <a href="https://man.openbsd.org/route.4">route(4)</a> for every configured IPv4 address on the machine.
<li>Flag any local <a href="https://man.openbsd.org/route.4">route(4)</a> as such and make them use the highest possible priority.
<li>Created (currently unused) system taskq ("systqmp") which runs without the kernel lock (see <a href="https://man.openbsd.org/task_add.9">task_add(9)</a>).
<!-- 2014/06/10 -->
<li>Raised the low water mark in <a href="https://man.openbsd.org/em.4">em(4)</a> so the internal buffers can hold at least two jumbo frames.
<li>On i386/amd64 hibernate, don't map phys pages < 64KB in the resume page table. Matches recent kernel change.
<li>Fixed off by one in <a href="https://man.openbsd.org/fsck_msdos.8">fsck_msdos(8)</a> when writing the FAT for FAT12 filesystems.
<li>In <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>, check return value of EVP_MD_CTX_copy_ex(). Avoids potential null pointer dereference.
<li>In <a href="https://man.openbsd.org/mtree.8">mtree(8)</a>, added ed25519 ssh host keys to /etc/mtree/special.
<li>Lowered <a href="https://man.openbsd.org/nc.1">nc(1)</a> buffers back to 16k for now, to avoid bufferbloat.
<li>Increased <a href="https://man.openbsd.org/nc.1">nc(1)</a> buffer size to 64k, and actually use the buffer.
<li>Abandoned the <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> "auto-ENGINE" /dev/crypto interface.
<li>In <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> tls1_cert_verify_mac(), avoid a possible NULL function call on ctx.final().
<li>Implemented <a href="https://man.openbsd.org/slowcgi.8">slowcgi(8)</a> -u (user to drop privs to) and -p (path to <a href="https://man.openbsd.org/chroot.8">chroot(8)</a> to). Allows <a href="https://man.openbsd.org/slowcgi.8">slowcgi(8)</a> to run non-chrooted.
<li>Cleaned up <a href="https://man.openbsd.org/slowcgi.8">slowcgi(8)</a> socket creation.
<li>Multiple fixes for <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> ssl3_digest_cached_records().
<li>Ensured <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> ssl3_final_finish_mac() returns failure if either the MD5 or SHA1 handshake MAC calculation fails.
<!-- 2014/06/09 -->
<li>Changed <a href="https://man.openbsd.org/installboot.8">installboot(8)</a> file copying process, to make it less likely that the PBR will change upon update.
<li>Fixed possible out of boundary access by <a href="https://man.openbsd.org/fsck_msdos.8">fsck_msdos(8)</a> if the filesystem is full or corrupt.
<!-- 2014/06/08 -->
<li>Updated to xf86-video-modesetting 0.8.1 and xf86-video-geode 2.11.15.
<!-- 2014/06/07 -->
<li>Further cleanup of context handling in <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> tls1_change_cipher_state().
<li>In <a href="https://man.openbsd.org/run.4">run(4)</a>, fixed TXWI and RXWI offset calculations so RT5592 devices function.
<!-- 2014/06/06 -->
<li>When relying on the local enqueuer, let <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> cope with long To/Cc lines. Avoids broken headers and confusing some MUAs.
<!-- 2014/06/05 -->
<li>Fixed inverted test in <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> so PKCS#11 keys that are explicitly listed are preferred.
<li>Reset properly when <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> c0-change-trigger is increased from zero, so panes don't get stuck.
<li><strong>5.4 and 5.5 and -current SECURITY FIXES in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> for: buffer overflow with crafted DTLS fragments (CVE-2014-0195); DTLS infinite recursion flaw with "Hello Request" (CVE-2014-0221); SSL/TLS MITM vulnerability (CVE-2014-0224); anonymous ECDH denial of service (CVE-2014-3470).</strong><br>A source code patch is available for <a href="errata54.html#012_openssl">5.4</a> and <a href="errata55.html#008_openssl">5.5</a>.
<li>Reduced amount of <a href="https://man.openbsd.org/traceroute.8">traceroute(8)</a> code running as root; only error out if the creation of a needed socket failed.
<li>Moved <a href="https://man.openbsd.org/ld.so.1">ld.so(1)</a> to a (slightly stripped) version of libc <a href="https://man.openbsd.org/malloc.3">malloc(3)</a>.
<li><strong>5.4 and 5.5 and -current SECURITY FIX: improper close-on-exec flag handling by <a href="https://man.openbsd.org/sendmail.8">sendmail(8)</a> (CVE-2014-3956).</strong><br>A source code patch is available for <a href="errata54.html#011_sendmail">5.4</a> and <a href="errata55.html#007_sendmail">5.5</a>.
<li>Added support for COLUMNS env variable to <a href="https://man.openbsd.org/ps.1">ps(1)</a>.
<li>Included work-around in <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a>, as <a href="https://man.openbsd.org/makewhatis.8">makewhatis(8)</a> expects its current dir to not be /.
<!-- 2014/06/04 -->
<li><a href="https://man.openbsd.org/vflush.9">vflush(9)</a> now works for <a href="https://man.openbsd.org/fuse.4">fuse(4)</a>.
<li>Do not skip or add a byte for the report ID when <a href="https://man.openbsd.org/usbhid.3">usbhid(3)</a> is manipulating data.
<li>Made <a href="https://man.openbsd.org/uaudio.4">uaudio(4)</a> properly compare endpoint addresses by ignoring the direction bit.
<!-- 2014/06/03 -->
<li>Accept -C as an alias for -c in <a href="https://man.openbsd.org/tr.1">tr(1)</a>.
<li>Made <a href="https://man.openbsd.org/zyd.4">zyd(4)</a> compile with ZYD_DEBUG.
<li>Fix <a href="https://man.openbsd.org/zyd.4">zyd(4)</a> frame length adjustment in the RX path.
<!-- 2014/06/02 -->
<li>In libm math code, made sure STRICT_ASSIGN handles double as well.
<li>Stripped <a href="https://man.openbsd.org/openssl.1">openssl(1)</a> functions called when "-rand" is specified (underlying code long gone).
<li>Removed easy access to the unsafe intel RDRAND instruction from <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<li>When checking for unicast and broadcast addresses, do one lookup instead of two.
<li>Fixed uninitialised variable, which caused <a href="https://man.openbsd.org/sndiod.8">sndiod(8)</a> crashes when handling errors.
<!-- 2014/06/01 -->
<li>In <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> tls1_setup_key_block(), use the correct IV length for GCM mode. Fixes key block length calculation.
<!-- 2014/05/31 -->
<li>Removed real mode <a href="https://man.openbsd.org/vga.4">vga(4)</a> repost option.
<li>Change the actual default for returned asn1 strings to utf8 in the <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> code.
<li>Reverted previous diff setting cold to 1 on shutdown (broken with <a href="https://man.openbsd.org/softraid.4">softraid(4)</a> disks).
<!-- 2014/05/30 -->
<li>Added <a href="https://man.openbsd.org/dump.8">dump(8)</a> -S option, to only estimate backup size and number of tapes required.
<li>Avoid panics on macppc with an <a href="https://man.openbsd.org/uhci.4">uhci(4)</a> cardbus when halting/rebooting.
<li>Fixed segfault seen on <a href="https://man.openbsd.org/Xorg.1">Xorg(1)</a> startup when using the <a href="https://man.openbsd.org/nv.4">nv(4)</a> or <a href="https://man.openbsd.org/savage.4">savage(4)</a> drivers.
<!-- 2014/05/29 -->
<li>Converted many <a href="https://man.openbsd.org/malloc.3">malloc(3)</a> to <a href="https://man.openbsd.org/reallocarray.3">reallocarray(3)</a>. Avoids 53 potential integer overflows in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<li>In <a href="https://man.openbsd.org/envy.4">envy(4)</a>, use the same convention for mixer control names as in <a href="https://man.openbsd.org/azalia.4">azalia(4)</a>.
<li>Added an enc_flags field to ssl3_enc_method. Helps identify <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> protocol version requirements.
<li>Made <a href="https://man.openbsd.org/fsck.8">fsck(8)</a> use the same values in checking as <a href="https://man.openbsd.org/newfs.8">newfs(8)</a> does in creating a <a href="https://man.openbsd.org/fs.5">fs(5)</a>.
<li>Fixed two more cases where ssl_replace_hash() return value was not checked by <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<!-- 2014/05/28 -->
<li>To give <a href="https://man.openbsd.org/perl.1">perl(1)</a> a random seed, call <a href="https://man.openbsd.org/arc4random.3">arc4random(3)</a> rather than read /dev/arandom. Makes it work in <a href="https://man.openbsd.org/chroot.8">chroot(8)</a> environments.
<li>Enabled writing per-commit commitid tokens to <a href="https://man.openbsd.org/rcs.1">rcs(1)</a> ",v" files.
<li>When <a href="https://man.openbsd.org/less.1">less(1)</a> is invoked as <a href="https://man.openbsd.org/more.1">more(1)</a>, made behaviour for "-i" match "less -I" (per POSIX).
<li>When suspending/resuming, avoid hangs by detaching/attaching <a href="https://man.openbsd.org/usb.4">usb(4)</a> devices (avoids <a href="https://man.openbsd.org/uhub.4">uhub(4)</a> interrupt races).
<li>On <a href="https://man.openbsd.org/mg.1">mg(1)</a> delete-window, display the correct line number when revisiting the buffer.
<li>Added -L option to <a href="https://man.openbsd.org/pwd.1">pwd(1)</a> (required by POSIX).
<!-- 2014/05/27 -->
<li>Fixed <a href="https://man.openbsd.org/mount.8">mount(8)</a> -ur for msdosfs: allow sync after more than one rw -> ro cycle; sync data (not only metadata).
<li>Fixed instance of the Y2038 problem in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<li>Refactored radix code. Solves issues with failed deletes of down routes.
<li>Enable strong stack protector by default for architectures running <a href="https://man.openbsd.org/gcc.1">gcc(1)</a> version 3.
<li>Allow <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> to handle the top bit of <a href="https://man.openbsd.org/xterm.1">xterm(1)</a>-style modifier keys.
<li>Added some formats for <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> pane bounds.
<li>Prevented userland from altering the local and broadcast flags in <a href="https://man.openbsd.org/route.4">route(4)</a>.
<li>Reserved the highest <a href="https://man.openbsd.org/route.4">route(4)</a> priority for kernel-managed routes.
<!-- 2014/05/26 -->
<li>Fixed memory leak and un-cleaned EVP_CIPHER_CTX upon error in <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> tls_decrypt_ticket().
<li>Removed /usr/src from <a href="https://man.openbsd.org/mtree.8">mtree(8)</a> to avoid useless warning from daily <a href="https://man.openbsd.org/security.8">security(8)</a> mail.
<li>Implemented improved <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> EVP AEAD API.
<li>Made sure <a href="https://man.openbsd.org/utpms.4">utpms(4)</a> only matches mouse interface, so <a href="https://man.openbsd.org/ukbd.4">ukbd(4)</a> works on more Powerbooks.
<!-- 2014/05/25 -->
<li>Fixed <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> resource descriptor leaks (CID: 966576 & 966577).
<li>Allow <a href="https://man.openbsd.org/tty.4">tty(4)</a> to handle threaded processes correctly with kerninfo status requests (a.k.a. ^T).
<li>Fixed <a href="https://man.openbsd.org/azalia.4">azalia(4)</a> format mistakes when AZALIA_DEBUG is defined.
<li>Pass DVACT_QUIESCE to <a href="https://man.openbsd.org/usb.4">usb(4)</a> to stop "new" <a href="https://man.openbsd.org/uhub.4">uhub(4)</a> device reattaching at every resume.
<!-- 2014/05/24 -->
<li>Fixed off-by-one in index validation before accessing arrays in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> ssl_cipher_get_evp().
<li>In <a href="https://man.openbsd.org/ssl.3">ssl(3)</a>, enabled three brainpool elliptic curves for TLS (per RFC 7027).
<li>Made <a href="https://man.openbsd.org/fsck_ext2fs.8">fsck_ext2fs(8)</a> and <a href="https://man.openbsd.org/fsck_ffs.8">fsck_ffs(8)</a> output verbiage more consistent.
<li>Added support for newer <a href="https://man.openbsd.org/run.4">run(4)</a> hardware.
<!-- 2014/05/23 -->
<li>Made <a href="https://man.openbsd.org/fsck_ext2fs.8">fsck_ext2fs(8)</a> initialise newent.e2d_type to EXT2_FT_UNKNOWN (a.k.a. 0).
<li>Reverted <a href="https://man.openbsd.org/pax.1">pax(1)</a> ar_io.c r1.45 to stop showing archives written with a non-standard blocksize as truncated reads.
<li>Stopped <a href="https://man.openbsd.org/tcpdump.8">tcpdump(8)</a> "weird flag" warning for DNS NOTIFY messages which should have "AA" set.
<li>Permit <a href="https://man.openbsd.org/less.1">less(1)</a> searches to work past/across NUL bytes.
<li>Made the <a href="https://man.openbsd.org/pax.1">pax(1)</a> signal handler safe.
<li>Expose bif_capacity in <a href="https://man.openbsd.org/acpibat.4">acpibat(4)</a>, to report the design capacity of the battery.
<li>Clean up after the <a href="https://man.openbsd.org/snmpd.8">snmpd(8)</a> traphandler children, to avoid leaving zombie processes.
<!-- 2014/05/22 -->
<li>Marked <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> <a href="https://man.openbsd.org/malloc.3">malloc(3)</a> wrapper functions as deprecated.
<li>Fixed <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> crash when running the pki lookup code.
<li>On sgi, converted the PS/2 keyboard layouts to sgi serial keyboard layouts.
<li>Let sgi <a href="https://man.openbsd.org/keyboard.7">keyboard(7)</a> work in polling mode; fixed "international" ("GERlessthan") key.
<!-- 2014/05/21 -->
<li>Made <a href="https://man.openbsd.org/qle.4">qle(4)</a> less likely to get stuck looping when the firmware behaves inconsistently.
<li>Fixed file size reported by <a href="https://man.openbsd.org/lpq.1">lpq(1)</a> -l by giving <a href="https://man.openbsd.org/stat.2">stat(2)</a> privileges on the spool file.
<li>Fixed <a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a> -u on sparc64.
<li>Fixed <a href="https://man.openbsd.org/ipsec.4">ipsec(4)</a> route addition, broken since the removal of the link-layer addresses from the per-ifp list.
<li>Made <a href="https://man.openbsd.org/xhci.4">xhci(4)</a> handle the stall condition like the bable condition.
<!-- 2014/05/20 -->
<li><a href="https://man.openbsd.org/pax.1">pax(1)</a> now exits with non-zero status if a read is truncated.
<li>Added support for -o XXX or -oXXX options, and -o max_read=XXX to <a href="https://man.openbsd.org/fuse.4">fuse(4)</a>.
<li>When sending <a href="https://man.openbsd.org/icmp.4">icmp(4)</a> messages, assign the queue ID to the correct packet header.
<li>Fixed eui64 address generation, broken upon removal of the link-layer address from the per-ifp list.
<!-- 2014/05/19 -->
<li>No more (obsolete) 5- and 6-byte or surrogate pair code point encodings in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> UTF8_{getc,putc}.
<li>Upon HTTPS <a href="https://man.openbsd.org/ftp.1">ftp(1)</a> redirects, don't reinitialise <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>, and reuse SSL_CTX.
<li>Plugged memory leak in <a href="https://man.openbsd.org/rcs.1">rcs(1)</a>.
<li>More consistency in <a href="https://man.openbsd.org/fuse.4">fuse(4)</a> error handling.
<li>Made <a href="https://man.openbsd.org/fuse.4">fuse(4)</a> use realpath for more reliable <a href="https://man.openbsd.org/mount.8">mount(8)</a> operations.
<li>On armv7, loongson and socppc use <a href="https://man.openbsd.org/autoconf.9">autoconf(9)</a> to track <a href="https://man.openbsd.org/usb.4">usb(4)</a> host controller's children.
<li>Stopped <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a> trying to update file when none has been specified by -L flag.
<li>Added H_SAVE_FP operation to <a href="https://man.openbsd.org/editline.3">editline(3)</a>, to save history to an open file pointer.
<li>Fixed <a href="https://man.openbsd.org/uhci.4">uhci(4)</a>. Unbreaks the build when DIAGNOSTIC is not defined.
<!-- 2014/05/18 -->
<li>Updated <a href="https://man.openbsd.org/run.4">run(4)</a> firmware to version 0.33.
<li>Made <a href="https://man.openbsd.org/mkuboot.8">mkuboot(8)</a> correctly handle files smaller than an <a href="https://man.openbsd.org/elf.5">elf(5)</a> header.
<li>In <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> ssl3_send_certificate_request(), properly adjust for payload size.
<li>Upon error, made sure <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> ssl3_setup_buffers() frees pqueue before returning.
<li>Fixed tail packet check in <a href="https://man.openbsd.org/pms.4">pms(4)</a> elantech v3 touchpad code.
<li>Stopped <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a> adding a lease to the leases TAILQ more than once. Avoids infinite loop.
<li>Updated to libXfont 1.4.8.
<li>Check <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> bio_err initialisation succeeds before using it.
<li>Updated to fontconfig 2.11.1.
<!-- 2014/05/17 -->
<li>Updated to xf86-input-synaptics 1.8.0.
<li>Fixed kernel build when <a href="https://man.openbsd.org/ehci.4">ehci(4)</a> uses EHCI_DEBUG.
<li>Switched <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> RSA key generation default to 2048 bits (matching <a href="https://man.openbsd.org/ssh.1">ssh(1)</a>).
<li>Made <a href="https://man.openbsd.org/qla.4">qla(4)</a> less likely to get stuck looping when the firmware behaves inconsistently.
<li>Change interrupt handler's return value to 0 when nothing is processed on <a href="https://man.openbsd.org/luna88k/pcexmem.4">pcexmem(4/luna88k)</a>.
<li>When <a href="https://man.openbsd.org/pfctl.8">pfctl(8)</a> is parsing a numerical value for the TOS bits, ensure it is in a valid range.
<!-- 2014/05/16 -->
<li>Fixed <a href="https://man.openbsd.org/mountd.8">mountd(8)</a>: when a host in a netgroup is unresolvable, don't ignore entire netgroup.
<li>Sped up <a href="https://man.openbsd.org/signify.1">signify(1)</a> -C.
<li>Made <a href="https://man.openbsd.org/df.1">df(1)</a> do calculations of available space the same way as ffs_statfs() does.
<li>Improved logging messages and style for <a href="https://man.openbsd.org/snmpd.8">snmpd(8)</a>.
<li>Don't put a link-layer address on the per-ifp lists or RB-Tree. Improves address lookups.
<!-- 2014/05/15 -->
<li>Fixed memory leaks in <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> asn1 upon failure.
<li>Replaced <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> ASN1_GENERALIZEDTIME_adj(), ASN1_UTCTIME_adj() and ASN1_TIME_to_generalizedtime() with wrappers.
<li>Added a ChaCha20-Poly1305 AEAD EVP implementation to <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> libcrypto.
<li>Added an AEAD EVP interface to <a href="https://man.openbsd.org/ssl.3">ssl(3)</a> libcrypto, along with AES-GCM AEAD implementations.
<li>Made <a href="https://man.openbsd.org/signify.1">signify(1)</a> -C mode work again.
<!-- 2014/05/14 -->
<li><a href="https://man.openbsd.org/rtadvd.8">rtadvd(8)</a> now ignores route info messages on the listening side.
<li>Stopped flushing streams on <a href="https://man.openbsd.org/abort.3">abort(3)</a>, which was unsafe.
<li>Removed arch-specific <a href="https://man.openbsd.org/lo.4">lo(4)</a> MTU and set to 32768 everywhere.
<li>Made <a href="https://man.openbsd.org/signify.1">signify(1)</a> recode base64 hashes if necessary; spell out base64 in error messages.
<li>Better use of <a href="https://man.openbsd.org/realloc.3">realloc(3)</a>, to speed up <a href="https://man.openbsd.org/signify.1">signify(1)</a> checksum verification.
<li>Added poly1305 to <a href="https://man.openbsd.org/ssl.3">ssl(3)</a>, utilising Andrew Moon's public domain implementation.
<!-- 2014/05/13 -->
<li><a href="https://man.openbsd.org/tmux.1">tmux(1)</a> no longer allows multiple buffers with the same name.
<li><strong>5.4, 5.5 and -current SECURITY FIX: integer, memory and buffer overflows in libXfont (CVE-2014-0209; CVE-2014-0210 and CVE-2014-0211)</strong>.
<li>Fixed regression in r1.285 of sys/net/if.c (TAILQ corruption where rdomain was not switched).
<li>In <a href="https://man.openbsd.org/iked.8">iked(8)</a>, pass SA initiator (not the exchange initiator) to sa_address().
<li>The resolver now skips incomplete entries in /etc/hosts and /etc/networks (rather than crash).
<li>Pass multi-argument <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> commands directly to <a href="https://man.openbsd.org/execvp.3">execvp(3)</a>. Helps avoid quoting problems.
<li>Added a copy mode key binding to copy to a named <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> buffer.
<li>Added <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> support for named buffers.
<!-- 2014/05/12 -->
<li>Fixed multiple bugs in <a href="https://man.openbsd.org/ncheck_ffs.8">ncheck_ffs(8)</a> handling of indirect blocks.
<li>Updated <a href="https://man.openbsd.org/drm.4">drm(4)</a> to libdrm 2.4.54.
<li>Fixed <a href="https://man.openbsd.org/ntpd.8">ntpd(8)</a> format strings involving time_t arguments. Fixes <a href="https://man.openbsd.org/ntpd.8">ntpd(8)</a> -d on sparc.
<li>Moved GTT management for Sandy Bridge into <a href="https://man.openbsd.org/inteldrm.4">inteldrm(4)</a>.
<li>Removed AES_bi_ige_encrypt() from <a href="https://man.openbsd.org/ssl.3">ssl(3)</a>.
<li>Removed md5crypt from <a href="https://man.openbsd.org/crypt.3">crypt(3)</a>.
<li>Moved the ohash functions into libutil.
<li>Stopped <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a> exiting when sent RTM_NEWADDR or RTM_DELADDR routing messages lacking appropriate address info.
<li>Altered <a href="https://man.openbsd.org/usbhidctl.1">usbhidctl(1)</a> and <a href="https://man.openbsd.org/usbhidaction.1">usbhidaction(1)</a> parsers to keep in sync with the kernel HID parser.
<li>Fixed possible <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> double free when tls is required but not advertised by the server.
<li>Updated the HID parser to properly parse modern input device descriptors.
<li>Added router alert option (RAO) in IGMP packets (per RFC2236), needed by some L3 switches.
<li>More intelligent parsing of WEP keys by <a href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a>.
<!-- 2014/05/11 -->
<li>Make sure <a href="https://man.openbsd.org/uhub.4">uhub(4)</a> root hub is re-attached before interrupts get enabled. Unbreaks resume.
<li>Stop ignoring "lease" statements in <a href="https://man.openbsd.org/dhclient.conf.5">dhclient.conf(5)</a>.
<li>Reworked/restored <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a> recorded lease handling.
<li>Fixed the installer's configuration of a static IPv6 default gateway.
<!-- 2014/05/10 -->
<li>Various format string fixes on mips64 and octeon.
<li>Fixed recently-occurring <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> breakage in <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a>.
<li>On i386/amd64, disable speedstep instead of panicking if high and low speeds are the same.
<li>Allow <a href="https://man.openbsd.org/nginx.8">nginx(8)</a> to <a href="https://man.openbsd.org/chroot.8">chroot(8)</a> to a directory other than /var/www.
<li>Many string format fixes on sparc64.
<li>Losing TCP connection no longer results in an unrecoverable stop in <a href="https://man.openbsd.org/iscsid.8">iscsid(8)</a>.
<!-- 2014/05/09 -->
<li>Stopped <a href="https://man.openbsd.org/cribbage.6">cribbage(6)</a> ignoring words which followed two or more blank characters.
<li>Print interface name with queues in <a href="https://man.openbsd.org/systat.1">systat(1)</a> q.
<li>Updated to: <a href="https://man.openbsd.org/xterm.1">xterm(1)</a> version 304; libXi 1.7.2 and xf86-input-synaptics 1.7.5.
<li>Fixed <a href="https://man.openbsd.org/fsck_ffs.8">fsck_ffs(8)</a> -b to work with the superblock locations on 4096-byte sector disks.
<li>Use the highest possible priority for any <a href="https://man.openbsd.org/route.4">route(4)</a> to local addresses.
<!-- 2014/05/08 -->
<li>Stopped <a href="https://man.openbsd.org/cribbage.6">cribbage(6)</a> choking on one-letter card names which followed three-letter card names.
<li>Fixed potential <a href="https://man.openbsd.org/uvm.9">uvm(9)</a> integer overflows.
<li>Made <a href="https://man.openbsd.org/relayd.8">relayd(8)</a> fail when encountering unsupported combinations.
<li>Only attach <a href="https://man.openbsd.org/luna88k/pcexmem.4">pcexmem(4/luna88k)</a> and <a href="https://man.openbsd.org/luna88k/pcexio.4">pcexio(4/luna88k)</a> on luna88k2 (not luna88k).
<li>Brought back restricted sockets to <a href="https://man.openbsd.org/snmpd.8">snmpd(8)</a>, inadvertently removed in recent update.
<!-- 2014/05/07 -->
<li>Made <a href="https://man.openbsd.org/zmore.1">zmore(1)</a> call <a href="https://man.openbsd.org/more.1">more(1)</a> and <a href="https://man.openbsd.org/zless.1">zless(1)</a> call <a href="https://man.openbsd.org/less.1">less(1)</a>.
<li>Repaired the termination condition of a <a href="https://man.openbsd.org/write.2">write(2)</a> loop in <a href="https://man.openbsd.org/vipw.8">vipw(8)</a>.
<li>In <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> ec_asn1.c, don't free memory unless we allocated it (RT#3338).
<li>Improved code to clear all bignums from bn_lib.c in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<li>In <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> BN_clear_free(), don't cleanse the data if the static data flag is set.
<li>Render <a href="https://man.openbsd.org/roff.7">roff(7)</a> escape sequences in man page descriptions prior to insertion into <a href="https://man.openbsd.org/mandoc.db.5">mandoc.db(5)</a>.
<li>Fixed two memory leaks in <a href="https://man.openbsd.org/makewhatis.8">makewhatis(8)</a> -n.
<li>Fixed segfault in <a href="https://man.openbsd.org/makewhatis.8">makewhatis(8)</a> -Q if the next .SH after .SH NAME does not have any arguments.
<li>Backed out the previous ICMP simplifying diff from <a href="https://man.openbsd.org/dhcpd.8">dhcpd(8)</a>, which caused livelocks.
<li>Try postponed requests first, so <a href="https://man.openbsd.org/iked.8">iked(8)</a> does in-order processing.
<li>Made <a href="https://man.openbsd.org/iked.8">iked(8)</a> authentication work with X.509 certificates not containing a subject-altname.
<li>Removed the undocumented and ineffective <a href="https://man.openbsd.org/ln.1">ln(1)</a> -F option.
<li>Removed <a href="https://man.openbsd.org/sysctl.8">sysctl(8)</a> {nd6_,}useloopback options.
<!-- 2014/05/06 -->
<li>Fixed recently broken ext2fs atime and mtime.
<li>Introduced <a href="https://man.openbsd.org/gcc.1">gcc(1)</a> -fstack-shuffle, which randomises local stack variables.
<li>Make sure <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> PKCS7_get_octet_string() return values are checked for NULL (PR#3339).
<li>Enabled <a href="https://man.openbsd.org/octeon/brswphy.4">brswphy(4/octeon)</a>.
<li>Allow <a href="https://man.openbsd.org/iked.8">iked(8)</a> to initiate a create-child-SA and process requests for the peer simultaneously.
<li>Explicitly zero ibufs before releasing memory. Ensures <a href="https://man.openbsd.org/iked.8">iked(8)</a> crypto parameters are cleaned.
<li>Fixed memory leaks in the <a href="https://man.openbsd.org/relayd.8">relayd(8)</a> and <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> code.
<li>Re-queue pfkey events while <a href="https://man.openbsd.org/iked.8">iked(8)</a> is busy initiating child-SAs.
<li>In <a href="https://man.openbsd.org/iked.8">iked(8)</a>, initiate ike SA rekeying ("ikesalifetime" keyword).
<li>Fixed <a href="https://man.openbsd.org/iked.8">iked(8)</a> memleak when SA lookup fails while forwarding encrypted <a href="https://man.openbsd.org/ip6.4">ip6(4)</a> packets.
<li>Plugged two <a href="https://man.openbsd.org/ucom.4">ucom(4)</a> xfer leaks and a buffer leak.
<li>Encrypt some <a href="https://man.openbsd.org/iked.8">iked(8)</a> notify payloads.
<li>Initial <a href="https://man.openbsd.org/iked.8">iked(8)</a> support for PFS.
<!-- 2014/05/05 -->
<li>Cleanse old <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> memory when expanding a bignum; clear all bignums when freed.
<li>Updated xkeyboard-config to version 2.11.
<li>Workaround overoptimistic <a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a> alignment expectation on dos_partition fields.
<li>Enhanced reading of saved ascii labels when using <a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a> -R.
<li>Stopped <a href="https://man.openbsd.org/iked.8">iked(8)</a> leaking on pid mismatch.
<li>Validate the attribute length in <a href="https://man.openbsd.org/iked.8">iked(8)</a>.
<li>Removed SRP and Kerberos support from <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<!-- 2014/05/04 -->
<li>On sparc, enabled <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> assembler code for DES.
<li>On vax, enabled the <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> assembler code for BN.
<li>In <a href="https://man.openbsd.org/relayd.8">relayd(8)</a> and <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a>, fixed SSL/TLS and a possible fatalx() on machines without a default RSA engine.
<!-- 2014/05/03 -->
<li>Added <a href="https://man.openbsd.org/sysctl.8">sysctl(8)</a> kern.nosuidcoredump=3, to dump <a href="https://man.openbsd.org/core.5">core(5)</a> into the /var/crash/progname/ directory.
<li>Enabled <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> assembler code for AES, DES, GCM, SHA1, SHA256 and SHA512 on sparc64.
<li>Enabled <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> assembler code for AES, BN, GCM128, SHA1, SHA256 and SHA512 on arm.
<li>Updated to: <a href="https://man.openbsd.org/xauth.1">xauth(1)</a> version 1.0.9; <a href="https://man.openbsd.org/xbacklight.1">xbacklight(1)</a> version 1.2.1; <a href="https://man.openbsd.org/xrandr.1">xrandr(1)</a> version 1.4.2 and <a href="https://man.openbsd.org/xinput.1">xinput(1)</a> version 1.6.1.
<li>Updated to libFS 1.0.6.
<li>Unbroke <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> compression.
<li>Switched to generating <a href="https://man.openbsd.org/bcrypt.3">bcrypt(3)</a> 2b hashes by default.
<li>Added checks for invalid base64 encoded data in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> padding. Fixes a crash (RT#2608).
<li>Provide extended-precision math constants (required by POSIX).
<li>Stopped citrus UTF-8 parser rejecting 0xFFFE and 0xFFFF (they do not render strings invalid).
<!-- 2014/05/02 -->
<li><a href="https://man.openbsd.org/drm.4">drm(4)</a> i915 fixes: workaround inverted brightness for Acer Aspire 5336; fixed gen4 composite s-video tv-out.
<li>Updated <a href="https://man.openbsd.org/Xserver.1">Xserver(1)</a> to version 1.15.1.
<li>On hppa, fixed <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> assembler version of SHA512 to output correct results.
<li>Make <a href="https://man.openbsd.org/acpiprt.4">acpiprt(4)</a> correctly handle interrupts with non-standard polarity.
<li>In <a href="https://man.openbsd.org/acpi.4">acpi(4)</a>, made acpi_mutex_acquire/release actually grab the global lock when called.
<li>Fixed occasional <a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a> crashes when altering mount points.
<!-- 2014/05/01 -->
<li>Reverted __bounded code in <a href="https://man.openbsd.org/ssh.1">ssh(1)</a>.
<li>Oh hppa, use assembly code for AES, BN (Montgomery), SHA1, SHA256 and SHA512 in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<li>Stopped <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> <a href="https://man.openbsd.org/perl.1">perl(1)</a> scripts outputting SOM-specific directives.
<li>Removed unreferenced OPENSSL_instrument_bus and OPENSSL_instrument_bus2 routines from <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<li>Extended <a href="https://man.openbsd.org/fread.3">fread(3)</a> and <a href="https://man.openbsd.org/fwrite.3">fwrite(3)</a> to check for integer overflows.
<li>Moved <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> RSA key handling from "lka" to a new dedicated "ca" process.
<li><strong>5.4 and 5.5 RELIABILITY FIX: Stop attacker's ability to trigger an <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> alert, which could cause a null pointer dereference.</strong><br>A source code patch is available for <a href="errata54.html#009_openssl">5.4</a> and <a href="errata55.html#005_openssl">5.5</a>.
<li>Fixed <a href="https://man.openbsd.org/gcc.1">gcc(1)</a> on i386, to detect overflows and properly align arrays > 16 bytes.
<li>Added ChaCha cypher to <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>, and provided it with an EVP implementation.
<li>Added Brainpool and ANSSI FRP256v1 elliptic curves to <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> (RT#2239).
<li>Corrected <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a> test when passing data to a keynote.
<!-- 2014/04/30 -->
<li>Improved <a href="https://man.openbsd.org/malloc.3">malloc(3)</a>'s ability to pick a free chunk at random.
<li><a href="https://man.openbsd.org/uvm.9">uvm(9)</a> now correctly flush discarded pages even if the number of hash buckets doesn't change.
<li>When <a href="https://man.openbsd.org/openssl.1">openssl(1)</a> isn't available, <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> now uses local fallback implementation of AES for UMAC.
<li>Preserve the intended chronological order of leases in <a href="https://man.openbsd.org/dhclient.leases.5">dhclient.leases(5)</a> files.
<li>Fixed <a href="https://man.openbsd.org/growfs.8">growfs(8)</a> on 4K-sector disks.
<li>First pass at removing win64 support from the assembly-generating <a href="https://man.openbsd.org/perl.1">perl(1)</a> scripts in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<li>Stopped <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> trying to create folders that already exist when using maildir.
<li>Improved imsg handling with many concurrent connections in <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a>.
<!-- 2014/04/29 -->
<li>New buffer API, to eventually make <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> usable as a standalone library.
<li>Improved enforcing of proper alignment of stack variables on sparc.
<li><a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> RSA private key privsep will now only load keys after forking the separated process.
<li>Stopped <a href="https://man.openbsd.org/sftp.1">sftp(1)</a> attempting to append a nul quote character to filenames (bz#2238).
<li>Implemented RSA privilege separation for <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a>. Prevents possible private key leakage.
<li>Made compiling <a href="https://man.openbsd.org/ssh.8">ssh(8)</a> and <a href="https://man.openbsd.org/sshd.8">sshd(8)</a> against <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> optional.
<li>When <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> fails to relay via TLS (and <a href="https://man.openbsd.org/smtpd.conf.5">smtpd.conf(5)</a> doesn't require security), try plain; also downgrade if a TLS error happens during the session.
<li>Constrain bytes read/written to positive values in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> s3_pkt.c code.
<li>Re-added local aesctr implementation to <a href="https://man.openbsd.org/ssh.1">ssh(1)</a>.
<li>Moved <a href="https://man.openbsd.org/traceroute6.8">traceroute6(8)</a> to the attic, fully merged into <a href="https://man.openbsd.org/traceroute.8">traceroute(8)</a>.
<li>Removed large memory leak from <a href="https://man.openbsd.org/usb.4">usb(4)</a>.
<li>Deleted SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS from <a href="https://man.openbsd.org/nginx.8">nginx(8)</a> to keep attack mitigations enabled.
<li>Stopped <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> sending success/failure replies when channels have sent a close already (bz#1818).
<li>Removed <a href="https://man.openbsd.org/less.1">less(1)</a> support for the obsolete (non-POSIX) "more -d" prompt.
<li>Made sure the <a href="https://man.openbsd.org/iked.8">iked(8)</a> state machine only advances if the AUTH payload has been verified.
<li>Use <a href="https://man.openbsd.org/explicit_bzero.3">explicit_bzero(3)</a> instead of <a href="https://man.openbsd.org/memset.3">memset(3)</a> to clear out sensitive <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a> data.
<!-- 2014/04/28 -->
<li>Implemented AI_ADDRCONFIG in <a href="https://man.openbsd.org/getaddrinfo.3">getaddrinfo(3)</a>, as per RFC 3493.
<li>Removed more WIN32, WIN64 and MINGW32 tentacles from <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
<li>Use the correct algorithm mask in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> t1_enc.c.
<li>In <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>, stopped SSL_OP_ALL disabling attack mitigations against CBC modes.
<li>Let <a href="https://man.openbsd.org/nm.1">nm(1)</a> -w correctly return 0 for valid archives.
<li>Stopped <a href="https://man.openbsd.org/ping.8">ping(8)</a> and <a href="https://man.openbsd.org/ping6.8">ping6(8)</a> sleeping after <a href="https://man.openbsd.org/poll.2">poll(2)</a> returns an error.
<li>Added <a href="https://man.openbsd.org/fuse.4">fuse(4)</a> support for 255 character file names.
<li><a href="https://man.openbsd.org/m4.1">m4(1)</a> now checks for integer overflows in custom allocs.
<li>Added support to <a href="https://man.openbsd.org/snmpd.8">snmpd(8)</a> for exporting ARP table via "ipNetToMediaTable" OID.
<li>Fixed a loop so that waiting for <a href="https://man.openbsd.org/i386/wds.4">wds(4/i386)</a> hardware actually happens.
<!-- 2014/04/27 -->
<li>Improved error handling when using <a href="https://man.openbsd.org/dbopen.3">dbopen(3)</a> in <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a>.
<li>Fixed library search order in <a href="https://man.openbsd.org/libtool.1">libtool(1)</a>.
<li>Updated to xproto 7.0.26.
<li>On i386, <a href="https://man.openbsd.org/installboot.8">installboot(8)</a> no longer overwrites disklabel and nearby blocks on 4k-sector disk drives.
<li>Stopped <a href="https://man.openbsd.org/bluetooth.4">bluetooth(4)</a> HID device grabbing the console.
<li>Re-added "_ppp" user and "_ppp" group, to be solely used by <a href="https://man.openbsd.org/npppd.8">npppd(8)</a> going forward.
<!-- 2014/04/26 -->
<li>Stopped <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> using random stack memory as addresses of strings.
<li>Removed support for building <a href="https://man.openbsd.org/openssl.1">openssl(1)</a> on 16-bit Windows.
<!-- 2014/04/25 -->
<li>Filter excess data from autoinstall output, to avoid filling the ramdisk.
<li>Made <a href="https://man.openbsd.org/more.1">more(1)</a> POSIX compliant with respect to the -e option.
<li>Merged <a href="https://man.openbsd.org/less.1">less(1)</a> version 458, including local changes.
<li>Reduced the verbosity of <a href="https://man.openbsd.org/makewhatis.8">makewhatis(8)</a> -t.
<li>Do not re-probe <a href="https://man.openbsd.org/pms.4">pms(4)</a> unnecessarily. Fixes 12 seconds <a href="https://man.openbsd.org/Xorg.1">Xorg(1)</a> delay on some laptops.
<li>Stopped <a href="https://man.openbsd.org/iked.8">iked(8)</a> and <a href="https://man.openbsd.org/mpii.4">mpii(4)</a> accessing pointers prior to a null check.
<li>Allow <a href="https://man.openbsd.org/snmpd.conf.5">snmpd.conf(5)</a> to set user-defined actions on receipt of snmp traps.
<!-- 2014/04/24 -->
<li>Removed <a href="https://man.openbsd.org/kinit.1">kinit(1)</a>.
<li>Fixed <a href="https://man.openbsd.org/sudo.8">sudo(8)</a> when checking command line environment variables against the blacklist (CVE 2014-0106).
<li>Fixed copied text in the <a href="https://man.openbsd.org/snmpd.8">snmpd(8)</a> error string.
<!-- 2014/04/23 -->
<li>Stopped <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> do_ssl3_write() being called recursively; don't release buffer meant for use.
<li>Audited <a href="https://man.openbsd.org/malloc.3">malloc(3)</a>/<a href="https://man.openbsd.org/calloc.3">calloc(3)</a>/<a href="https://man.openbsd.org/realloc.3">realloc(3)</a> usage in <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a> to be safe from overflows.
<li>Fixes in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> kssl.c to prevent double frees and removed a use-after-free.
<li>Fixed leak in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> BIO_accept which could have caused the caller to crash.
<li>Audited <a href="https://man.openbsd.org/strlcpy.3">strlcpy(3)</a>/<a href="https://man.openbsd.org/strlcat.3">strlcat(3)</a> usage in <a href="https://man.openbsd.org/mandoc.1">mandoc(1)</a>.
<li>Removed "Z" option from <a href="https://man.openbsd.org/malloc.conf.5">malloc.conf(5)</a>; by default always junk small chunks now.
<li>In <a href="https://man.openbsd.org/unbound.8">unbound(8)</a>, use <a href="https://man.openbsd.org/arc4random.9">arc4random(9)</a> as PRNG backend, instead of the libcrypto RAND.
<li><a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a> now fills all required fields after clearing. Avoids consistency check failures.
<!-- 2014/04/22 -->
<li>Improved <a href="https://man.openbsd.org/malloc.3">malloc(3)</a> hash functions that compute the same on big-endian and little-endian archs.
<li>Removed OPENSSL_indirect_call() from <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> for reduced attack surface.
<li>Fixed a missing <a href="https://man.openbsd.org/splbio.9">splbio(9)</a> in sys/ufs/ffs/ffs_softdep.c which caused crashes.
<li>Remove useless RX checksum offloading support from <a href="https://man.openbsd.org/gem.4">gem(4)</a> and <a href="https://man.openbsd.org/hme.4">hme(4)</a>.
<li>Removed Apache from base (replaced by <a href="https://man.openbsd.org/nginx.8">nginx(8)</a>).
<li>On <a href="https://man.openbsd.org/bge.4">bge(4)</a> when VLAN_HWTAGGING is disabled, stopped tagging the packet twice.
<li>Prepend ether_vlan_header rather than regular ethernet header for more efficient vlan tagging.
<li>Kerberos disabled and removed from base, possibly to be moved to <a href="https://man.openbsd.org/ports.7">ports(7)</a> later.
<li>Support the CA key for <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> inspection in the <a href="https://man.openbsd.org/relayd.8">relayd(8)</a> CA process.
<!-- 2014/04/21 -->
<li>Avoid a loop during autoinstall when the path in the responsefile does not exist.
<li>Made <a href="https://man.openbsd.org/iscsictl.8">iscsictl(8)</a> print bytes read and written in human-readable form.
<li>Allow the installer to configure dhcp for an interface without an active network connection.
<li>Bind <a href="https://man.openbsd.org/iscsid.8">iscsid(8)</a> to localAddr if it is specified.
<li>Print the target and initiator name in <a href="https://man.openbsd.org/iscsictl.8">iscsictl(8)</a> show command.
<li>Verify permissions are correct on the <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> id_ed25519 file.
<li>Fixed msdosfs to cope with 64-bit time_t. Set unrepresentable dates to 1/1/1980.
<li>Made <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a> delete discarded offered leases from the correct TAILQ. Avoids infinite loop.
<li>Implemented <a href="https://man.openbsd.org/sftp.1">sftp(1)</a> upload resume support.
<li>Reverted r1.101 of <a href="https://man.openbsd.org/traceroute.8">traceroute(8)</a>, which broke source port selection.
<li>Added <a href="https://man.openbsd.org/mallocarray.3">mallocarray(3)</a> function (like <a href="https://man.openbsd.org/calloc.3">calloc(3)</a> but without the cleared-memory guarantee).
<li>Backed out parts of sys/nfs/nfs_serv.c r1.47, which computed wrong block sizes.
<li>Added <a href="https://man.openbsd.org/pkg_add.1">pkg_add(1)</a> support for reading/writing long paths and linkpaths as extended headers.
<li>Allow <a href="https://man.openbsd.org/iscsid.8">iscsid(8)</a> to send data immediately for write commands, for 20% performance boost.
<li>Stopped <a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a> leaking mountpoint info. Fixes mysterious crashes.
<!-- 2014/04/20 -->