OpenBSD Journal

With one recent commit, the top(1) command on OpenBSD became quite a bit more useful. The commit adds a new -Q flag to show each process' use of the chroot(2), pledge(2) and unveil(2) facilities.The commit message reads,

In an announcement posted on social media, Damien Miller (djm@) writes,

As previously reported, Ori Bernstein is working on GEFS, the "Good Enough File System" imported to OpenBSD, and his EuroBSDCon 2026 presentation was very well received. In fact, the video is among the most frequently played from the conference.Now Ori has followed up with more evolved code that includes several important steps towards makin the new file system fit for general use. In a message to tech@, Ori writes:

LibreSSL 4.4.0, 4.3.4 and 4.2.3 have been released.

In his message to the ports@ mailing list, Thomas Frohwein (thfr@) leads in,

In his message to the ports@ mailing list, Thomas Frohwein (thfr@) leads in,

Theo de Raadt (deraadt@) hascommittedto -currenta (WIP) new utility for updating system databases:

The OpenBSD project hasannouncedOpenBSD 8.0,its 61 release.The new releasecontains a number of significant improvements, including but certainlynot limited to:

Version 0.130of Game of Treeshas been released (and the portupdated).Complete release notes are as follows:Read more...

In a post to tech@, Jan Schreiber submitted a driver for USB network control mode, uncm(4). Jan writes:

We have to admit that even users of a well rounded operating system like OpenBSD sometimes encounter hardware that is not quite supported yet. Fortunately, sometimes the user facing the problematic hardware is an experienced developer like Ian Darwin, and he took the time to write up his experience in a blog post titled Un-hanging the HP Envy 17-DA0013dx for OpenBSD.The article leads in with,

We have to admit that even users of a well rounded operation system like OpenBSD sometimes encounter hardware that is not quite supported yet. Fortunately, sometimes the user facing the problematic hardware is an experienced developer like Ian Darwin, and he took the time to write up his experience in a blog post titled Un-hanging the HP Envy 17-DA0013dx for OpenBSD.The article leads in with,

In their usual, unassuming fashion, the OpenSSH project have released a new version, release 10.6.The full text of the 10.6 release nodes reads:

In a move that hints strongly that the new OpenBSD release is about to drop soon, the LibreSSL project have announced the new stable releases.The announcement reads,

As previously noted, Rafael Sadowski (radowski@) has been behind a recent pickup in development of httpd(8)andrelayd(8).Now Rafael has written a new piece,entitledHeaders Up! What's New in httpd and relayd,on some of his recent work onhttpd(8)andrelayd(8).Among the notable additions are expanded and improved filtering and pattern matching features which make it harder to make a case for putting something like nginx in front of your httpd(8)andrelayd(8) setups.So while we at Undeadly were making notes with a view to reporting on all these features, Rafael himself beat us to it.His latest article is well worth reading, here.

In another hint that anew OpenBSD releaseis close,theOpenBGPD project hasannounceda new release of its software, version 9.3:

Theo de Raadt (deraadt@) updated the versionofOpenBSD-currentfrom "8.0"to "8.0-current".

The OpenBSD8.0 release cycle is entering its final phases...With the followingcommit,Theo de Raadt (deraadt@) moved -currentto version 8.0(dropping the "-beta"):

Job Snijders (job@)importedrtrd(8),and its associated control program,rtrctl(8):

Mike Larkin (mlarkin@)committedsupport for multi-processor virtual machines (i.e. guests):

Version 0.129 of Game of Trees has been released (and the port updated). Complete release notes are as follows:

Filesystems on OpenBSD have come in two varieties, UFS1 or UFS2. Ori Bernstein has set out to possibly introduce a new option, the "Good Enough File System", which Ori describes as

In an annoucement that vastly understates the usefulness of their code, the OpenSMTPD project have announced their new OpenSMTPD 7.9.0p0 release.The announcement says,

Last weekend was the EuroBSDCon conference, this time in Brussels, Belgium. Several talks were held, with quite a few on OpenBSD.You can watch all the talks on peer tube, check the dedicated OpenBSD playlist, or pick your favorite talk from the list:

Version 0.128of Game of Treeshas been released (and the portupdated). Complete release notes are as follows:Read more...

It's a big day for routing security aficionados. The OpenBGPD project (a sub-project of the OpenBSD project) have announced version 9.9 of rpki-client(8), with various improvements, enhancements and fixes.The announcement reads

In another move that signals a new OpenBSD release is in the works, the OpenSSH project has released without fanfare its new version, OpenSSH 10.5.The release notes read,

In another move that signals a new OpenBSD release is in the works, the OpenSSH project has released without fanfare its new version, OpenSSH 10.5.The release notes read,

A sure sign that a newOpenBSDwill soon be ready is that a new OpenBGPD release appears. On August 6th, 2026, the project released OpenBGPD version 9.2.The announcement reads,

Returning readers of this site may have noticed that the pace of development in relayd(8) and httpd(8) has been picking up recently. Now Rafael Sadowski (rsadowski@) has a new blog post out titled Dead Software Walking: The ongoing evolution of relayd(8) and httpd(8) where he tells the story.The article starts with

Thanks to the tireless work of among others Dave Voutila (dv@), development of the OpenBSD/amd64 virtualization system vmm(4)/vmd(8) continues to make progress.Now breaking changes, but with with potential benefits in both process isolation and compartmentalization of functionality, are on the way. It almost goes without saying that this code needs testing.In a message to the tech@ mailing list with the subject tests wanted: vmm(4)/vmd(8) fd-ification, Dave Voutila presents the code along with some explanation:

Thanks to the tireless work of among others Dave Voutila (dv@), development of the OpenBSD/amd64 virtualization system vmm(4)/vmd(8) continues to make progress.Now breaking changes, but with with potential benefits in both process isolation and compartmentalization of functionality, are on the way. It almost goes without saying that this code needs testing.In a message to the tech@ mailing list with the subject tests wanted: vmm(4)/vmd(8) fd-ification, Dave Voutila presents the code along with some explanation:

Yes, you read that right. Modern development tools in the form of the LLVM compiler infrastructure is well on its way to supporting OpenBSD/sparc64 along with other more conventional architectures.The support is now ready for testing, via a patch set presented by Kirill A. Korinsky (kirill@) in a message to the tech@ mailing list, with the subject LLVM toolchain for sparc64.The message reads,

In a change likely to be widely welcomed,Rafael Sadowski (rsadowski@)committedsupport for custom HTTP headers inhttpd(8).This obviates the need to use FastCGI support orrelayd(8)to achieve things like addingSSL/TLS security headers.Thecommitreads:

Up until quite recently, relayd(8) did not actually support ECDSA keys and certificates, as described in the Relayd doesn't like ecdsa thread on the tech@ mailing list.The problem is now solved.In this commit by Rafael Sadowski (rsadowski@), code that originated in smtpd(8) adds the previously lacking support.The commit message reads,

Version 0.127 of Game of Trees has been released (and the port updated). Complete release notes are as follows:

Version 0.127 of Game of Trees has been released (and the port updated). Complete release notes are as follows:

OpenBSD is moving closer to adding WPA3 support.Stefan Sperling (stsp@) posted a message with the subjectadd WPA3 supportto the tech mailling list with a patch that implements WPA3 in OpenBSD's net80211 subsystem including ifconfig(8), asking for testing and feedback.He also noted that this effort is supported by the NLNet Foundaton (as noted in an earlier article).The message reads,

OpenBSD development is an ever ongoing activity, and when the feature set of a new release has been set and the stabilization phase leading up to the release starts, -current becomes $NEXTRELEASE-beta.The switch to 8.0-beta happened with this commit by Theo de Raadt (deraadt@):

TheOpenBSD/loongsonhardware platform has been retired.Thecommit message by Miod Vallat (miod@) explains the reason(s).

Sometimes I like to think of OpenBSD development as a form of spiritual discipline. The project is a decades-long painstaking labor of love with hackers carefully rearranging source code by hand. In Dutch you'd call this monnikenwerk. So what better place could there be for a hackathon than an actual monastery? The g2k26 hackathon brought together 18 developers in the quaint village of Kloosterburen(its namesake stemming from there being a monastery) in the province of Groningen and was funded by the OpenBSD Foundation. I believe this was the first hackathon in the Netherlands!It's like the monastics from way back when already knew what's up with creating the perfect environment for hacking. We were given simple domestic quarters a stone's throw away from the communal hackroom. Big windows provided views of the gardens to help contemplation. While the Dutch national weather forecasting service issued its first-ever code red for extreme heat, our proximity to the North Sea and the monastery's thick stone walls created an enjoyable cooling effect. This all allowed me to (surprise surprise!) focus on rpki-client(8). A recent incident in the RPKI ecosystem helped me realize that our validator implementation doesn't need to try to synchronize to every broken endpoint on every run every time. To improve reliablity and reduce pressure on affected publication points, I implemented a mechanism to carry some state from one run to the next run to instrument a backoff retry strategy. Rpki-client now keeps track of the moment in time a RPKI CA became non-functional, how many synchronization attempts were made since then, and when the last attempt was. With this information the program can progressively decrease the synchronization frequency for persistently non-functional CAs, eventually settling on retrying about once per day. As they say: once bitten, twice shy. In closing, getting to spend time with other developers really is lovely. Special thanks to tb@ and claudio@ for their code review and feedback. Shoutout to caspar@ for helping organize this hackathon!

Academic studies of OpenBSD's features and their practical impact on security are somewhat rare, but we were pleasantly surprised to see the recent paper A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System, by Jukka Ruohonen, Krzysztof Sierszecki, Abhishek Tiwari (all at University of Southern Denmark).The paper studies the adoption of the pledge(2) and unveil(2) in the OpenBSD base system and packages over time, and finds that the features provided actually seem to facilitate adoption of secure coding practices.The paper's abstracts concludes,

The OpenSSH project has released OpenSSH 10.4.

Bothrelayd(8)andhttpd(8)now have the "secure" list of allowed crypto methods forHTTPS, which includeTLSv1.3 and the TLSv1.2 AEAD cipher suites.The previous list was "HIGH:!aNULL" which contain non-perfect-forward-securitymethods and this change may cause old clients to not be able to connect.

We almost missed this in a flurry of commits by Jonathan gray (jsg@), but following this commit, OpenBSD/amd64 kernels now have a 512GB address space.The commit message innocently reads,

In OpenBSD, the syslogd(8) system logger has already for a while now fork(2)ed the privileged from the non-privileged parts. Now Alexander Bluhm (bluhm@) decided it's time to split these parts into separate binaries in order to provide even better separation. The final commit message reads,

Random order relinking of critical components is an OpenBSD feature specifically designed to make it harder to exploit bugs in the resulting binary.sshd(8) was the first of the network-facing daemons to get the random treatment (see this previous report). Nowin a series of commits that split one daemon (smptd(8)) into six separate binaries, Theo de Raadt (deraadt@) is bringing httpd(8) and smptd(8), both common in network facing configrations, into the random relink at boot fold.httpd(8) was the first of the two:Read more...

In -current,Robert Nagy (robert@)updatedclang(1),llvm,and lld(1)to version 22.1.6:

The LibreSSL project has announced the release of version 4.3.2 of the software.

Version 0.126 of Game of Trees has been released (and the port updated). Complete release notes are as follows: