We have to admit that even users of a well rounded operating system like OpenBSD sometimes encounter hardware that is not quite supported yet. Fortunately, sometimes the user facing the problematic hardware is an experienced developer like Ian Darwin, and he took the time to write up his experience in a blog post titled Un-hanging the HP Envy 17-DA0013dx for OpenBSD.The article leads in with,
We have to admit that even users of a well rounded operation system like OpenBSD sometimes encounter hardware that is not quite supported yet. Fortunately, sometimes the user facing the problematic hardware is an experienced developer like Ian Darwin, and he took the time to write up his experience in a blog post titled Un-hanging the HP Envy 17-DA0013dx for OpenBSD.The article leads in with,
In a move that hints strongly that the new OpenBSD release is about to drop soon, the LibreSSL project have announced the new stable releases.The announcement reads,
As previously noted, Rafael Sadowski (radowski@) has been behind a recent pickup in development of httpd(8)andrelayd(8).Now Rafael has written a new piece,entitledHeaders Up! What's New in httpd and relayd,on some of his recent work onhttpd(8)andrelayd(8).Among the notable additions are expanded and improved filtering and pattern matching features which make it harder to make a case for putting something like nginx in front of your httpd(8)andrelayd(8) setups.So while we at Undeadly were making notes with a view to reporting on all these features, Rafael himself beat us to it.His latest article is well worth reading, here.
The OpenBSD8.0 release cycle is entering its final phases...With the followingcommit,Theo de Raadt (deraadt@) moved -currentto version 8.0(dropping the "-beta"):
Filesystems on OpenBSD have come in two varieties, UFS1 or UFS2. Ori Bernstein has set out to possibly introduce a new option, the "Good Enough File System", which Ori describes as
In an annoucement that vastly understates the usefulness of their code, the OpenSMTPD project have announced their new OpenSMTPD 7.9.0p0 release.The announcement says,
Last weekend was the EuroBSDCon conference, this time in Brussels, Belgium. Several talks were held, with quite a few on OpenBSD.You can watch all the talks on peer tube, check the dedicated OpenBSD playlist, or pick your favorite talk from the list:
It's a big day for routing security aficionados. The OpenBGPD project (a sub-project of the OpenBSD project) have announced version 9.9 of rpki-client(8), with various improvements, enhancements and fixes.The announcement reads
In another move that signals a new OpenBSD release is in the works, the OpenSSH project has released without fanfare its new version, OpenSSH 10.5.The release notes read,
In another move that signals a new OpenBSD release is in the works, the OpenSSH project has released without fanfare its new version, OpenSSH 10.5.The release notes read,
A sure sign that a newOpenBSDwill soon be ready is that a new OpenBGPD release appears. On August 6th, 2026, the project released OpenBGPD version 9.2.The announcement reads,
Returning readers of this site may have noticed that the pace of development in relayd(8) and httpd(8) has been picking up recently. Now Rafael Sadowski (rsadowski@) has a new blog post out titled Dead Software Walking: The ongoing evolution of relayd(8) and httpd(8) where he tells the story.The article starts with
Thanks to the tireless work of among others Dave Voutila (dv@), development of the OpenBSD/amd64 virtualization system vmm(4)/vmd(8) continues to make progress.Now breaking changes, but with with potential benefits in both process isolation and compartmentalization of functionality, are on the way. It almost goes without saying that this code needs testing.In a message to the tech@ mailing list with the subject tests wanted: vmm(4)/vmd(8) fd-ification, Dave Voutila presents the code along with some explanation:
Thanks to the tireless work of among others Dave Voutila (dv@), development of the OpenBSD/amd64 virtualization system vmm(4)/vmd(8) continues to make progress.Now breaking changes, but with with potential benefits in both process isolation and compartmentalization of functionality, are on the way. It almost goes without saying that this code needs testing.In a message to the tech@ mailing list with the subject tests wanted: vmm(4)/vmd(8) fd-ification, Dave Voutila presents the code along with some explanation:
Yes, you read that right. Modern development tools in the form of the LLVM compiler infrastructure is well on its way to supporting OpenBSD/sparc64 along with other more conventional architectures.The support is now ready for testing, via a patch set presented by Kirill A. Korinsky (kirill@) in a message to the tech@ mailing list, with the subject LLVM toolchain for sparc64.The message reads,
In a change likely to be widely welcomed,Rafael Sadowski (rsadowski@)committedsupport for custom HTTP headers inhttpd(8).This obviates the need to use FastCGI support orrelayd(8)to achieve things like addingSSL/TLS security headers.Thecommitreads:
Up until quite recently, relayd(8) did not actually support ECDSA keys and certificates, as described in the Relayd doesn't like ecdsa thread on the tech@ mailing list.The problem is now solved.In this commit by Rafael Sadowski (rsadowski@), code that originated in smtpd(8) adds the previously lacking support.The commit message reads,
OpenBSD is moving closer to adding WPA3 support.Stefan Sperling (stsp@) posted a message with the subjectadd WPA3 supportto the tech mailling list with a patch that implements WPA3 in OpenBSD's net80211 subsystem including ifconfig(8), asking for testing and feedback.He also noted that this effort is supported by the NLNet Foundaton (as noted in an earlier article).The message reads,
OpenBSD development is an ever ongoing activity, and when the feature set of a new release has been set and the stabilization phase leading up to the release starts, -current becomes $NEXTRELEASE-beta.The switch to 8.0-beta happened with this commit by Theo de Raadt (deraadt@):
Sometimes I like to think of OpenBSD development as a form of spiritual discipline. The project is a decades-long painstaking labor of love with hackers carefully rearranging source code by hand. In Dutch you'd call this monnikenwerk. So what better place could there be for a hackathon than an actual monastery? The g2k26 hackathon brought together 18 developers in the quaint village of Kloosterburen(its namesake stemming from there being a monastery) in the province of Groningen and was funded by the OpenBSD Foundation. I believe this was the first hackathon in the Netherlands!It's like the monastics from way back when already knew what's up with creating the perfect environment for hacking. We were given simple domestic quarters a stone's throw away from the communal hackroom. Big windows provided views of the gardens to help contemplation. While the Dutch national weather forecasting service issued its first-ever code red for extreme heat, our proximity to the North Sea and the monastery's thick stone walls created an enjoyable cooling effect. This all allowed me to (surprise surprise!) focus on rpki-client(8). A recent incident in the RPKI ecosystem helped me realize that our validator implementation doesn't need to try to synchronize to every broken endpoint on every run every time. To improve reliablity and reduce pressure on affected publication points, I implemented a mechanism to carry some state from one run to the next run to instrument a backoff retry strategy. Rpki-client now keeps track of the moment in time a RPKI CA became non-functional, how many synchronization attempts were made since then, and when the last attempt was. With this information the program can progressively decrease the synchronization frequency for persistently non-functional CAs, eventually settling on retrying about once per day. As they say: once bitten, twice shy. In closing, getting to spend time with other developers really is lovely. Special thanks to tb@ and claudio@ for their code review and feedback. Shoutout to caspar@ for helping organize this hackathon!
Academic studies of OpenBSD's features and their practical impact on security are somewhat rare, but we were pleasantly surprised to see the recent paper A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System, by Jukka Ruohonen, Krzysztof Sierszecki, Abhishek Tiwari (all at University of Southern Denmark).The paper studies the adoption of the pledge(2) and unveil(2) in the OpenBSD base system and packages over time, and finds that the features provided actually seem to facilitate adoption of secure coding practices.The paper's abstracts concludes,
Bothrelayd(8)andhttpd(8)now have the "secure" list of allowed crypto methods forHTTPS, which includeTLSv1.3 and the TLSv1.2 AEAD cipher suites.The previous list was "HIGH:!aNULL" which contain non-perfect-forward-securitymethods and this change may cause old clients to not be able to connect.
We almost missed this in a flurry of commits by Jonathan gray (jsg@), but following this commit, OpenBSD/amd64 kernels now have a 512GB address space.The commit message innocently reads,
In OpenBSD, the syslogd(8) system logger has already for a while now fork(2)ed the privileged from the non-privileged parts. Now Alexander Bluhm (bluhm@) decided it's time to split these parts into separate binaries in order to provide even better separation. The final commit message reads,
Random order relinking of critical components is an OpenBSD feature specifically designed to make it harder to exploit bugs in the resulting binary.sshd(8) was the first of the network-facing daemons to get the random treatment (see this previous report). Nowin a series of commits that split one daemon (smptd(8)) into six separate binaries, Theo de Raadt (deraadt@) is bringing httpd(8) and smptd(8), both common in network facing configrations, into the random relink at boot fold.httpd(8) was the first of the two:Read more...
The OpenBSD project hasannouncedOpenBSD 7.9,its 60 release.The new releasecontains a number of significant improvements, including but certainlynot limited to:
Like (we suspect) quite a few of our readers, undeadly.org co-editor Peter Hansteen runs a mail service and settled on exim as the reasonable alternative to the classic sendmail way back when.However, that software has had its share of security issues over the years, and during the preparations for the OpenBSD 7.9 release, the ports maintainers decided that
Network-oriented readers will be familiar with the concept of overload tables, commonly used with state tracking options to create adaptive rulesets for such things as punishingpassword-guessing botnets.A downside to tables that would tend to fill up indefinitely is that at some point they will be quite full, and the administrator would need to either manually run pfctl expire or set up a crontab entry to weed out old entries at intervals.Now Alexandr Nedvedicky (sashan@) is airing a patch on tech@ that would add a timeout option to to tables declarations, doing away with the need to set up crontab entries to run pfctl expire.The patch and the explanation can be found in the thread pf(4) add timeout option to ip address tables, with followup discussion where several developers and users pitch in.The message reads,
Florian Obser (florian@) recently gave aBSD-NLtalkentitled"Let's find out how to get predictable IPv6 addresses assigned to OpenBSD VMs".Florian takes us on a guided tour of how inet6 autoconf actually works, with enlightening and entertaining peeks into selected piece of OpenBSD source.At the end, we are asked to "now, draw the rest of the owl".Slidesare available in theusual place,andvideois also available.
Due to hardware failure, the machine hosting undeadly has gone down last week. Thanks to the kind and swift help from OpenBSD.amsterdam, we're now back online. We will source new hardware for the original machine and hopefully move back again soon.
Jonathan Gray (jsg@) updated the versionofOpenBSD-currentfrom "7.9"to "7.9-current".Those running the latest-and-greatest[via a sufficiently new snapshot or built from source]no longer need to use"-D snap" withpkg_add(1)(andpkg_info(1)).
Routing security matters to all of us(even those of us who seldom give the subject any thought),and therpki-client projectannouncedthe release of a new version of theirResource Public Key Infrastructure (RPKI) client,with a number of improvements.The announcement reads,
We're a little late reporting it but...The familiar safeguardsysctl hw.smtis now deprecated,having been replaced by a more flexible mechanismwhich allows discriminating between different varieties of core type.First, Theo de Raadt (deraadt@) enabled the mechanism for OpenBSD/amd64 in thiscommit:
OpenBSD Journal