|   | Released March 29, 2016 Copyright 1997-2016, Theo de Raadt. ISBN 978-0-9881561-7-3 5.9 Songs: "Doctor W^X", "Systemagic (Anniversary Edition)" 
 
All applicable copyrights and credits are in the src.tar.gz,
sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the
files fetched via  | 
This is a partial list of new features and systems included in OpenBSD 5.9. For a comprehensive list, see the changelog leading to 5.9.
lookup yp
            in
            
            resolv.conf(5).
        SOCK_DNS
            
            socket(2) flag that makes an SS_DNS tagged socket
            conceptually different from a plain socket.
        mode subcommand.
    default-lease-time,
        max-lease-time and bootp-lease-time options.
    -y IEEE802_11_RADIO and -v options.
    -g flag is used.
    -b flag that specifies the size of the EFI System
        partition to create.
    -v flag that causes a verbose display of both MBR
        and GPT information.
    -B and
        -b flags being removed.
        The associated fields in the disklabel were also removed.
        These functions are now all performed by
        
        installboot(8).
    kevent structures are now dumped.
    PermitRootLogin=prohibit-password/without-password that could,
        depending on compile-time configuration, permit password authentication
        to root while preventing other forms of authentication.
      SECURITY extension.
      diffie-hellman-group-exchange to 2048 bits.
      blowfish-cbc, cast128-cbc,
          all arcfour variants and the rijndael-cbc aliases
          for AES.
        draft-rsa-dsa-sha2-256-03.txt and
        draft-ssh-ext-info-04.txt.
      AddKeysToAgent client option which can be set to
        yes, no, ask, or confirm, and
        defaults to no.  When enabled, a private key that is used
        during authentication will be added to
        ssh-agent(1)
        if it is running (with confirmation enabled if set to confirm).
      authorized_keys option restrict that
        includes all current and future key restrictions
        (no-*-forwarding, etc.).
        Also add permissive versions of the existing restrictions, e.g.
        no-pty -> pty. This simplifies the task of setting up
        restricted keys and ensures they are maximally-restricted,
        regardless of any permissions we might implement in the future.
      ssh-keygen -lf ~/.ssh/authorized_keys.  (bz#1319)
      none as an argument for
        sshd_config(5)
        Foreground and ChrootDirectory.  Useful inside
        Match blocks to override a global default.  (bz#2486)
      -f -") for ssh-keygen -L.
      ssh-keyscan -c ... flag to allow fetching certificates
        instead of plain keys.
      cvs.openbsd.org.) in
        hostname canonicalisation - treat them as already canonical and
        trailing '.' before matching
        ssh_config(5).
      first_kex_follows option during the
        initial key exchange.
      SSH2_MSG_UNIMPLEMENTED replies to
        unexpected messages during key exchange.  (bz#2949)
      ConnectionAttempts=0, which does not
        make sense and would cause ssh to print an uninitialised stack
        variable.  (bz#2500)
      Match blocks.  (bz#2489)
      PubkeyAcceptedKeyTypes +... inside a Match block.
      -i options
        before checking whether or not the identity file exists.  Avoids
        confusion for cases where shell doesn't expand (e.g.
        -i ~/file vs. -i~/file).  (bz#2481)
      Match exec
        in a config file, which could cause some commands to fail in certain
        environments.  (bz#2471)
      ChrootDirectory is active.  (bz#2485)
      PubkeyAcceptedKeyTypes in ssh -G config dump.
      TunnelForwarding device flags if they are
        already what is needed; makes it possible to use
        tun(4)/
        tap(4)
        networking as non-root user if device permissions and interface flags
        are pre-established.
      RekeyLimits could be exceeded by one packet.  (bz#2521)
      fatal() for PKCS11 tokens that present empty key IDs.
        (bz#1773)
      RekeyLimits larger than 4GB.  (bz#2521)
      known_hosts
        file edits when known_hosts doesn't exist.
      %i in ControlPath to UID.  (bz#2449)
      openssh_RSA_verify.  (bz#2460)
      ssh -G ...) of HostKeyAlgorithms=+...
      HostkeyAlgorithms=+...
      ClientHello messages
        that do not include TLS extensions, resulting in such handshakes being
        aborted.
      ECDH_compute_key that can lead to silent
        truncation of the result key without error. A coding error could cause
        software to use much shorter keys than intended.
      DTLS_BAD_VER. Pre-DTLSv1 implementations
        are no longer supported.
      engine command and parameters are removed from
        
        openssl(1).
        Previous releases removed dynamic and built-in engine support already.
      Certplus CA root certificate to the default
        cert.pem file.
      sizeof(RC4_CHUNK).
      AEAD construction introduced in RFC 7539, which is different
        than that already used in TLS with
        
        EVP_aead_chacha20_poly1305(3).
      COMODO RSA Certification Authority and
        QuoVadis root certificates to cert.pem.
      C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority"
        (serial 3c:91:31:cb:1f:f6:d0:1b:0e:9a:b8:d0:44:bf:12:be)
        root certificate from cert.pem.
      s_time command now performs a proper shutdown which allows a
        full TLS connection to be benchmarked more accurately. A new
        -no_shutdown flag
        makes s_time adopt the previous behavior so that comparisons
        can still be made with OpenSSL's version.
      SSLEAY_CONF backwards compatibility
        environment variable in
        
        openssl(1).
      CVE-2015-3194—NULL pointer dereference in client
          side certificate validation.
        CVE-2015-3195—memory leak in PKCS7, not reachable
          from TLS/SSL.
        CVE-2015-3193—carry propagating bug in the x86_64
          Montgomery squaring procedure.
        CVE-2015-3196—double free race condition of the
          identify hint data.
        cmake builds.
      pkgconfig files to correctly report the release
        version number, not the individual library ABI version numbers.
      libtls API is changed from the 2.2.x series:
        libtls no longer implicitly closes the passed in sockets.
          The caller is responsible for closing them in this case.
        OPENSSL_cpu_caps is provided that does not
        allow software to inadvertently modify cpu capability flags.
        OPENSSL_ia32cap and OPENSSL_ia32cap_loc are removed.
      out_len argument of AEAD changed from
        ssize_t to size_t.
      libtls for client and server operations; it is
        included in the libressl-portable distribution as an example of how
        to use the libtls library.  This is intended to be a simpler
        and more robust replacement for openssl s_client and
        openssl s_server for day-to-day operations.
      unsigned long to
        time_t.  LibreSSL now checks if the host OS supports 64-bit
        time_t.
      libtls.
      libtls,
        
        tls_peer_cert_notbefore(3)
        and
        
        tls_peer_cert_notafter(3).
      EVP_CHECK_DES_KEY code
        (non-functional since initial commit in 2004).
      probable_prime_dh_safe().
      LIBRESSL_VERSION_NUMBER to match that of
        OPENSSL_VERSION_NUMBER.
      AES_decrypt.
      SSL_OP_SINGLE_DH_USE flag.
      Many pre-built packages for each architecture:
Some highlights:
Following this are the instructions which you would have on a piece of paper if you had purchased a CDROM set instead of doing an alternate form of install. The instructions for doing an HTTP (or other style of) install are very similar; the CDROM instructions are left intact so that you can see how much easier it would have been if you had purchased a CDROM instead.
Please refer to the following files on the three CDROMs or mirror site for extensive details on how to install OpenBSD 5.9 on your machine:
Quick installer information for people familiar with OpenBSD, and the use of the "disklabel -E" command. If you are at all confused when installing OpenBSD, read the relevant INSTALL.* file as listed above!
If you already have an OpenBSD 5.8 system, and do not want to reinstall, upgrade instructions and advice can be found in the Upgrade Guide.
src.tar.gz contains a source archive starting at /usr/src.
This file contains everything you need except for the kernel sources, which are
in a separate archive.  To extract:
# mkdir -p /usr/src # cd /usr/src # tar xvfz /tmp/src.tar.gz
sys.tar.gz contains a source archive starting at /usr/src/sys.
This file contains all the kernel sources you need to rebuild kernels.
To extract:
# mkdir -p /usr/src/sys # cd /usr/src # tar xvfz /tmp/sys.tar.gz
Both of these trees are a regular CVS checkout. Using these trees it is possible to get a head-start on using the anoncvs servers as described here. Using these files results in a much faster initial CVS update than you could expect from a fresh checkout of the full OpenBSD source tree.
A ports tree archive is also provided. To extract:
# cd /usr # tar xvfz /tmp/ports.tar.gz
Go read the ports page if you know nothing about ports at this point. This text is not a manual of how to use ports. Rather, it is a set of notes meant to kickstart the user on the OpenBSD ports system.
The ports/ directory represents a CVS (see the manpage for cvs(1) if you aren't familiar with CVS) checkout of our ports. As with our complete source tree, our ports tree is available via AnonCVS. So, in order to keep up to date with the -stable branch, you must make the ports/ tree available on a read-write medium and update the tree with a command like:
# cd /usr/ports # cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_5_9
[Of course, you must replace the server name here with a nearby anoncvs server.]
Note that most ports are available as packages on our mirrors. Updated ports for the 5.9 release will be made available if problems arise.
If you're interested in seeing a port added, would like to help out, or just would like to know more, the mailing list ports@openbsd.org is a good place to know.