OpenBSD 6.1 released

New syspatch(8) utility for security and reliability binary updates to the base system.

A (highly subjective) selection of things that seemed interesting, sorted from most to least noteworthy in my opinion

--

- A lot of code has been removed or simplified to make the transition to multi-processor easier.

- printf(3) family of formatting functions now report to syslog when the %s format is used with a NULL pointer.

- When sending TCP streams they are locally stored in large mbuf clusters to improve memory management. The maximum TCP send and receive buffer size has been increased from 256KB to 2MB. Note that this results in a different pf(4) OS fingerprint for OpenBSD.

- ssh(1): Add a proxy multiplexing mode to ssh(1) inspired by the version in PuTTY by Simon Tatham. This allows a multiplexing client to communicate with the master process using a subset of the SSH packet and channels protocol over a Unix-domain socket, with the main process acting as a proxy that translates channel IDs, etc. This allows multiplexing mode to run on systems that lack file-descriptor passing used by current multiplexing code) and potentially, in conjunction with Unix-domain socket forwarding, with the client and multiplexing master process on different machines. Multiplexing proxy mode may be invoked using "ssh -O proxy ..."

- OpenSSH 7.4: Server support for the SSH v.1 protocol has been removed. {NB, note the "server" bit - "client" is not mentioned}

- Support for Linux guest VMs.

- The performance and concurrency of the malloc(3) family in multi-threaded processes has been improved.

- read(2) on directories now fails instead of returning 0.

- Support for permitting non-root users to mount(8) filesystems has been removed.

- Install sets are now fetched over an HTTPS connection by default when using a mirror that supports it.

- For incoming TLS connections syslogd(8) can validate client certificates with a given CA file.

- nc(1) now also supports OCSP stapling server side, and will show the stapling information client side.

- When log files are rotated, newsyslog(8) writes the creation time in UTC ISO format into the first line.

--

- sshd(8): Remove the UseLogin configuration directive and support for having /bin/login manage login sessions.

- sshd(8): Add a sshd_config DisableForwarding option that disables X11, agent, TCP, tunnel and Unix domain socket forwarding, as well as anything else we might implement in the future. Like the 'restrict' authorized_keys flag, this is intended to be a simple and future-proof way of restricting an account.

- sshd(8), ssh(1): Support the "curve25519-sha256" key exchange method. This is identical to the currently-supported method named "curve25519-sha256@libssh.org".

- Deprecate the sshd_config UsePrivilegeSeparation option, thereby making privilege separation mandatory. Privilege separation has been on by default for almost 15 years and sandboxing has been on by default for almost the last five.

- SHA512_256 family of functions added to libc.

- LibreSSL 2.5.3: Massive update and normalization of manpages, conversion to mandoc format. Many pages were rewritten for clarity and accuracy. Portable doc links are up-to-date with a new conversion tool.

--

- Use a hardware register for the thread pointer on arm for improved performance in multi-threaded processes.

- New vmm(4)/ vmd(8): Support was partially integrated in 6.0, but disabled.

- vmm(4) no longer requires VMX unrestricted guest capability (Nehalem and later CPUs are sufficient).

- Support VMs with > 2GB RAM.

- vmd(8) uses pledge(2) and the fork+exec model.

--

- All shared libraries, all dynamic and static-PIE executables, and ld.so(1) itself use the RELRO ("read-only after relocation") design such that more of the initial data is protected as read-only.

- The privileged parent process of syslogd(8) calls exec(2) to reshuffle its random memory layout.

- New function recallocarray(3) to reduce the risk of incorrect clearing of memory before and after reallocarray(3).

- arm added to the list of archs where the setjmp(3) family of functions apply XOR cookies to stack and return-address values in the jmpbuf.

- bioctl(8) now uses bcrypt PBKDF to derive keys for crypto volumes.

- Partial UTF-8 line editing support for ksh(1) Vi input mode.

- UTF-8 support in column(1).

--

Edit: Reordered things a little and grouped things together for legibility

They're down to earth enough that they'll probably recommend people learn how to use a CD burner.

Before you start wiping your other hypervisors, please note that it does not seem to be mature yet

* https://marc.info/?l=openbsd-tech&m=149048271705188&w=2)

My personal favorite from the LibreSSL section:

    Massive update and normalization of manpages, conversion to mandoc format. Many pages were rewritten for clarity and accuracy.

Most of OpenSSL's documentation desperately needed attention and was full of extremely minor errors that rendered some parts unintelligible - for example, this confusing single character one that was already fixed in LibreSSL : https://github.com/openssl/openssl/commit/a41815f05e71009d2a...