Index: stable/8/release/doc/en_US.ISO8859-1/errata/article.xml =================================================================== --- stable/8/release/doc/en_US.ISO8859-1/errata/article.xml (revision 278271) +++ stable/8/release/doc/en_US.ISO8859-1/errata/article.xml (revision 278272) @@ -1,299 +1,219 @@ %release; + + ]>
&os; &release.current; Errata The &os; Project $FreeBSD$ - 2013 + 2015 The &os; Documentation Project &tm-attrib.freebsd; &tm-attrib.intel; &tm-attrib.sparc; &tm-attrib.general; This document lists errata items for &os; &release.current;, containing significant information discovered after the release or too late in the release cycle to be otherwise included in the release documentation. This information includes security advisories, as well as news relating to the software or documentation that could affect its operation or usability. An up-to-date version of this document should always be consulted before installing this version of &os;. This errata document for &os; &release.current; will be maintained until the &os; &release; end of life. Introduction This errata document contains late-breaking news about &os; &release.current; Before installing this version, it is important to consult this document to learn about any post-release discoveries or problems that may already have been found and fixed. Any version of this errata document actually distributed with the release (for example, on a CDROM distribution) will be out of date by definition, but other copies are kept updated on the Internet and should be consulted as the current errata for this release. These other copies of the errata are located at http://www.FreeBSD.org/releases/, plus any sites which keep up-to-date mirrors of this location. Source and binary snapshots of &os; &release.branch; also contain up-to-date copies of this document (as of the time of the snapshot). For a list of all &os; CERT security advisories, see http://www.FreeBSD.org/security/ or ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/. Security Advisories Problems described in the following security advisories have been fixed in &release.current;. For more information, consult the individual advisories available from http://security.FreeBSD.org/. - - - - - - - - Advisory - Date - Topic - - + &security; + - - - SA-12:01.openssl - 03 May 2012 + + Errata Notices - OpenSSL multiple vulnerabilities - - - - SA-12:02.crypt - 30 May 2012 - Incorrect crypt() hashing - - - - SA-12:03.bind - 12 June 2012 - Incorrect handling of zero-length RDATA fields in &man.named.8; - - - - SA-12:04.sysret - 12 June 2012 - Privilege escalation when returning from kernel - - - - SA-12:05.bind - 6 August 2012 - &man.named.8; DNSSEC validation Denial of Service - - - - SA-12:06.bind - 22 November 2012 - Multiple Denial of Service vulnerabilities with &man.named.8; - - - - SA-12:07.hostapd - 22 November 2012 - Insufficient message length validation for EAP-TLS messages - - - - SA-12:08.linux - 22 November 2012 - Linux compatibility layer input validation error - - - - SA-13:02.libc - 19 February 2013 - glob(3) related resource exhaustion - - - - SA-13:03.openssl - 02 April 2013 - OpenSSL multiple vulnerabilities - - - - SA-13:04.bind - 02 April 2013 - BIND remote denial of service - - - - SA-13:05.nfsserver - 29 April 2013 - Insufficient input validation in the NFS server - - - - + &errata; Open Issues [20130613] The &man.vtnet.4; network interface driver displays the following message upon configuration when using QEMU 1.4.1 and later: vtnet0: error setting host MAC filter table This message is harmless when the interface has only one MAC address. The patch for this issue is filed to a PR kern/178955. [20130609] There is incompatibility in &man.jail.8; configuration because the &man.jail.8; utility and rc.d/jail script has been changed. More specifically, the following &man.sysctl.8; variables cannot be used to set the default parameters for jails: security.jail.mount_zfs_allowed security.jail.mount_procfs_allowed security.jail.mount_nullfs_allowed security.jail.mount_devfs_allowed security.jail.mount_allowed security.jail.chflags_allowed security.jail.allow_raw_sockets security.jail.sysvipc_allowed security.jail.socket_unixiproute_only security.jail.set_hostname_allowed These could be set by manually using &man.sysctl.8; utility, the &man.sysctl.conf.5; file, or for some of them the following variables in &man.rc.conf.5;: jail_set_hostname_allow="yes" jail_socket_unixiproute_only="yes" jail_sysvipc_allow="yes" These parameters must now be specified in jail_parameters (or jail_jailname_parameters for per-jail configuration) in &man.rc.conf.5;. For example: jail_parameters="allow.sysvipc allow.raw_sockets" The valid keywords are the following. For more detail, see &man.jail.8; manual page. allow.set_hostname allow.sysvipc allow.raw_sockets allow.chflags allow.mount allow.mount.devfs allow.mount.nullfs allow.mount.procfs allow.mount.zfs allow.quotas allow.socket_af [20130608] &os; &release; no longer supports &os; CVS repository. Some documents mistakenly refer to RELENG_8_4_0_RELEASE as CVS tag for the release and RELENG_8_4 as CVS branch tag for the &release; security branch. However, &os; Project no longer supports &os; CVS repository and &release; has been released by using &os; subversion repository instead. RELENG_8_4 corresponds to svn://svn.FreeBSD.org/base/releng/8.4, and RELENG_8_4_0_RELEASE corresponds to svn://svn.FreeBSD.org/base/release/8.4.0. Please note that &os; source tree for &release; and its security branch cannot be updated by using official CVSup servers. [20130607] (removed about a &man.bge.4; network interface driver issue because it was incorrect) [20130606] The &man.fxp.4; network interface driver may not work well with the &man.dhclient.8; utility. More specifically, if the /etc/rc.conf has the following line: ifconfig_fxp0="DHCP" to activate a DHCP client to configure the network interface, the following notification messages are displayed and the &man.dhclient.8; utility keeps trying to initialize the network interface forever. kernel: fxp0: link state changed to UP kernel: fxp0: link state changed to DOWN A patch to fix this issue will be released as an Errata Notice. Late-Breaking News and Corrections [20130606] As described in &os; &release; Release Notes, &os; ZFS subsystem has been updated to support feature flags for ZFS pools. However, the default version number of a newly created ZFS pool is still 28. This is because &os; 9.0 and 9.1 do not support the feature flags. This means ZFS pools with feature flag support cannot be used on &os; 9.0 and 9.1. An 8.X system with v28 ZFS pools can be upgraded to 9.X with no problem. Note that &man.zfs.8; send and receive commands do not work between pools with different versions. Once a ZFS pool is upgraded from v28, there is no way to upgrade the system to &os; 9.0 and 9.1. &os; 9.2 and later will support ZFS pools with feature flags. To create a ZFS pool with feature flag support, use the &man.zpool.8; create command and then the &man.zpool.8; upgrade command.
Index: stable/8/release/doc/en_US.ISO8859-1/relnotes/article.xml =================================================================== --- stable/8/release/doc/en_US.ISO8859-1/relnotes/article.xml (revision 278271) +++ stable/8/release/doc/en_US.ISO8859-1/relnotes/article.xml (revision 278272) @@ -1,1268 +1,1250 @@ %release; + + ]>
&os; &release.current; Release Notes The &os; Project $FreeBSD$ - 2011 + 2015 The &os; Documentation Project &tm-attrib.freebsd; &tm-attrib.ibm; &tm-attrib.ieee; &tm-attrib.intel; &tm-attrib.sparc; &tm-attrib.general; The release notes for &os; &release.current; contain a summary of the changes made to the &os; base system on the &release.branch; development line. This document lists applicable security advisories that were issued since the last release, as well as significant changes to the &os; kernel and userland. Some brief remarks on upgrading are also presented. Introduction This document contains the release notes for &os; &release.current;. It describes recently added, changed, or deleted features of &os;. It also provides some notes on upgrading from previous versions of &os;. The &release.type; distribution to which these release notes apply represents the latest point along the &release.branch; development branch since &release.branch; was created. Information regarding pre-built, binary &release.type; distributions along this branch can be found at . The &release.type; distribution to which these release notes apply represents a point along the &release.branch; development branch between &release.prev; and the future &release.next;. Information regarding pre-built, binary &release.type; distributions along this branch can be found at . This distribution of &os; &release.current; is a &release.type; distribution. It can be found at or any of its mirrors. More information on obtaining this (or other) &release.type; distributions of &os; can be found in the Obtaining &os; appendix to the &os; Handbook. All users are encouraged to consult the release errata before installing &os;. The errata document is updated with late-breaking information discovered late in the release cycle or after the release. Typically, it contains information on known bugs, security advisories, and corrections to documentation. An up-to-date copy of the errata for &os; &release.current; can be found on the &os; Web site. What's New This section describes the most user-visible new or changed features in &os; since &release.prev;. Typical release note items document recent security advisories issued after &release.prev;, new drivers or hardware support, new commands or options, major bug fixes, or contributed software upgrades. They may also list changes to major ports/packages or release engineering practices. Clearly the release notes cannot list every single change made to &os; between releases; this document focuses primarily on security advisories, user-visible changes, and major architectural improvements. Security Advisories Problems described in the following security advisories have been fixed. For more information, consult the individual advisories available from http://security.FreeBSD.org/. - - - - - - - - Advisory - Date - Topic - - + &security; + - - - SA-10:08.bzip2 - 20 September 2010 - Integer overflow in bzip2 decompression - - - SA-10:10.openssl - 29 November 2010 - OpenSSL multiple vulnerabilities - - - - + + Errata Notices + + &errata; Kernel Changes The maximum number of pages used for DMA bounce buffer pool has been increased from 256 to 1024. The default value of kern.hz has been increased from 100 to 1000. The SMP kernel now works on MPC7400-based Apple desktop machines such as PowerMac3,3. &os;/powerpc now supports DMA bounce buffer which is required on systems with larger RAM than 4GB. &os;/mips support has been improved. It now supports SMP on a SWARM with a dual-core Sibyte processor. &os;/mips now supports Netlogic Microsystems' XLR and XLS multi-core processor families. &os;/sparc64 now supports reservation-based physical memory allocation which provides better performance. &os;/amd64 now always sets the KVA space as equal to or larger than physical memory size. The default size was calculated based on one-third of the physical memory size by a code derived from one for i386. It has been changed because constraints for memory space are not severe on amd64 and this change would help to prevent a kmem_map too small panic which often occurs when using ZFS. CPU topology detection for Intel CPUs has been improved. ACPI suspend/resume functionality support has been improved. &os; kernel now supports kern_fpu_enter() and kern_fpu_leave() KPIs which allow the kernel subsystems to use XMM register files used in Intel SSE (Streaming SIMD Extensions). The &man.acpi.4; driver now uses ACPI Reset Register capability by default only when a flag in the FADT which indicates it is available. This behavior was controlled by a &man.sysctl.8; variable hw.acpi.handle_reboot and the default value was always set to 0. The &man.acpi.4; driver now supports new loader tunables hw.acpi.install_interface and hw.acpi.remove_interface. For more details, see &man.acpi.4; manual page. The &man.alq.9; support has been improved. The alq_writen() and alq_getn() KPIs have been extended to support variable length messages, which is enabled at ALQ creation time depending on the arguments passed to alq_open(). Also, the ALQ_NOACTIVATE and ALQ_ORDERED flags have been added to allow ALQ consumers to have more control over I/O scheduling and resource acquisition respectively. These extensions are fully backward compatible. The &man.alq.9; support is now provided as a kernel module alq.ko. The &man.ddb.8; kernel debugger now supports an optional delay in reset and reboot commands. This allows an administrator to break the system into debugger and trigger automatic textdump when an unattended panic occurs. The &man.ddb.8; kernel debugger now supports a show cdev command. This displays the list of all created cdev's, consisting of devfs node name and struct cdev address. The &os; GENERIC kernel is now compiled with and options. From 8.2-RELEASE the kernel supports displaying a stack trace on panic by using &man.stack.9; facility with no debugger backend like &man.ddb.8;. Note that this does not change the default behaviors of the GENERIC kernel on panic. The following &man.sysctl.8; variables are also now loader tunables: vm.kmem_size, vm.kmem_size_max, and vm.kmem_size_min, debug.kdb.stop_cpus, debug.trace_on_panic, and kern.sync_on_panic. Also, new &man.sysctl.8; variables vm.kmem_map_size for the current kmem map size and vm.kmem_map_free for largest contiguous free range in kmem map, vfs.ncsizefactor for size factor for namecache, and vfs.ncnegfactor for ratio of negative namecache entries have been added. The &os; &man.memguard.9; framework has been improved to make it able to detect use-after-free of allocated memories over a longer time. For more details, see &man.memguard.9; manual page. PT_LWPINFO request to obtain information about the kernel thread that caused the traced process to stop in the &man.ptrace.2; process tracing and debugging facility has been improved. It now reports system call entry and leave events, as well as availability of siginfo_t accompanying the reported signal. The &os; &man.crypto.4; framework (opencrypto) now supports XTS-AES (XEX-TCB-CTS, or XEX-based Tweaked Code Book mode with CipherText Stealing), which is defined in IEEE Std. 1619-2007. Xen HVM support in &os;/amd64 kernel has been improved. For more details, see &man.xen.4; manual page. The qpi(4) pseudo bus driver has been added. This supports extra PCI buses on Intel QPI chipsets where various hardware such as memory controllers for each socket is connected. Boot Loader Changes &os; now fully supports GPT (GUID Partition Table). Checksums of primary header and primary partition table are verified properly now. Memory management issues that prevented &os; OpenFirmware loader and netbooting from working have been fixed. The &man.pxeboot.8; now uses NFS version 3 instead of version 2 by default. Hardware Support The &man.aesni.4; driver has been added. This supports AES accelerator on Intel CPUs and accelerates AES operations for &man.crypto.4;. The &man.aibs.4; driver has been added. This supports the hardware sensors in ASUS motherboards and replaces the &man.acpi.aiboost.4; driver. The &man.coretemp.4; driver now supports Xeon 5500/5600 series. &os;/powerpc now supports the I2C bus in Apple System Management Unit. A device driver that supports CPU temperature sensors on PowerMac 11,2 has been added. The &man.ehci.4;, &man.ohci.4;, and &man.uhci.4; driver now support LOW speed BULK transfer mode. The &man.ichwd.4; driver now supports Intel NM10 Express chipset watchdog timer. The &man.tpm.4; driver, which supports Trusted Platform Module has been added. The xhci(4) driver, which supports Extensible Host Controller Interface (xHCI) and USB 3.0, has been added. Multimedia Support The &os; Linux emulation subsystem now supports the video4linux API. This requires native video4linux hardware drivers such as the ones provided by multimedia/pwcbsd and multimedia/webcamd. MIDI input buffer size in the &man.uaudio.4; driver has been changed. This fixes a problem where the input appears several seconds late. An issue in the &man.uaudio.4; driver that prevented some USB audio devices from working has been fixed. Network Interface Support The &man.alc.4; driver now supports Atheros AR8151/AR8152 PCIe Gigabit/Fast Ethernet controllers. A bug in the &man.alc.4; driver was fixed that could lead to a system freeze when the system was booted without a cable plugged in. This symptom was found in AR8132 on EEE PC. The TX interrupt moderation timer in the &man.alc.4; driver has been reduced from 50ms to 1ms. The 50ms timer resulted in a poor UDP performance. The &man.axe.4; driver has been improved for stability and better performance on the TX packet rate. The &man.bge.4; driver now supports BCM5718 x2 PCI Express dual-port gigabit Ethernet controller family. This family is the successor to the BCM5714/BCM5715 family and supports IPv4/IPv6 checksum offloading, TSO, VLAN hardware tagging, jumbo frames, MSI/MSIX, IOV, RSS and TSS. The current version of the driver supports all hardware features except IOV and RSS/TSS. A bug in the &man.bge.4; driver which prevented TSO from working in BCM57780 has been fixed. A bug in the &man.bge.4; driver that could wrongly disable the TX checksum offloading feature as well when one tries to disable only the RX checksum offloading has been fixed. Some improvements for reliability of the &man.bge.4; driver with BCM5906 controller has been made. The &man.bge.4; driver now supports hardware MAC statistics in controller's internal memory for BCM5705 or newer Broadcom controllers. These counters can be accessed via &man.sysctl.8; variable dev.bge.N.stats.* and provide useful information to diagnose driver issues. UDP checksum offloading in the &man.bge.4; driver has been disabled by default. This is because Broadcom controllers have a bug which can generate UDP datagrams with checksum value 0 when TX UDP checksum offloading is enabled. The checksum offloading can be enabled by using the following loader tunable: dev.bge.N.forced_udpcsum A bug in the &man.bge.4; driver that could lead to poor performance on a system with more than 4 GB RAM has been fixed. The cause was that all of Broadcom controllers except the BCM5755 and later have a bug in 4 GB-boundary DMA processing and used the bounce buffer in an inefficient way. The &man.bwi.4; driver, which supports Broadcom BCM430* and BCM431* family Wireless Ethernet controllers, has been added. This is not compiled into the GENERIC kernel because there are some problems. The kernel module if_bwi.ko is available and can be loaded without recompiling the kernel to enable this driver. A bug in the &man.bwn.4; driver that prevented WPA authentication from working has been fixed. A bug in the &man.cdce.4; driver has been fixed. The &man.cxgb.4; driver now supports the following new &man.sysctl.8; variables: hw.cxgb.nfilters sets the maximum number of entries in the hardware filter table, dev.cxgbc.N.pkt_timestamp provides packet timestamp instead of connection hash, and dev.cxgbc.N.core_clock provides the core clock frequency in kHz. The &man.em.4; driver has been updated to version 7.1.9. The &man.igb.4; driver has been updated to version 2.0.7. The &man.em.4; and &man.igb.4; drivers now provide statistics counters as &man.sysctl.8; MIB objects. The &man.em.4; and &man.igb.4; drivers now support the &man.led.4; interface via /dev/led/emN and /dev/led/igbN for identification LED control. The following command line makes the LED blink on em0: &prompt.root; echo f2 > /dev/led/em0 The &man.epair.4; virtual Ethernet interface driver now supports explicit UP/DOWN linkstate. This fixes an issue when it is used with the &man.carp.4; protocol. The &man.fxp.4; driver now supports TSO over VLAN on i82550 and i82551 controllers. The &man.iwn.4; driver now supports Intel Wireless WiFi Link 6000 series. The firmware has been updated to version 9.221.4.1. The &man.ixgbe.4; driver is now also provided as a kernel module. The &man.ixgbe.4; driver has been updated to version 2.3.8. It now supports 82599, better interrupt handling, hardware assist to LRO, VM SRIOV interface, and so on. The &man.miibus.4; has been rewritten for the generic IEEE 802.3 annex 31B full duplex flow control support. The &man.alc.4;, &man.bge.4;, &man.bce.4;, &man.cas.4;, &man.fxp.4;, &man.gem.4;, &man.jme.4;, &man.msk.4;, &man.nfe.4;, &man.re.4;, &man.stge.4;, and &man.xl.4; drivers along with atphy(4), bmtphy(4), brgphy(4), e1000phy(4), gentbi(4), inphy(4), ip1000phy(4), jmphy(4), nsgphy(4), nsphyter(4), and &man.rgephy.4; have been updated to support flow control via this facility. The &man.mwlfw.4; driver is now also provided as a kernel module. A bug in the &man.mxge.4; driver that prevented TSO from working has been fixed. The &man.nfe.4; driver now supports WoL (Wake on LAN). The &man.re.4; driver now supports 64-bit DMA addressing for RTL810xE/RTL8168/RTL8111 PCIe controllers. The &man.re.4; driver now supports hardware interrupt moderation of TX completion interrupts on RTL8169/RTL8168 controllers. The &man.rl.4; driver now supports WoL (Wake on LAN) on RTL8139B or newer controllers. The &man.rl.4; driver now supports reading hardware statistics counters by setting a &man.sysctl.8; variable dev.rl.N.stats to 1. The &man.rl.4; driver now supports a device hint to change a way of register access. Although some newer RTL8139 controllers support memory-mapped register access, it is difficult to detect the support automatically. For this reason the driver uses I/O mapping by default and provides the following device hint. If it is set to 0, the driver uses memory mapping for register access. hint.rl.N.prefer_iomap="0" Note that the default value is 1. The &man.rl.4; driver has improved interrupt handling. It now has better TX performance under high RX load. A bug in the &man.sk.4; driver has been fixed. It did not program the station address for Yukon controllers and overriding the station address with &man.ifconfig.8; was not possible. The &man.sk.4; driver now disables TX checksum offloading by default. This is because some revisions of the Yukon controller generate corrupted frames. The checksum offloading can be enabled manually by using option in the &man.ifconfig.8; utility. The &man.sis.4; driver now works on all supported platforms. Some stability and performance issues have also been fixed. The &man.sis.4; driver now supports WoL (Wake on LAN) on NS DP8315 controller. A tunable dev.sis.N.manual_pad for the &man.sis.4; driver has been added. This controls whether padding with 0x00 for short frames is done by CPU, rather than the controller. The reason why this tunable has been added is that NS DP83815/DP83816 pads them with 0xff though RFC 1042 specifies it should be 0x00. The tunable is disabled by default, which means padding with 0xff is used because padding with 0x00 by software needs extra CPU cycles. Enabling manual_pad, by setting this &man.sysctl.8; variable to a non-zero value, forces the use of software padding. The &man.ste.4; driver now supports a device hint to change the device register access mode. The driver uses memory-mapped register access by default, but this caused stability problems with some old IC Plus Corp (formerly Sundace) controllers. The following device hint makes the driver use I/O mapping for register access: hint.ste.N.prefer_iomap="1" The &man.xl.4; driver now supports WoL (Wake on LAN). Note that not all controllers support this functionality and some need an additional remote wakeup cable. Network Protocols An issue in the &man.carp.4; pseudo interface and linkstate changes of the underlying interfaces has been fixed. This happened when a &man.carp.4; interface was created before the underlying interface and its linkstate became UP. The stdtime part of libc, &man.zdump.8; and &man.zic.8; have been updated from the tzcode2004a release to the tzcode2009h release. If you have upgraded from source or via the &man.freebsd-update.8;, then please run &man.tzsetup.8; to install a new /etc/localtime. A new loader tunable net.link.ifqmaxlen has been added. It specifies the default value of send interface queue length. The default value for this parameter is 50. The ngtee action in the &man.ipfw.4; packet filter subsystem has been changed. It no longer accepts a packet. A possible panic in the &man.ipfw.4; pseudo interface for logging has been fixed. IPsec flow distribution has been improved for more parallel processing. A bug in the &os; IPv4 stack that prevented adding a proxy ARP entry over &man.netgraph.4; interfaces has been fixed. A bug in the &os; IPv6 stack that prevented an in the &man.ping6.8; utility from working with net.inet6.ip6.use_defaultzone=1 has been fixed. The &man.lagg.4; interface now supports a &man.sysctl.8; variable net.link.lagg.failover_rx_all. This controls whether to accept input packets on any link in a failover lagg. The &man.ng.eiface.4; &man.netgraph.4; node now supports VLAN-compatible MTU and an MTU size which is larger than 1500. The &man.ng.ether.4; &man.netgraph.4; node now supports interface transfer between multiple virtual network stacks by &man.ifconfig.8; vnet command. A &man.ng.ether.4; node associated with a network interface is now destroyed and recreated when the network interface is moved to another vnet. A new &man.netgraph.4; node &man.ng.patch.4; has been added. This performs data modification of packets passing through. Modifications are restricted to a subset of C language operations on unsigned integers of 8, 16, 32 or 64-bit size. An ICMP unreachable problem in the &man.pf.4; packet filter subsystem when TSO support is enabled has been fixed. The TCP bandwidth delay product window limiting algorithm controlled by the &man.sysctl.8; variable net.inet.tcp.inflight.enable is now disabled by default. It has been found that this algorithm is inefficient on a fast network with smaller RTT than 10ms. It had been enabled by default since 5.2-RELEASE, and then had been disabled only if the RTT was lesser than 10ms since 7.0-RELEASE. Pluggable TCP congestion control algorithm modules are planned to be added for the future releases. A bug in &os; TCP Path MTU discovery which could lead to a wrong calculation for an MTU smaller than 256 octets has been fixed. Note that this bug did not affect MTUs equal to or larger than 256 octets. The &os; TCP reassembly implementation has been improved. A long-standing accounting bug affecting SMP systems has been fixed and the net.inet.tcp.reass.maxqlen &man.sysctl.8; variable has been retired in favor of a per-connection dynamic limit based on the receive socket buffer size. &os; receivers now handle packet loss (particularly losses caused by queue overflows) significantly better than before which improves connection throughput. The TCP initial window increase in RFC 3390 which can be controlled by a &man.sysctl.8; variable net.inet.tcp.rfc3390 now reduces the congestion window to the restart window if a TCP connection has been idle for one retransmit timeout or more. For more details, see RFC 5681 Section 4.1. The &man.siftr.4;, Statistical Information For TCP Research (SIFTR) kernel module has been added. This is a facility that logs a range of statistics on active TCP connections to a log file. It provides the ability to make highly granular measurements of TCP connection state, aimed at system administrators, developers and researchers. &os; virtual network stack (vnet) now supports IPv4 multicast routing. The IEEE 802.11s element identifiers have been updated to reflect the final version of the amendment. This update breaks compatibility with older mesh setups but is necessary as the previous IDs are used by another amendment leading to unexpected results when trying to associate with an accesspoint using the affected IDs. Disks and Storage The &man.ahci.4; driver now disables NCQ and PMP support on VIA VT8251 because they are unreliable under load. The &man.ahci.4; driver now uses 15 seconds for device reset timeout instead of 10 seconds because some devices need 10 - 12 seconds to spin up. The &man.arcmsr.4; driver has been updated to version 1.20.00.19. The &man.ada.4; driver now supports a new &man.sysctl.8; variable kern.cam.ada.spindown_shutdown which controls whether or not to spin-down disks when shutting down if the device supports the functionality. The default value is 1. The &man.ata.4; driver now supports limiting initial ATA mode for devices via device hints hint.devname.unit.devN.mode or hint.devname.unit.mode. The valid values are the same as ones supported in the &man.atacontrol.8; and &man.camcontrol.8; utilities. The &man.ata.4; driver now disables cable status check on both controller and device side when the loader tunable hw.ata.ata_dma_check_80pin is 0. The check on controller side was performed regardless of this loader tunable. The &man.ata.4; driver now reports SATA power management capabilities to the &man.CAM.4; layer when is enabled. This allows a device to initiate transitions if controller configured to accept it. This makes hint.ata.N.pm_level=1 mode work. The &man.ata.4; driver has been improved on hotplugging and connection speed reporting support for some Intel SATA controllers including ICH5 and ICH8+ operating in legacy mode. An issue of device detection of Serverworks K2 SATA controllers in the &man.ata.4; has been fixed. A bug in the &man.ata.4; driver that prevented some Silicon Image chipsets from working on big endian systems has been fixed. The &man.gconcat.8; GEOM class now supports kernel crash dump. The dumping is performed to the component where a dump partition begins. A bug in the &man.geli.8; GEOM class on little endian platforms has been fixed. The metadata version for newly created providers has been updated to 4 due to this. Providers with the older versions are fully interoperable with 8.2-RELEASE and later by being treated as ones with the native byte order flag automatically. The &man.geli.8; GEOM class now supports a &man.sysctl.8; variable kern.geom.eli.overwrites. This specifies the number of times on-disk keys should be overwritten when destroying them. The default value is 5. The &man.geli.8; GEOM class has been improved for preventing the same encryption key from being used in 2^20 blocks (sectors). The &man.geli.8; GEOM class now uses XTS-AES mode by default. A &man.sysctl.8; variable kern.geom.eli.debug now allows a value -1. This means turn off any log messages of the &man.geli.8; GEOM class. The &man.mpt.4; driver now supports larger I/O sizes which the device and &man.CAM.4; subsystem can support. This was limited to 64KB, and the number of scatter/gather segments was limited to 33 on platforms with 4K pages. The &man.twa.4; driver has been updated. The version number is 3.80.06.003. File Systems The &man.linprocfs.5; Linux process file system now supports proc/$$/environment. The &os; NFS client now supports a kernel environment variable boot.nfsroot.nfshandlelen. This lets the diskless root file system on boot to use NFS version 3 and the specified file handle length. If this variable is not set, NFS version 2 is used. The ZFS on-disk format has been updated to version 15. The ZFS metaslab code has been updated. This provides a noticeable improvement on write speed, especially on pools with less than 30% of free space. The related OpenSolaris Bug IDs are 6826241, 6869229, 6918420, and 6917066. The ZFS now supports offlining of log devices. The related OpenSolaris Bug IDs are 6599442, 6726045, and 6803605. Performance improvements for the ZFS have been imported from OpenSolaris. They include caching of ACL permission checks, faster handling of &man.stat.2;, mitigation of mutex lock contention. The related OpenSolaris Bug IDs are 6802734, 6844861, 6848431, 6775100, 6827779, 6857433, 6860318, 6865875, 6867395, 6868276, and 6870564. The default value of vfs.zfs.vdev.max_pending has been decreased from 35 to 10 (OpenSolaris Bug ID is 6891731) to improve latency. Various bugs in the ZFS subsystem have been fixed. The related OpenSolaris Bug IDs are: 6328632, 6396518, 6501037, 6504953, 6542860, 6551866, 6572357, 6572376, 6582163, 6586537, 6595194, 6596237, 6604992, 6621164, 6623978, 6633095, 6635482, 6664765, 6674216, 6696242, 6696858, 6702206, 6710376, 6713916, 6717022, 6722540, 6722991, 6737463, 6739487, 6739553, 6740164, 6745863, 6747596, 6747698, 6748436, 6755435, 6757430, 6758107, 6759986, 6759999, 6761100, 6761406, 6764124, 6765294, 6767129, 6769612, 6770866, 6774713, 6774886, 6775697, 6776104, 6776548, 6780491, 6784104, 6784108, 6785914, 6788152, 6788830, 6789318, 6790064, 6790345, 6790687, 6791064, 6791066, 6791071, 6791101, 6792134, 6792139, 6792884, 6793430, 6794136, 6794570, 6794830, 6797109, 6797118, 6798384, 6798878, 6799895, 6800184, 6800942, 6801507, 6801810, 6803343, 6803822, 6804954, 6807339, 6807765, 6809340, 6809683, 6809691, 6810367, 6815592, 6815893, 6816124, 6818183, 6821169, 6821170, 6822816, 6824006, 6824062, 6824968, 6826466, 6826468, 6826469, 6826470, 6826471, 6826472, 6827260, 6830237, 6830541, 6833162, 6833711, 6833999, 6834217, 6836714, 6836768, 6838062, 6838344, 6841321, 6843014, 6843069, 6843235, 6844069, 6844900, 6847229, 6848242, 6856634, 6857012, 6861983, 6862984, 6863610, 6870564, 6880764, 6882227, 6892298, 6898245, 6906110, 6906946, 6939941, 6950219, 6951024, and 6953403. Userland Changes The &man.arp.8; utility has been improved. It now runs faster even when a single interface has a number of aliases. A bug in the &man.b64decode.1; utility that prevented an option from handling arbitrary breaks in a base64 encoded string has been fixed. The &man.calendar.1; utility now supports repeating events which span multiple years, lunar events, and solar events. The &man.dhclient.8; utility now reports a reason for exiting and the 10-second period in which the &man.dhclient.8; ignores routing messages has been changed to start just after dhclient-script starts instead of just after it finished. This change fixes a symptom that &man.dhclient.8; silently exits under a certain condition. Userland support for the &man.dtrace.1; subsystem has been added. This allows inspection of userland software itself and its correlation with the kernel, thus allowing a much better picture of what exactly is going on behind the scenes. The &man.dtruss.1; utility has been added and the libproc library has been updated to support the facility. The &man.du.1; utility now supports a option to display entries that exceeds the value of threshold. If the value is negative, it displays entries with a value less than the absolute value of threshold. The &man.fdisk.8; utility now supports partitions which are provided by &man.gjournal.8; or &man.geli.8; GEOM classes. The &man.gcore.1; utility now supports an flag which forces a full dump of all the segments except for the malformed ones. The &man.geli.8; utility now supports resize subcommand to resize encrypted file systems after growing it. The &man.geli.8; utility now supports suspend and resume subcommands. The suspend subcommand makes &man.geli.8; devices wait for all in-flight I/O requests, suspend new I/O requests, remove all &man.geli.8; sensitive data from the kernel memory (like encryption keys) and will wait for either geli resume or geli detach command. For more information, see &man.geli.8; manual page. The &man.geli.8; utility now checks the metadata provider size strictly. If the check fails, the provider is not attached. A new option can override this behavior. The &man.geli.8; utility now supports and options for loading passphrase from a file. The gethost*(), getnet*(), and getproto*() functions now set the errno to ERANGE and the NSS backend terminates with NS_RETURN when the result buffer size is too small. The &man.gpart.8; utility now supports a resize command to resize partitions for all schemes but EBR. The &man.gpart.8; utility now supports backup and restore subcommands to backup partition tables and restore them. The &man.gpart.8; utility now handles given geom/provider names with and without /dev/ prefix. The &man.gpart.8; utility now supports an option for the destroy subcommand. This option forces destroying of the partition table even if it is not empty. The &man.gpart.8; utility now supports a recover subcommand for GPT partition tables. A corrupted GPT is now marked when the following three types of corruption: Primary GPT header or table is corrupted. Secondary GPT header or table is corrupted. Secondary GPT header is not located at the last LBA. Changes to the corrupted GPT table are not allowed except for destroy and recover subcommands. The &man.gpart.8; utility now supports GPT_ENT_ATTR_BOOTME, GPT_ENT_ATTR_BOOTONCE, and GPT_ENT_ATTR_BOOTFAILED attributes in GPT. The attribute keywords in the command line are bootme, bootonce, and bootfailed respectively. An issue in the &man.newfs.8; utility has been fixed. A UFS1 file system created with 64KB blocksize was incorrectly recognized as one with a broken superblock. This is because the &os; kernel checks a partition first for a UFS2 superblock at 64KB offset while it is possible that a UFS1 file systems with 64KB blocksize has an alternative superblock at the same location. For example, a file system created by newfs -U -O 1 -b 65536 -f 8192 could lead to this symptom. The &man.hastd.8; utility now supports SIGHUP for reloading the configuration file. When SIGTERM or SIGINT is received, the worker processes terminate. The &man.ifconfig.8; utility now check an invalid CIDR subnet notation more strictly. It wrongly accepted 10.0.0.1/10.0.0.1 as 10.0.0.1/10. An accuracy issue in the &man.jn.3; and &man.jnf.3; functions in libm has been fixed. Incorrect behaviors in stuttering sequences and reverse ranges in the &man.jot.1; utility have been fixed. The libarchive library and &man.tar.1; utility now support LZMA (Lempel-Ziv-Markov chain-Algorithm) compression format. The &man.tar.1; utility now supports a blocksize which is up to 8192 (4MB) in the option. A bug in the &man.lpr.1; utility that prevented it from working with some files on a ZFS file system has been fixed. The option in the &man.mount.8; utility now displays the rw mount option correctly as in the &man.fstab.5; format. The &man.ncal.1; utility has been updated. The option has been replaced with and . Options to show previous, current and next month, and to show months after current month have been added. The option now prints only the month, not the whole year. The &man.newsyslog.8; utility now supports an option to override the default &man.syslogd.8; PID file. The &man.newsyslog.8; utility now supports a special log file name <include> for processing file inclusion. Globbing in the file name and circular dependency detection are supported. For more details, see the &man.newsyslog.conf.5; manual page. The &man.ntpd.8; utility is now compiled with shared memory reference clock driver. For example, GPS devices can be used as source of precise time via astro/gpsd in the Ports Collection. An off-by-one error in the &man.pax.1; utility when ustar file name is too long has been fixed. The &man.pkill.1; utility now supports an option like the &man.kill.1; utility does. The &man.pmcstat.8; utility now supports a file and a network socket as a top source. A new option specifies to send log output to filename, and another new option specifies to receive events from filename. For a socket, the filename is in a form of ipaddr:port. This allows top monitoring over TCP on a system with no local symbols, for example. The &man.pom.6; utility now supports a flag to print only the percentage. The &man.powerd.8; utility now supports an and to control the minimum and maximum frequency, respectively. The &man.ruptime.1; utility now displays hostnames longer than 12 characters. A behavior of the &man.sh.1; program when an option is specified has been changed. The special parameters $@ and $* no longer cause an error when there are no positional parameters. A bug in the &man.sh.1; program has been fixed. A SIGINT signal is now passed through from a child process if the shell is interactive and the job control is enabled. For example, aborting &man.sleep.1; command by Ctrl-C no longer display ok in the following command line: &prompt.user; sleep 5; echo ok The &man.sh.1; program now supports a bg command consisting solely of redirections. For example: &prompt.user; < /dev/null & The &man.sleep.1; utility now supports the SIGINFO signal and reports the specified sleep time and the remaining time. The &man.tftp.1; and &man.tftpd.8; utilities have been improved for better interoperability and they now support RFC 1350, 2347, 2348, 2349, and 3617. A bug in [=]=] equivalent class handling in the &man.tr.1; utility has been fixed. A closing bracket immediately after [= was incorrectly treated as special. The &man.uname.1; utility now supports an flag as a synonym for the flag for compatibility with other systems. Bugs in &man.vi.1; utility have been fixed. They include handling of ^@ and ^C in insert mode when reading an ex command. The &man.watchdogd.8; program now uses MADV_PROTECT memory flag to protect itself from being terminated by the &os; kernel when available memory becomes short. This kind of process termination happens in a swap-intensive workload. The set sharenfs command in the &man.zfs.8; utility now supports option. <filename>/etc/periodic</filename> Scripts A periodic script for zfs scrub has been added. For more details, see &man.periodic.conf.5; manual page. A periodic script which can be used to find installed ports' files with mismatched checksum has been added. For more details, see the &man.periodic.conf.5; manual page. Contributed Software The ACPI-CA has been updated to 20101013. The &man.ee.1; program has been updated to version 1.5.2. ISC BIND has been updated to version 9.6-ESV-R3. netcat has been updated to version 4.8. OpenSSL has been updated to version 0.9.8q. sendmail has been updated to version 8.14.9. The timezone database has been updated to the tzdata2010o release. The xz has been updated from snapshot as of 12 April 2010 to 5.0.0 release Ports/Packages Collection Infrastructure The &man.pkg.create.1; utility now supports LZMA (xz) compression. Note that the default is still bzip2. Release Engineering and Integration The &man.sysinstall.8; utility now uses the following numbers for default and minimum partition sizes: 1GB for /, 4GB for /var, and 1GB for /tmp. The &man.sysinstall.8; utility now attempts to enable &man.getty.8; on a serial port when no VGA card is detected on the system. The supported version of the GNOME desktop environment (x11/gnome2) has been updated to 2.32.1. The supported version of the KDE desktop environment (x11/kde4) has been updated to 4.5.5. Upgrading from previous releases of &os; Upgrades between RELEASE versions (and snapshots of the various security branches) are supported using the &man.freebsd-update.8; utility. The binary upgrade procedure will update unmodified userland utilities, as well as unmodified GENERIC kernel distributed as a part of an official &os; release. The &man.freebsd-update.8; utility requires that the host being upgraded has Internet connectivity. An older form of binary upgrade is supported through the Upgrade option from the main &man.sysinstall.8; menu on CDROM distribution media. This type of binary upgrade may be useful on non-&arch.i386;, non-&arch.amd64; machines or on systems with no Internet connectivity. Source-based upgrades (those based on recompiling the &os; base system from source code) from previous versions are supported, according to the instructions in /usr/src/UPDATING. Upgrading &os; should, of course, only be attempted after backing up all data and configuration files.
Index: stable/8/release/doc/share/xml/errata.xml =================================================================== --- stable/8/release/doc/share/xml/errata.xml (nonexistent) +++ stable/8/release/doc/share/xml/errata.xml (revision 278272) @@ -0,0 +1,116 @@ + + + + + + + + + + Errata + Date + Topic + + + + + + FreeBSD-EN-13:01.fxp + 28 June 2013 + Fixed a problem where &man.dhclient.8; would + infinitely try to intialize &man.fxp.4; + + + + FreeBSD-EN-13:02.vtnet + 28 June 2013 + Fixed a problem frames sent to additional MAC + addresses are not forwarded to the &man.vtnet.4; + interface + + + + FreeBSD-EN-13:04.freebsd-update + 26 October 2013 + Multiple fixes + + + + FreeBSD-EN-13:05.freebsd-update + 28 November 2013 + Fix INDEX generation + + + + FreeBSD-EN-14:01.random + 14 January 2014 + Disable hardware RNGs by default + + + + FreeBSD-EN-14:02.mmap + 14 January 2014 + Fix incorrect coalescing of stack + entry + + + + FreeBSD-EN-14:03.pkg + 15 May 2014 + Add pkg bootstrapping, configuration and public + keys + + + + FreeBSD-EN-14:04.kldxref + 15 May 2014 + Improve build repeatability for + &man.kldxref.8; + + + + FreeBSD-EN-14:06.exec + 3 June 2014 + Fix triple-fault when executing from a threaded + process + + + + FreeBSD-EN-14:08.heimdal + 24 June 2014 + Fix gss_pseudo_random() + interoperability issue + + + + FreeBSD-EN-14:09.jail + 8 July 2014 + Fix jail fails to start if + WITHOUT_INET/WITHOUT_INET6 is use + + + + FreeBSD-EN-14:10.tzdata + 21 October 2014 + Time zone data file update + + + + FreeBSD-EN-14:12.zfs + 4 November 2014 + Fix NFSv4 and ZFS cache consistency + issue + + + + FreeBSD-EN-14:13.freebsd-update + 23 December 2014 + Fix directory deletion issue + + + + Property changes on: stable/8/release/doc/share/xml/errata.xml ___________________________________________________________________ Added: svn:eol-style ## -0,0 +1 ## +native \ No newline at end of property Added: svn:keywords ## -0,0 +1 ## +FreeBSD=%H \ No newline at end of property Added: svn:mime-type ## -0,0 +1 ## +text/xml \ No newline at end of property Index: stable/8/release/doc/share/xml/security.xml =================================================================== --- stable/8/release/doc/share/xml/security.xml (nonexistent) +++ stable/8/release/doc/share/xml/security.xml (revision 278272) @@ -0,0 +1,221 @@ + + + + + + + + + + Advisory + Date + Topic + + + + + + FreeBSD-SA-13:07.bind + 26 July 2013 + Denial of Service vulnerability in + &man.named.8; + + + + FreeBSD-SA-13:09.ip_multicast + 21 August 2013 + Integer overflow in computing the size of + a temporary buffer can result in a buffer which is too + small for the requested operation + + + + FreeBSD-SA-13:10.sctp + 21 August 2013 + Fix a bug that could lead to kernel memory + disclosure with SCTP state cookie + + + + FreeBSD-SA-13:12.ifioctl + 10 September 2013 + In IPv6 and NetATM, stop + SIOCSIFADDR, + SIOCSIFBRDADDR, + SIOCSIFDSTADDR and + SIOCSIFNETMASK at the socket layer + rather than pass them on to the link layer without + validation or credential checks + + + + FreeBSD-SA-13:13.nullfs + 10 September 2013 + Prevent cross-mount hardlinks between different + nullfs mounts of the same underlying + filesystem + + + + FreeBSD-SA-14:01.bsnmpd + 14 January 2014 + bsnmpd remote denial of service + vulnerability + + + + FreeBSD-SA-14:02.ntpd + 14 January 2014 + ntpd distributed reflection Denial of Service + vulnerability + + + + FreeBSD-SA-14:04.bind + 14 January 2014 + BIND remote denial of service + vulnerability + + + + FreeBSD-SA-14:05.nfsserver + 8 April 2014 + NFS deadlock vulnerability + + + + FreeBSD-SA-14:06.openssl + 8 April 2014 + ECDSA Cache Side-channel Attack in + OpenSSL + + + + FreeBSD-SA-14:08.tcp + 30 April 2014 + TCP reassembly vulnerability + + + + FreeBSD-SA-14:11.sendmail + 5 June 2014 + sendmail improper close-on-exec flag + handling + + + + FreeBSD-SA-14:12.ktrace + 5 June 2014 + ktrace memory disclosure + + + + FreeBSD-SA-14:14.openssl + 5 June 2014 + OpenSSL multiple vulnerabilities + + + + FreeBSD-SA-14:16.file + 5 June 2014 + Multiple vulnerabilities in &man.file.1; and + &man.libmagic.3; + + + + FreeBSD-SA-14:17.kmem + 8 July 2014 + kernel memory disclosure in control message and + SCTP notifications + + + + FreeBSD-SA-14:18.openssl + 9 September 2014 + Multiple vulnerabilities in + OpenSSL + + + + FreeBSD-SA-14:19.tcp + 16 September 2014 + Denial of Service in TCP packet + processing + + + + FreeBSD-SA-14:21.routed + 21 October 2014 + &man.routed.8; denial of service + vulnerability + + + + FreeBSD-SA-14:23.openssl + 21 October 2014 + Multiple vulnerabilities in + OpenSSL + + + + FreeBSD-SA-14:25.setlogin + 4 November 2014 + kernel stack disclosure in &man.setlogin.2; and + &man.getlogin.2; + + + + FreeBSD-SA-14:26.ftp + 4 November 2014 + Remote command execution in + &man.ftp.1; + + + + FreeBSD-SA-14:28.file + 10 December 2014 + Multiple vulnerabilities in &man.file.1; and + &man.libmagic.3; + + + + FreeBSD-SA-14:29.bind + 10 December 2014 + BIND remote denial of service + vulnerability + + + + FreeBSD-SA-14:31.ntp + 23 December 2014 + Multiple vulnerabilities in NTP + suite + + + + FreeBSD-SA-15:01.ntp + 14 January 2015 + Multiple vulnerabilities in + OpenSSL + + + + FreeBSD-SA-15:02.kmem + 27 January 2015 + Fix SCTP SCTP_SS_VALUE kernel memory corruption + and disclosure vulnerability + + + + FreeBSD-SA-15:03.sctp + 27 January 2015 + Fix SCTP stream reset + vulnerability + + + + Property changes on: stable/8/release/doc/share/xml/security.xml ___________________________________________________________________ Added: svn:eol-style ## -0,0 +1 ## +native \ No newline at end of property Added: svn:keywords ## -0,0 +1 ## +FreeBSD=%H \ No newline at end of property Added: svn:mime-type ## -0,0 +1 ## +text/xml \ No newline at end of property