Pledge changes in 7.9-beta

David Leadbeater (dgl@)
posted to ports@ a message,
entitled
Pledge changes in 7.9-beta,
which explains the consequences for porters
of the recent pledge(2)/unveil(2) changes in -current (and, to some extent, 7.8).
Whilst targeted at porters, it…

PF queues break the 4 Gbps barrier

OpenBSD’s
PF
packet filter has long supported HFSC traffic shaping
with the queue
rules in
pf.conf(5).
However, an internal 32-bit limitation in the HFSC
service curve structure (struct hfsc_sc) meant that bandwidth values
were silently capped…

OpenBSD -current moves to 7.9-beta

It’s that time of the year again.
With the following
commit,
Theo de Raadt (deraadt@)
changed the version of the OpenBSD development branch
to 7.9-beta:

CVSROOT: /cvs
Module name: src
Changes by: deraadt@cvs.openbsd.org 2026/03/10 20:27:20…

The Book of PF, 4th Edition Spotted in the Wild

You may have heard already that a
fourth edition
of
The Book of PF was on the way.

It is now shipping, and when author and
undeadly.org
co-editor Peter Hansteen finally got his author copies,
he wrote a blog post titled
The Book of PF, 4th E…

tmppath promise removed from pledge(2) in -current

A long standing and somewhat odd conflict between two OpenBSD security mechanisms, pledge(2) and unveil(2) has been resolved by eliminating the tmppath promise from what pledge(2) offers.

The commit by Theo de Raadt (deraadt@) comes with an explana…

Another subprocess for vmd(8)

Dave Voutila (dv@)
has continued his work on moving
vmd(8)
to a multi-process model.
(Undeadly
first reported
on this in 2023.)
This time the
virtio scsi device has been
converted to a subprocess:

CVSROOT: /cvs
Module name: src
Changes…

bsd.rd breakdown

Every OpenBSD admin has booted bsd.rd at least once — to install, upgrade, or rescue a broken system. But few people stop to look at what’s actually inside that file.

In this article over at the OpenBSD Jumpstart site, they take a look at just t…

pf: make af-to less magical

Seasoned networkers will know to tell you that legacy IPv4 and modern IPv6 are, in fact, not directly compatible, and shipping traffic between IPv4 and IPv6 network requires address family translation.

On our favorite operating system and its sibl…

MAXCPUS on OpenBSD/amd64-current is now 255

With these two commits, Mike Larkin (mlarkin@) set the stage for, and next up, bumped the maximum number of processors supported on OpenBSD/amd64 from 64 to 255.

The first commit message reads,

List: openbsd-cvs
Subject: CVS: cvs.o…

rpki-client 9.7 released

The rkpi-client project has made a new release, rkpi-client 9-7, available with important new features and bug fixes.

The announcement reads,

Subject: rpki-client 9.7 released
From: Sebastian Benoit <benno () openbsd ! org>