OpenBSD Now! @openbsdnow@bsd.network

Consider two OpenBSD PF configurations:

pf1.conf, where SSH blocked by default, but internal LAN traffic is allowed:

block in on em0 proto tcp to port 22
pass in quick on em0 proto tcp from 192.168.0.0/16 to any

and updated pf2.conf, where someone added quick to the blocking rule "for safety's sake":

block in quick on em0 proto tcp to port 22
pass in quick on em0 proto tcp from 192.168.0.0/16 to any

quick was added to a broad block rule, silently shadowing the subsequent quick pass rule. Both are quick rules, both are present, and the change consists of just one word. A reviewer might reason: "The pass rule still has quick, so LAN traffic should still go through." However, among quick rules, the "first-match-wins" principle applies, not "last-match-wins": the block in quick rule now matches LAN traffic before the quick pass rule and shadows it. "Last-match-wins" only applies to non-quick rules. Visually, nothing appears broken, yet the behavior has changed.

And proofwall detect this:

$ ./proofwall diff -n 2 pf1.conf pf2.conf
DIFFERENT: rulesets are NOT semantically equivalent. Regressions (2): pass in A, block in B:
- 192.168.0.0:0 -> 0.0.0.0:22 proto=tcp flags=0x00 iface="em0" dir=in
- 192.168.0.0:0 -> 0.0.0.0:22 proto=tcp flags=0xff iface="em0" dir=in

Rule issues (1):
[B] line 2: redundant rule (removing it changes nothing): pass in quick on em0 proto tcp from 192.168.0.0/16 to any

This is interpreted as follows: a regression specifically for 192.168.0.0/16 -> tcp/22 (traffic that previously passed is now blocked), while the pass ... quick rule in the second config has become redundant - its effect is completely overridden by an earlier block quick rule.

OpenBSD 7.9 released

Release notes: https://www.openbsd.org/79.html
Announce: https://marc.info/?l=openbsd-announce&m=177919671915512&w=2

#release

OpenBSD Errata: October 7, 2026 (isakmpd xserver expat wsdisplay)

Errata patches for isakmpd, X11 server, libexpat and kernel wscons have been released for OpenBSD 7.8 and 7.9.

Binary updates for the amd64, arm64 and i386 platform are available via the syspatch utility. Source code patches can be found on the
respective errata page:

• https://www.openbsd.org/errata78.html
• https://www.openbsd.org/errata79.html

#errata

Notable changes in this release include:

• enabling the hybrid post-quantum ssh-mldsa44-ed25519 signature algorithm
• addition of a -p option for sftp's lmkdir/mkdir commands
• the scp -R option, which allows copies between two remote hosts, is being deprecated due to security risks; the option will be ignored in the future

LibreSSL 4.2.2 and 4.3.3 released

https://marc.info/?l=openbsd-announce&m=179124712212854&w=2

#release

• sshd(8): On OS X SDK >= 27, sandboxing is no longer supported as the API we depended upon has been removed and no obvious alternative provided.

Recently the OpenSSH team have received a large number of security bug reports, many of which are findings from AI models or made with AI assistance. While many AI reports are determined not to have security impact when considered in the context of a realistic threat model, we very much welcome these reports, especially when combined with human triage, analysis, test-cases and particularly when accompanied by proposed fixes.

We have seen a number of cases where a security bug identified by AI tools is subsequently independently discovered by a different researcher. This suggests that adversaries who do not report bugs to OSS projects are likely to be able to discover these bugs too. Given this, the OpenSSH team will, for now, be making more frequent releases to get bugfixes into users' hands more quickly rather than batching them until the next planned release.

OpenSSH 10.6 was released

https://www.openssh.org/txt/release-10.6

#release

Un-hanging the HP Envy 17-DA0013dx for OpenBSD

https://darwinsys.com/blog/20260925-hp-envy-17/

Native Mac man page editor with syntax coloring, mandoc syntax checking & live preview.

https://github.com/sveinbjornt/ManDrake

(this can be easily replaced by vim, tmux and mandoc)

"On Random Numbers" - an RFC draft written by Damien Miller and Rich Salz.

https://www.ietf.org/archive/id/draft-rsalz-4086bis-00.txt

Input devices on OpenBSD for console, X11 and Wayland - Matthieu Herrb

Slides: https://www.openbsd.org/papers/eurobsdcon2026-matthieu-input.pdf

Video: https://exquisite.tube/w/iMjFGHMDpVGg4gk41ZVWvQ

This talk will present the current state of the input device "stack" on OpenBSD, and discuss some ideas for upcoming changes in order to get the console, X.Org and Wayland applications the best possible support.

There are challenges with the different event encoding models, hot-plugging devices and handling their suspend and resume life cycles.

Rafael Sadowski (@sizeofvoid) told about his recent work on httpd(8) and relayd(8).

Headers Up! What's New in httpd and relayd

https://rsadowski.de/posts/2026/update-relayd-and-httpd/

Unix Manpages, Then and Now - Kristaps Dzonsons

https://exquisite.tube/w/outXbyYKigdtPuz83gRbVq

#EuroBSDCon26 #eurobsdcon

OpenNTPD - 20 years and a few milliseconds later - Henning Brauer

https://exquisite.tube/w/6bRewfPFTZ8BiieG1E2N7U

#EuroBSDCon26 #EuroBSDCon

From Report to Patch, the OpenBSD Errata Process -
Alexander Bluhm

Video: https://exquisite.tube/w/sDafcZjdEQpR83aogPSx9j

Slides: https://www.openbsd.org/papers/eurobsdcon2026-bluhm-errata.pdf

#EuroBSDCon2026 #EuroBSDCon

OpenBSD formal driver verification with SeL4

Paper: https://arxiv.org/pdf/2311.03585v1
Source: gitlab.com/system.verification/openbsd-formal-driver-verification-with-sel4