OpenBSD Upgrade Guide: 6.8 to 6.9

Upgrades are only supported from one release to the release immediately following.
Read through and understand this process before attempting it. For critical or physically remote machines, test it on an identical, local system first.

Before using any upgrade method

Check available disk space in /usr. Verify that the /usr partition has a size of at least 1.1G. With less space the upgrade may fail and you should consider reinstalling the system instead.
Check pf.conf(5). pf(4) and pfctl(8) are now stricter about validating rules which use port ranges.
The following show incorrect port ranges that were previously accepted:
```
  port 2004:2000
  port 2004 >< 2000
  port 2004 <> 2000 # range should be low-high
  port 2000 >< 2000 # range should not be a single port
```
If upgrading without console access, check and correct ranges before upgrading.
Read configuration and syntax changes and the package upgrade instructions. There were several configuration changes and changes in packages that may require planning before starting the upgrade.

Upgrade Methods

Unattended Upgrade: The easiest method is an unattended upgrade using sysupgrade(8). The program will download all install the sets, verify their signatures, and reboot to perform the upgrade automatically. Once the unattended upgrade has completed, continue below.
Interactive Upgrade: If you insist on leaving out some of the install sets, you will want to perform an interactive upgrade. (sysupgrade upgrades with all install sets.)
Manual Upgrade: The final option is using the manual upgrade process. (This is not recommended as it is the most error-prone method.)

Interactive Upgrade

Get and verify bsd.rd. Download the ramdisk kernel and the cryptographically-signed checksum file for your architecture.

bsd.rd

[alpha] [amd64] [arm64] [armv7] [hppa] [i386] [landisk] [loongson] [luna88k] [macppc] [octeon] [sparc64]

SHA256.sig

[alpha] [amd64] [arm64] [armv7] [hppa] [i386] [landisk] [loongson] [luna88k] [macppc] [octeon] [sparc64]

Verify bsd.rd and SHA256.sig using signify(1):
```
$ signify -C -p /etc/signify/openbsd-69-base.pub -x SHA256.sig bsd.rd
Signature Verified
bsd.rd: OK
```
Next, boot from the install kernel, bsd.rd, retrieved in the previous step. Place it in the root of your filesystem and instruct the boot loader to boot this kernel. Once this kernel is booted, choose the (U)pgrade option and follow the prompts.
After the filesets have been installed, the system will reboot with the upgraded kernel. Now continue with the next step:

After the Upgrade

After upgrading the sets, the system will reboot with the upgraded kernel and run sysmerge(8) during boot. In some cases, configuration files cannot be modified automatically. Run

 # sysmerge

to check and perform these configuration changes.

Next remove the old files. Finish up by upgrading the packages using pkg_add -u.

You may wish to check the errata page for any post-release fixes.

Manual Upgrade (without the install kernel)

This is NOT the recommended process. Use the unattended or interactive upgrade methods if at all possible!

Sometimes, you need to perform an upgrade of a machine for which the normal unattended or interactive upgrade process is not possible.

Preparation

Place install files in a good location. Make sure you have sufficient space! Running out of space on a remote upgrade could be...unfortunate. Note that using softdeps can exacerbate the situation as deleted and overwritten files do not release their space immediately. Consider disabling the softdep mount option in /etc/fstab and rebooting before undertaking a manual upgrade. Having at least 500MB free on /usr would be recommended.
Become root. While using doas(1) before each command is generally a good practice, the command will likely be broken by the last steps, so you should become root before starting this process. It might be good to verify your access to root using a method other than doas at this point, i.e., direct login or using su(1).
Stop and/or disable any appropriate applications. During this process, all the userland applications will be replaced but may not be runnable, and strange things may happen as a result. You may also have issues with DNS resolution during the first reboot, so PF rules and NFS mounts dependent upon DNS may cause boot-up problems. There may be other applications which you wish to keep from running immediately after the upgrade; stop and disable them as well.
Install new boot blocks. This should actually be done at the end of any upgrade. If this has been neglected, then failure to do this now may break serial console or other things, depending on your platform. Use installboot(8), assuming sd0 is your boot disk:
```
# installboot sd0
```

Upgrading manually

Install new kernels. The extra steps for copying over the primary kernel are done to ensure that there is always a valid kernel on the disk.

If using the multiprocessor kernel:

# cd /usr/rel    # where you put the release files
# ln -f /bsd /obsd && cp bsd.mp /nbsd && mv /nbsd /bsd
# cp bsd.rd /
# cp bsd /bsd.sp

If using the single processor kernel:

# cd /usr/rel    # where you put the release files
# ln -f /bsd /obsd && cp bsd /nbsd && mv /nbsd /bsd
# cp bsd.rd bsd.mp /    # may give a harmless warning

Enable KARL. Store the kernel's checksum:
```
# sha256 -h /var/db/kernel.SHA256 /bsd 
```

Install new userland. Save a copy of reboot(8), extract and install the release tarballs, reboot. Install base69.tgz last, because the new base system, in particular tar(1), gzip(1) and reboot(8), will not work with the old kernel. Either untar the needed filesets manually:

# cp /sbin/reboot /sbin/oreboot
# tar -C / -xzphf xshare69.tgz
# tar -C / -xzphf xserv69.tgz
# tar -C / -xzphf xfont69.tgz
# tar -C / -xzphf xbase69.tgz
# tar -C / -xzphf man69.tgz
# tar -C / -xzphf game69.tgz
# tar -C / -xzphf comp69.tgz
# tar -C / -xzphf base69.tgz    # Install last!
# /sbin/oreboot

or, if you use ksh(1), you can do:

# cp /sbin/reboot /sbin/oreboot
# for _f in [!b]*69.tgz base69.tgz; do tar -C / -xzphf "$_f" || break; done
# /sbin/oreboot

Note that tar(1) can expand only one archive per invocation, so a simple glob won't work.

After reboot, update /dev. Run MAKEDEV(8):
```
# cd /dev
# ./MAKEDEV all
```
Update the boot loader. Still assuming sd0 is your boot disk:
```
# installboot sd0
```
Update system configuration files. Run sysmerge(8):
```
# sysmerge
```
Update firmware. There may be new firmware for your system. Update it with fw_update(1):
```
# fw_update
```
Finish up. Review the console output from boot (using dmesg -s) and correct any failures as necessary. All the steps following configuration changes below also apply to manual upgrades. Finally, remove /sbin/oreboot and update packages: pkg_add -u. Reboot once more to make sure you use the newest firmware files and run on your own kernel generated by KARL.

Configuration and syntax changes

hostname.if(5). RFC 8981 changed the IPv6 terminology from privacy to temporary addresses. autoconfprivacy in hostname.if(5) files should be changed to temporary.
iked.conf(5). New keywords have been introduced to iked.conf to simplify configuration when using "config address".
Previously, when either "to 0.0.0.0" or "to 0.0.0.0/0" were used, they would be replaced with the peer's assigned address when creating flows. "to dynamic" has been introduced to make the configuration syntax clearer.
"to 0.0.0.0" works as before but can be updated to the new syntax if wanted.
"to 0.0.0.0/0" will now be treated literally; if the old behaviour is desired one must change to "to dynamic".
pf(4) In previous releases, even if forwarding was not configured, pf(4) allowed forwarding of packets with af-to. To continue using NAT64 one has to set these sysctl:
```
    # sysctl net.inet.ip.forwarding=1
    # sysctl net.inet6.ip6.forwarding=1
```

pf.conf(5). Syntax for PF's routing options (route-to, reply-to, dup-to) has changed. If using these features without console access, review /etc/pf.conf before updating; the previous syntax will be rejected by pfctl(8).

These options previously accepted an IP address and network interface, for example:

      # address is directly reachable via the interfaces (showing both accepted formats)
      pass out proto tcp to port {80 443} route-to 192.0.2.1@ix0
      pass out proto udp to port 53 dup-to (em2 192.168.2.99)

      # using placeholder address to signify remote address on a point-to-point link
      pass in on pppoe1 reply-to 0.0.0.1@pppoe1

They now take only an IP address, and perform a route lookup to determine the interface. The above examples can now be written like so:

    # address is directly reachable via the interfaces
    pass out proto tcp to port {80 443} route-to 192.0.2.1
    pass out proto udp to port 53 dup-to 192.168.2.99

    # using :peer to use the remote address on a point-to-point link
    # using (...) to track changes dynamically
    pass in on pppoe1 reply-to (pppoe1:peer)

Alternatively, for some configurations using these features, it may be simpler to use multiple route tables instead (using ifconfig's rdomain and pf.conf's rtable features).

smtpd.conf(5) As smtpd(8) has been ported to libtls, the way SNI works has changed:
- The set of certificates for a tls listener must be explicitly defined by using the pki listener option multiple times:
```
    pki "mail.example.com" cert "/etc/ssl/mail.example.com.crt"
    pki "mail.example.com" key "/etc/ssl/private/mail.example.com.key"

    pki "mail.example.org" cert "/etc/ssl/mail.example.org.crt"
    pki "mail.example.org" key "/etc/ssl/private/mail.example.org.key"

    listen on egress tls pki "mail.example.com" \
                         pki "mail.example.org"
```
- The certificate to use is now selected by looking at the names contained in the certificates defined for the listener. The label of the pki entry itself is not relevant anymore.
Configurations that use only a single certificate do not need updating.
snmpd.conf(5) Cleanup in snmpd(8)'s traphandler code led to the following changes:
- To define a trap handle, explicitly enable notify functionality on the listen socket.
```
    listen on 127.0.0.1
```
  must become
```
    listen on 127.0.0.1
    listen on 127.0.0.1 notify
```
- Incoming trap packets are now checked against trap community.
- traphandler_v1translate now fully complies with RFC3584 section 3.1. Handlers for generic-trap < 6 need to modify their trap handle scripts and potentially add trap handle statements in accordance with RFC3584 section 3.1 bullet (3).
- Running snmpd(8) without -N now prints iso.org.dod.internet.mgmt.mib-2.system.sysUpTime.0 (first varbind) in accordance with its internal MIB definitions (iso.org.dod.internet.mgmt.mib_2.system.sysUpTime.0).
- Running snmpd(8) with -N now prints iso.org.dod.internet.mgmt.mib-2.system.sysUpTime.0 (first varbind) numerically (.1.3.6.1.2.1.1.3.0).
- Running snmpd(8) with -N now prints iso.org.dod.internet.snmpV2.snmpModules.snmpMIB.snmpMIBObjects.snmpTrap.snmpTrapOID.0 (second varbind) numerically (1.3.6.1.6.3.1.1.4.1.0).
video(4). Similar to how audio recording is handled, recording has been disabled by default in video(4). It may be reenabled like this:
```
    # sysctl kern.video.record=1 # enable at runtime
    # echo kern.video.record=1 >> /etc/sysctl.conf # set at boot
```

Files to remove

Perl has been updated to 5.32.1 and some files are no longer included and can be removed.

  # rm -rf /usr/bin/podselect \
          /usr/lib/libperl.so.20.0 \
          /usr/libdata/perl5/*/CORE/dquote_inline.h \
          /usr/libdata/perl5/*/Tie \
          /usr/libdata/perl5/*/auto/Tie \
          /usr/libdata/perl5/Pod/Find.pm \
          /usr/libdata/perl5/Pod/InputObjects.pm \
          /usr/libdata/perl5/Pod/ParseUtils.pm \
          /usr/libdata/perl5/Pod/Parser.pm \
          /usr/libdata/perl5/Pod/PlainText.pm \
          /usr/libdata/perl5/Pod/Select.pm \
          /usr/libdata/perl5/pod/perlce.pod \
          /usr/libdata/perl5/unicore/Heavy.pl \
          /usr/libdata/perl5/unicore/lib/Lb/EB.pl \
          /usr/libdata/perl5/unicore/lib/Perl/_PerlNon.pl \
          /usr/libdata/perl5/unicore/lib/Sc/Armn.pl \
          /usr/libdata/perl5/utf8_heavy.pl \
          /usr/share/man/man1/podselect.1 \
          /usr/share/man/man3p/Pod::Find.3p \
          /usr/share/man/man3p/Pod::InputObjects.3p \
          /usr/share/man/man3p/Pod::ParseUtils.3p \
          /usr/share/man/man3p/Pod::Parser.3p \
          /usr/share/man/man3p/Pod::PlainText.3p \
          /usr/share/man/man3p/Pod::Select.3p

A more detailed cleanup can be done with the aid of the sysclean package.

Special packages

databases/postgresql. There was a major update to PostgreSQL 13.2. Use pg_upgrade as described in the postgresql-server pkg-readme or do a dump/restore.
games/multimc. With the import of games/lwjgl3 multimc has been updated to be able to play the latest versions of Minecraft. To play legacy versions of Minecraft 1.12.2 and before, see the pkg-readme or use the minecraft package.
security/yubiserve. The "yubiserve" package is unmaintained upstream and requires an end-of-life version of Python. This has been replaced with "yubikeyedup". While it is broadly compatible with the most common use of yubiserve it has its limits: it supports only sqlite3 (using the same schema as before) not other databases, and it only supports HTTP internally, if you require HTTPS then you will need to use a proxy (e.g. relayd or nginx). It no longer uses a configuration file, only command line arguments.
www/rt. The update to 5.0.0 moves the default config directory from /etc/rt3 to /etc/rt. Make sure to move all the modified configuration files to the new path.

[FAQ Index] | [6.7 -> 6.8] [6.9 -> 7.0]

$OpenBSD: upgrade69.html,v 1.7 2024/04/20 22:10:39 bentley Exp $