OpenBSD: Innovations

This is a list of software and ideas developed or maintained by the OpenBSD project, sorted in order of approximate introduction. Some of them are explained in detail in our research papers.
ipsec(4): Started by John Ioannidis, Angelos D. Keromytis, Niels Provos, and Niklas Hallqvist, imported February 20, 1997. OpenBSD was the first free operating system to provide an IPSec stack.
inet6(4): First complete integration and adoption of IPv6 led by "Itojun" (Dr. Junichiro Hagino) [WIDE/KAME], Craig Metz [NRL], and Angelos D. Keromytis starting Jan 6, 1999. Almost fully operational Jun 6, 1999 during the first OpenBSD hackathon. OpenBSD 2.7.
Privilege separation: First implemented by Niels Provos and Markus Friedl in OpenSSH in March 2002, released with OpenBSD 3.2. The concept is now used in many OpenBSD programs, for example bgpd(8), dhclient(8), dhcpd(8), dvmrpd(8), eigrpd(8), file(1), httpd(8), iked(8), ldapd(8), ldpd(8), mountd(8), npppd(8), ntpd(8), ospfd(8), ospf6d(8), pflogd(8), radiusd(8), relayd(8), ripd(8), script(1), smtpd(8), syslogd(8), tcpdump(8), tmux(1), xconsole(1), xdm(1), Xserver(1), ypldap(8), pkg_add(1), etc.
Privilege revocation: Related to the work on privilege separation, some programs were refactored to drop privileges while holding onto a tricky resource such as a raw socket, reserved port, or modification-locked bpf(4) descriptor, for example ping(8), traceroute(8), etc.
Stack protector: Developed since 2001 as "propolice" by Hiroaki Etoh. Integrated, and implemented for additional hardware platforms, by Federico G. Schwindt, Miod Vallat and Theo de Raadt. OpenBSD 3.3 was the first operating system to enable it systemwide by default.
W^X: First used for sparc, sparc64, alpha, and hppa in OpenBSD 3.3. Strictly enforced by default since OpenBSD 6.0: a program can only violate it if the executable is marked with PT_OPENBSD_WXNEEDED and it is located on a filesystem mounted with the wxallowed mount(8) option.
GOT and PLT protection by ld.so: first done as part of the W^X work in OpenBSD 3.3, by Dale Rahn and Theo de Raadt. The GOT and PLT regions are read-only outside of ld.so itself. Extended to the .init/.fini sections (constructors and destructors) in OpenBSD 3.4.
ASLR: OpenBSD 3.4 was the first widely used operating system to provide it by default.
gcc-local(1) __attribute__((__bounded__)) static analysis annotation and checking mechanism: Started by Anil Madhavapeddy on June 26, 2003 and ported to GCC 4 by Nicholas Marriott. First released with OpenBSD 3.4.
malloc(3) randomization implemented by Thierry Deval. Guard pages and randomized (delayed) free added by Ted Unangst. Reimplemented by Otto Moerbeek for OpenBSD 4.4.
Position-independent executables (PIE): OpenBSD 5.3 was the first widely used operating system to enable it globally by default, on seven hardware platforms. Implemented in November 2008 by Kurt Miller and enabled by default by Pascal Stumpf in August 2012.
Random-data memory: the ability to specify that a variable should be initialized at load time with random byte values (placed into a new ELF .openbsd.randomdata section) was implemented in OpenBSD 5.3 by Matthew Dempsky.
Stack protector per shared object: using the random-data memory feature, each shared object was given its own stack protector cookie in OpenBSD 5.3 by Matthew Dempsky.
Static-PIE: Position-independent static binaries for /bin, /sbin and ramdisks. Implemented for OpenBSD 5.7 by Kurt Miller and Mark Kettenis.
SROP (sigreturn(2) oriented programming) mitigation: attacks researched by Eric Bosman and Herbert Bos in 2014, solution implemented by Theo de Raadt in May 2016, enabled by default since OpenBSD 6.0.
Library order randomization: In rc(8), re-link libc.so, libcrypto, and ld.so on startup, placing the objects in a random order. Theo de Raadt and Robert Peichaer, May 2016, enabled by default since OpenBSD 6.0 and 6.2.
Kernel-assisted lazy-binding for W^X safety in multi-threaded programs. A new syscall kbind(2) permits lazy-binding to be W^X safe in multi-threaded programs. Implemented for OpenBSD 5.9 by Philip Guenther in July 2015.
Process layouts in memory tightened to remove execute permission from all segmented, non-instruction data and to remove write permission from data that is only modified during loading and relocation. By combining the RELRO (Read-Only after Relocation) design from the GNU project with the original ASLR work from OpenBSD 3.3 and strict lazy-binding work from OpenBSD 5.9, this is applied to not just a subset of programs and libraries but rather to all programs and libraries. Implemented for OpenBSD 6.1 by Philip Guenther in August 2016.
Use of fork+exec in privilege separated programs. The strategy is to give each process a fresh & unique address space for ASLR, stack protector -- as protection against address space discovery attacks. Implemented first by Damien Miller (sshd(8) 2004), Claudio Jeker (bgpd(8), 2015), Eric Faurot (smtpd(8), 2016), Rafael Zalamena (various, 2016), and others.
trapsleds: Reduction of incidental NOP instructions/sequences in the instruction stream which could be useful potentially for ROP attack methods to inaccurately target gadgets. These NOP sequences are converted into trap sequences where possible. Todd Mortimer and Theo de Raadt, June 2017.
Kernel relinking at boot: the .o files of the kernel are relinked in random order from a link-kit, before every reboot. This provides substantial interior randomization in the kernel's text and data segments for layout and relative branches/calls. Basically a unique address space for each kernel boot, similar to the userland fork+exec model described above but for the kernel. Theo de Raadt, June 2017.
Rearranged i386/amd64 register allocator order in clang(1) to reduce polymorphic RET instructions: Todd Mortimer, November 20, 2017.
Reencoding of i386/amd64 instruction sequences to avoid embedded polymorphic RET instructions. Enhancements to clang(1) Todd Mortimer, April 28, 2018 a