We've finally reached a hundred episodes, and this week we'll be talking to Sebastian Wiedenroth about pkgsrc. Though originally a NetBSD project, now it runs pretty much everywhere, and he even runs a conference about it!
This episode was brought to you by
Headlines
Remote DoS in the TCP stack
A pretty devious bug in the BSD network stack has been making its rounds for a while now, allowing remote attackers to exhaust the resources of a system with nothing more than TCP connectionsWhile in the LAST_ACK state, which is one of the final stages of a connection's lifetime, the connection can get stuck and hang there indefinitelyThis problem has a slightly confusing history that involves different fixes at different points in time from different peopleJuniper originally discovered the bug and announced a fix for their proprietary networking gear on June 8thOn June 29th, FreeBSD caught wind of it and fixed the bug in their -current branch, but did not issue a security notice or MFC the fix back to the -stable branchesOn July 13th, two weeks later, OpenBSD fixed the issue in their -current branch with a slightly different patch, citing the FreeBSD revision from which the problem was foundImmediately afterwards, they merged it back to -stable and issued an errata notice for 5.7 and 5.6On July 21st, three weeks after their original fix, FreeBSD committed yet another slightly different fix and issued a security notice for the problem (which didn't include the first fix)After the second fix from FreeBSD, OpenBSD gave them both another look and found their single fix to be sufficient, covering the timer issue in a more general wayNetBSD confirmed they were vulnerable too, and applied another completely different fix to -current on July 24th, but haven't released a security notice yetDragonFly is also investigating the issue now to see if they're affected as well***
c2k15 hackathon reports
Reports from OpenBSD's latest hackathon, held in Calgary this time, are starting to roll in (there were over 40 devs there, so we might see a lot more of these)The first one, from Ingo Schwarze, talks about some of the mandoc work he did at the eventHe writes, "Did you ever look at a huge page in man, wanted to jump to the definition of a specific term - say, in ksh, to the definition of the "command" built-in command - and had to step through dozens of false positives with the less '/' and 'n' search keys before you finally found the actual definition?"With mandoc's new internal jump targets, this is a problem of the past nowJasper also sent in a report, doing his usual work with Puppet (and specifically "Facter," a tool used by Puppet to gather various bits of system information)Aside from that and various ports-related work, Jasper worked on adding tame support to some userland tools, fixing some Octeon stuff and introduced something that OpenBSD has oddly lacked until now: an "-i" flag for sed (hooray!)Antoine Jacoutot gave a report on what he did at the hackathon as well, including improvements to the rcctl tool (for configuring startup services)It now has an "ls" subcommand with status parsing, allowing you to list running services, stopped services or even ones that failed to start or are supposed to be running (he calls this "the poor man's service monitoring tool")He also reworked some of the rc.d system to allow smoother operation of multiple instances of the same daemon to run (using tor with different config files as an example)His list also included updating ports, updating ports documentation, updating the hotplug daemon and laying out some plans for automatic sysmerge for future upgradesFoundation director Ken Westerback was also there, getting some disk-related and laptop work doneHe cleaned up and committed the 4k sector softraid code that he'd been working on, as well as fixing some trackpad issuesStefan Sperling, OpenBSD's token "wireless guy," had a lot to say about the hackathon and what he did there (and even sent in his write-up before he got home)He taught tcpdump about some new things, including 802.11n metadata beacons (there's a lot more specific detail about this one in the report)Bringing a bag full of USB wireless devices with him, he set out to get the unsupported ones working, as well as fix some driver bugs in the ones that already did workOne quote from Stefan's report that a lot of people seem to be talking about: "Partway through the hackathon tedu proposed an old diff of his to make our base ls utility display multi-byte characters. This led to a long discussion about how to expand UTF-8 support in base. The conclusion so far indicates that single-byte locales (such as ISO-8859-1 and KOI-8) will be removed from the base OS after the 5.8 release is cut. This simplifies things because the whole system only has to care about a single character encoding. We'll then have a full release cycle to bring UTF-8 support to more base system utilities such as vi, ksh, and mg. To help with this plan, I started organizing a UTF-8-focused hackathon for some time later this year."Jeremy Evans wrote in to talk about updating lots of ports, moving the ruby ports up to the latest version and also creating perl and ruby wrappers for the new tame subsystemWhile he's mainly a ports guy, he got to commit fixes to ports, the base system and even the kernel during the hackathonRafael Zalamena, who got commit access at the event, gives his very first report on his networking-related hackathon activitiesWith Rafael's diffs and help from a couple other developers, OpenBSD now has support for VPLSJonathan Gray got a lot done in the area of graphics, working on OpenGL and Mesa, updating libdrm and even working with upstream projects to remove some GNU-specific codeAs he's become somewhat known for, Jonathan was also busy running three things in the background: clang's fuzzer, cppcheck and AFL (looking for any potential crashes to fix)Martin Pieuchot gave an write-up on his experience: "I always though that hackathons were the best place to write code, but what's even more important is that they are the best (well actually only) moment where one can discuss and coordinate projects with other developers IRL. And that's what I did."He laid out some plans for the wireless stack, discussed future plans for PF, made some routing table improvements and did various other bits to the network stackUnfortunately, most of Martin's secret plans seem to have been left intentionally vague, and will start to take form in the next release cycleWe're still eagerly awaiting a report from one of OpenBSD's newest developers, Alexandr Nedvedicky (the Oracle guy who's working on SMP PF and some other PF fixes)OpenBSD 5.8's "beta" status was recently reverted, with the message "take that as a hint," so that may mean more big changes are still to come...***
FreeBSD quarterly status report
FreeBSD has published their quarterly status report for the months of April to June, citing it to be the largest one so farIt's broken down into a number of sections: team reports, projects, kernel, architectures, userland programs, ports, documentation, Google Summer of Code and miscellaneous othersStarting off with the cluster admin, some machines were moved to the datacenter at New York Internet, email services are now more resilient to failure, the svn mirrors (now just "svn.freebsd.org") are now using GeoGNS with official SSL certs and general redundancy was increasedIn the release engineering space, ARM and ARM64 work continues to improve on the Cavium ThunderX, more focus is being put into cloud platforms and the 10.2-RELEASE cycle is reaching its final stagesThe core team has been working on phabricator, the fancy review system, and is considering to integrate oauth support soonWork also continues on bhyve, and more operating systems are slowly gaining support (including the much-rumored Windows Server 2012)The report also covers recent developments in the Linux emulation layer, and encourages people using 11-CURRENT to help test out the 64bit supportMultipath TCP was also a hot topic, and there's a brief summary of the current status on that patch (it will be available publicly soon)ZFSguru, a project we haven't talked about a lot, also gets some attention in the report - version 0.3 is set to be completed in early AugustPCIe hotplug support is also mentioned, though it's still in the development stages (basic hot-swap functions are working though)The official binary packages are now built more frequently than before with the help of additional hardware, so AMD64 and i386 users will have fresher ports without the need for compilingVarious other small updates on specific areas of ports (KDE, XFCE, X11...) are also included in the reportDocumentation is a strong focus as always, a number of new documentation committers were added and some of the translations have been improved a lotMany other topics were covered, including foundation updates, conference plans, pkgsrc support in pkgng, ZFS support for UEFI boot and much more***
The OpenSSH bug that wasn't
There's been a lot of discussion about a supposed flaw in OpenSSH, allowing attackers to substantially amplify the number of password attempts they can try per session (without leaving any abnormal log traces, even)There's no actual exploit to speak of; this bug would only help someone get more bruteforce tries in with a fewer number of connectionsFreeBSD in its default configuration, with PAM and ChallengeResponseAuthentication enabled, was the only one vulnerable to the problem - not upstream OpenSSH, nor any of the other BSDs, and not even the majority of Linux distrosIf you disable all forms of authentication except public keys, like you're supposed to, then this is also not a big deal for FreeBSD systemsRealistically speaking, it's more of a PAM bug than anything elseOpenSSH added an additional check for this type of setup that will be in 7.0, but simply changing your sshd_config is enough to mitigate the issue for now on FreeBSD (or you can run freebsd-update)***
Interview - Sebastian Wiedenroth -
[email protected] / @wied0r
News Roundup
Now served by OpenBSD
We've mentioned that you can also install OpenBSD on DO droplets, and this blog post is about someone who actually did itThe use case for the author was for a webserver, so he decided to try out the httpd in baseConfiguration is ridiculously simple, and the config file in his example provides an HTTPS-only webserver, with plaintext requests automatically redirectingTLS 1.2 by default, strong ciphers with LibreSSL and HSTS combined give you a pretty secure web server***
FreeBSD laptop playbooks
A new project has started up on Github for configuring FreeBSD on various laptops, unsurprisingly named "freebsd-laptops"It's based on ansible, and uses the playbook format for automatic set up and configurationRight now, it's only working on a single Lenovo laptop, but the plan is to add instructions for many more modelsCheck the Github page for instructions on how to get started, and maybe get involved if you're running FreeBSD on a laptop***
NetBSD on the NVIDIA Jetson TK1
If you've never heard of the Jetson TK1, we can go ahead and spoil the secret here: NetBSD runs on itAs for the specs, it has a quad-core ARMv7 CPU at 2.3GHz, 2 gigs of RAM, gigabit ethernet, SATA, HDMI and mini-PCIEThis blog post shows which parts of the board are working with NetBSD -current (which seems to be almost everything)You can even run X11 on it, pretty sweet***
DragonFly power mangement options
DragonFly developer Sepherosa, who we've had on the show, has been doing some ACPI work over thereIn this email, he presents some of DragonFly's different power management options: ACPI P-states, C-states, mwait C-states and some Intel-specific bits as wellHe also did some testing with each of them and gave his findings about power savingIf you've been thinking about running DragonFly on a laptop, this would be a good one to read***
OpenBSD router under FreeBSD bhyve
If one BSD just isn't enough for you, and you've only got one machine, why not run two at onceThis article talks about taking a FreeBSD server running bhyve and making a virtualized OpenBSD router with itIf you've been considering switching over your router at home or the office, doing it in a virtual machine is a good way to test the waters before committing to real hardwareThe author also includes a little bit of history on how he got into both operating systemsThere are lots of mixed opinions about virtualizing core network components, so we'll leave it up to you to do your researchOf course, the next logical step is to put that bhyve host under Xen on NetBSD...***
Feedback/Questions
Kevin writes inLogan writes inPeter writes inRandy writes in***
View all episodes
