We've finally reached a hundred episodes, and this week we'll be talking to Sebastian Wiedenroth about pkgsrc. Though originally a NetBSD project, now it runs pretty much everywhere, and he even runs a conference about it!
This episode was brought to you by
Headlines
- A pretty devious bug in the BSD network stack has been making its rounds for a while now, allowing remote attackers to exhaust the resources of a system with nothing more than TCP connections
- While in the LAST_ACK state, which is one of the final stages of a connection's lifetime, the connection can get stuck and hang there indefinitely
- This problem has a slightly confusing history that involves different fixes at different points in time from different people
- Juniper originally discovered the bug and announced a fix for their proprietary networking gear on June 8th
- On June 29th, FreeBSD caught wind of it and fixed the bug in their -current branch, but did not issue a security notice or MFC the fix back to the -stable branches
- On July 13th, two weeks later, OpenBSD fixed the issue in their -current branch with a slightly different patch, citing the FreeBSD revision from which the problem was found
- Immediately afterwards, they merged it back to -stable and issued an errata notice for 5.7 and 5.6
- On July 21st, three weeks after their original fix, FreeBSD committed yet another slightly different fix and issued a security notice for the problem (which didn't include the first fix)
- After the second fix from FreeBSD, OpenBSD gave them both another look and found their single fix to be sufficient, covering the timer issue in a more general way
- NetBSD confirmed they were vulnerable too, and applied another completely different fix to -current on July 24th, but haven't released a security notice yet
- DragonFly is also investigating the issue now to see if they're affected as well
***
- Reports from OpenBSD's latest hackathon, held in Calgary this time, are starting to roll in (there were over 40 devs there, so we might see a lot more of these)
- The first one, from Ingo Schwarze, talks about some of the mandoc work he did at the event
- He writes, "Did you ever look at a huge page in man, wanted to jump to the definition of a specific term - say, in ksh, to the definition of the "command" built-in command - and had to step through dozens of false positives with the less '/' and 'n' search keys before you finally found the actual definition?"
- With mandoc's new internal jump targets, this is a problem of the past now
- Jasper also sent in a report, doing his usual work with Puppet (and specifically "Facter," a tool used by Puppet to gather various bits of system information)
- Aside from that and various ports-related work, Jasper worked on adding tame support to some userland tools, fixing some Octeon stuff and introduced something that OpenBSD has oddly lacked until now: an "-i" flag for sed (hooray!)
- Antoine Jacoutot gave a report on what he did at the hackathon as well, including improvements to the rcctl tool (for configuring startup services)
- It now has an "ls" subcommand with status parsing, allowing you to list running services, stopped services or even ones that failed to start or are supposed to be running (he calls this "the poor man's service monitoring tool")
- He also reworked some of the rc.d system to allow smoother operation of multiple instances of the same daemon to run (using tor with different config files as an example)
- His list also included updating ports, updating ports documentation, updating the hotplug daemon and laying out some plans for automatic sysmerge for future upgrades
- Foundation director Ken Westerback was also there, getting some disk-related and laptop work done
- He cleaned up and committed the 4k sector softraid code that he'd been working on, as well as fixing some trackpad issues
- Stefan Sperling, OpenBSD's token "wireless guy," had a lot to say about the hackathon and what he did there (and even sent in his write-up before he got home)
- He taught tcpdump about some new things, including 802.11n metadata beacons (there's a lot more specific detail about this one in the report)
- Bringing a bag full of USB wireless devices with him, he set out to get the unsupported ones working, as well as fix some driver bugs in the ones that already did work
- One quote from Stefan's report that a lot of people seem to be talking about: "Partway through the hackathon tedu proposed an old diff of his to make our base ls utility display multi-byte characters. This led to a long discussion about how to expand UTF-8 support in base. The conclusion so far indicates that single-byte locales (such as ISO-8859-1 and KOI-8) will be removed from the base OS after the 5.8 release is cut. This simplifies things because the whole system only has to care about a single character encoding. We'll then have a full release cycle to bring UTF-8 support to more base system utilities such as vi, ksh, and mg. To help with this plan, I started organizing a UTF-8-focused hackathon for some time later this year."
- Jeremy Evans wrote in to talk about updating lots of ports, moving the ruby ports up to the latest version and also creating perl and ruby wrappers for the new tame subsystem
- While he's mainly a ports guy, he got to commit fixes to ports, the base system and even the kernel during the hackathon
- Rafael Zalamena, who got commit access at the event, gives his very first report on his networking-related hackathon activities
- With Rafael's diffs and help from a couple other developers, OpenBSD now has support for VPLS
- Jonathan Gray got a lot done in the area of graphics, working on OpenGL and Mesa, updating libdrm and even working with upstream projects to remove some GNU-specific code
- As he's become somewhat known for, Jonathan was also busy running three things in the background: clang's fuzzer, cppcheck and AFL (looking for any potential crashes to fix)
- Martin Pieuchot gave an write-up on his experience: "I always though that hackathons were the best place to write code, but what's even more important is that they are the best (well actually only) moment where one can discuss and coordinate projects with other developers IRL. And that's what I did."
- He laid out some plans for the wireless stack, discussed future plans for PF, made some routing table improvements and did various other bits to the network stack
- Unfortunately, most of Martin's secret plans seem to have been left intentionally vague, and will start to take form in the next release cycle
- We're still eagerly awaiting a report from one of OpenBSD's newest developers, Alexandr Nedvedicky (the Oracle guy who's working on SMP PF and some other PF fixes)
- OpenBSD 5.8's "beta" status was recently reverted, with the message "take that as a hint," so that may mean more big changes are still to come...
***
- FreeBSD has published their quarterly status report for the months of April to June, citing it to be the largest one so far
- It's broken down into a number of sections: team reports, projects, kernel, architectures, userland programs, ports, documentation, Google Summer of Code and miscellaneous others
- Starting off with the cluster admin, some machines were moved to the datacenter at New York Internet, email services are now more resilient to failure, the svn mirrors (now just "svn.freebsd.org") are now using GeoGNS with official SSL certs and general redundancy was increased
- In the release engineering space, ARM and ARM64 work continues to improve on the Cavium ThunderX, more focus is being put into cloud platforms and the 10.2-RELEASE cycle is reaching its final stages
- The core team has been working on phabricator, the fancy review system, and is considering to integrate oauth support soon
- Work also continues on bhyve, and more operating systems are slowly gaining support (including the much-rumored Windows Server 2012)
- The report also covers recent developments in the Linux emulation layer, and encourages people using 11-CURRENT to help test out the 64bit support
- Multipath TCP was also a hot topic, and there's a brief summary of the current status on that patch (it will be available publicly soon)
- ZFSguru, a project we haven't talked about a lot, also gets some attention in the report - version 0.3 is set to be completed in early August
- PCIe hotplug support is also mentioned, though it's still in the development stages (basic hot-swap functions are working though)
- The official binary packages are now built more frequently than before with the help of additional hardware, so AMD64 and i386 users will have fresher ports without the need for compiling
- Various other small updates on specific areas of ports (KDE, XFCE, X11...) are also included in the report
- Documentation is a strong focus as always, a number of new documentation committers were added and some of the translations have been improved a lot
- Many other topics were covered, including foundation updates, conference plans, pkgsrc support in pkgng, ZFS support for UEFI boot and much more
***
- There's been a lot of discussion about a supposed flaw in OpenSSH, allowing attackers to substantially amplify the number of password attempts they can try per session (without leaving any abnormal log traces, even)
- There's no actual exploit to speak of; this bug would only help someone get more bruteforce tries in with a fewer number of connections
- FreeBSD in its default configuration, with PAM and ChallengeResponseAuthentication enabled, was the only one vulnerable to the problem - not upstream OpenSSH, nor any of the other BSDs, and not even the majority of Linux distros
- If you disable all forms of authentication except public keys, like you're supposed to, then this is also not a big deal for FreeBSD systems
- Realistically speaking, it's more of a PAM bug than anything else
- OpenSSH added an additional check for this type of setup that will be in 7.0, but simply changing your sshd_config is enough to mitigate the issue for now on FreeBSD (or you can run freebsd-update)
***
pkgsrc and pkgsrcCon
News Roundup
- We've mentioned that you can also install OpenBSD on DO droplets, and this blog post is about someone who actually did it
- The use case for the author was for a webserver, so he decided to try out the httpd in base
- Configuration is ridiculously simple, and the config file in his example provides an HTTPS-only webserver, with plaintext requests automatically redirecting
- TLS 1.2 by default, strong ciphers with LibreSSL and HSTS combined give you a pretty secure web server
***
- A new project has started up on Github for configuring FreeBSD on various laptops, unsurprisingly named "freebsd-laptops"
- It's based on ansible, and uses the playbook format for automatic set up and configuration
- Right now, it's only working on a single Lenovo laptop, but the plan is to add instructions for many more models
- Check the Github page for instructions on how to get started, and maybe get involved if you're running FreeBSD on a laptop
***
- If you've never heard of the Jetson TK1, we can go ahead and spoil the secret here: NetBSD runs on it
- As for the specs, it has a quad-core ARMv7 CPU at 2.3GHz, 2 gigs of RAM, gigabit ethernet, SATA, HDMI and mini-PCIE
- This blog post shows which parts of the board are working with NetBSD -current (which seems to be almost everything)
- You can even run X11 on it, pretty sweet
***
- DragonFly developer Sepherosa, who we've had on the show, has been doing some ACPI work over there
- In this email, he presents some of DragonFly's different power management options: ACPI P-states, C-states, mwait C-states and some Intel-specific bits as well
- He also did some testing with each of them and gave his findings about power saving
- If you've been thinking about running DragonFly on a laptop, this would be a good one to read
***
- If one BSD just isn't enough for you, and you've only got one machine, why not run two at once
- This article talks about taking a FreeBSD server running bhyve and making a virtualized OpenBSD router with it
- If you've been considering switching over your router at home or the office, doing it in a virtual machine is a good way to test the waters before committing to real hardware
- The author also includes a little bit of history on how he got into both operating systems
- There are lots of mixed opinions about virtualizing core network components, so we'll leave it up to you to do your research
- Of course, the next logical step is to put that bhyve host under Xen on NetBSD...
***
Feedback/Questions
