OpenBSD Journal

OpenBSD Journal

Help the OpenBSD Foundation Reach Its 2022 Funding Goal

Contributed by Peter N. M. Hansteen on from the puffy needs cash dept.

The OpenBSD Foundation, which is central to funding the OpenBSD project, needs your help to reach its 2022 Fundraising Goal of $300,000.

At the time of writing, the amount raised in 2022 stands at a little over 50% of the stated goal.

The Foundation needs your help to sustainably fund the project. Please head over to the Foundation's donations page, and make sure you drag your employer over there too!

With about 30 days left in 2022, we know we can do it!

lladdr-tied Config Support May Soon Land in ifconfig(8) and netstart(8)

Contributed by Peter N. M. Hansteen on from the all linked up dept.

It started with a thread on misc@ with the subject "Locking network card configuration" where the problem description is, when two or more network interfaces are attached to the same USB bus, their numbering may not be entirely predictable. The question is, what workarounds are possible?

The thread, where several developers offered their insights, and which soon migrated to tech@ with the subject switched to "lladdr support for netstart/hostname.if (was: Re: Locking network card configuration)" and later "lladdr support for netstart/hostname.if" turned up several suggestions, with several patches, and potential support for link level address (MAC address) tied configuration via a new hostname.MAC(5) file to supplement the more familiar hostname.if(5) config file, complete with corresponding ifconfig(8) options.

Please read the messages and patches, and if you have useful input for the developers on this, please chime in via tech@ or in comments here if you prefer.

Once again, an interesting feature that may materialize for testing in snapshots in the near future.

Next steps toward mimmutable, from deraadt@

Contributed by Peter N. M. Hansteen on from the unmute the immutable dept.

In a recent message to the tech mailing list, Theo de Raadt (deraadt@) summarized the state of the new memory protections work. The thread also includes a followup from Otto Moerbeek (otto@) on consequent changes to the memory allocation mechanisms.

Theo writes,

From: "Theo de Raadt" <deraadt () openbsd ! org>
Date: Fri, 18 Nov 2022 03:10:05 +0000
To: openbsd-tech
Subject: More on mimmutable

[LONG]

I am getting close to having the big final step of mimmutable in the tree.
Here's a refresher on the how it works, what's already done, and the next
bit to land.

DESCRIPTION
     The mimmutable() system call changes currently mapped pages in the region
     to be marked immutable, which means their protection or mapping may not
     be changed in the future.  mmap(2), mprotect(2), and munmap(2) to pages
     marked immutable will return with error EPERM.

Read more…

Call for testing on updated Apple M1/M2 bootloader code

Contributed by Peter N. M. Hansteen on from the Bump my bootloader dept.

Tobias Heider (tobhe@) posted to tech@ asking people with access to the relevant hardware to test updates to the arm64 bootloader code:

From: Tobias Heider <tobhe () openbsd ! org>
Date: Fri, 18 Nov 2022 16:57:12 +0000
To: openbsd-tech
Subject: Help testing Apple M1/M2 bootloader update

Hi all,

we are working on automated bootloader and device-tree updates for Apple
Silicon machines.  This is necessary because both drivers and device trees
are moving targets and without a way to update both we end up in situations
where drivers suddenly stop working.

Read more…

Game of Trees 0.79 released.

Contributed by grey on from the got branches from the trenches dept.

Version 0.79 of Game of Trees has been released (and the port updated):

* got 0.79; 2022-11-08
- repair build on OpenBSD/sparc64 (patch by Ted Bullock)
- fix crash in gotd if client gets disconnected on error (reported by Mikhail)
- fix crash in got-send-pack when server does not announce any capabilities
- make gotd work as intended on an empty repository
- prevent freeing of bogus pointers in got_inflate_end() and got_deflate_end()
- reduce delta cache size to avoid running out of memory on large pack files
- add missing free of delta buffers in several error paths
- make 'got clone -b' work for repositories which lack a valid HEAD reference
- use sub-second precision when checking for objects/pack/ modification
- fix capabilities announced by gotsh when no references exist in repository

mmap(2), munmap(2), and mprotect(2) unlocked

Contributed by rueda on from the woosh! dept.

Martin Pieuchot (mpi@) has committed a change unlocking the mmap(2), munmap(2), and mprotect(2) system calls:

CVSROOT:	/cvs
Module name:	src
Changes by:	mpi@cvs.openbsd.org	2022/11/08 04:05:57

Modified files:
	sys/kern       : syscalls.master 

Log message:
Mark mmap(2), munmap(2) and mprotect(2) as NOLOCK.

Accesses to data structures used by these syscalls are serialized by the
VM map lock with the exception of file mappings which are still protected
by the KERNEL_LOCK().

Unlocking this set of syscalls improves most of userland workloads.

Tested by many including robert@ (since 2 years), mlarkin@, kn@, sdk@,
jca@, aoyama@, naddy@, Scott Bennett and others. Thanks to all!

Joint work with kn@.

ok robert@, aja@, kettenis@, kn@, deraadt@, beck@

The improvement in workload performance can be quite marked. Following Martin's request for testing, Mike Larkin (mlarkin@) reported build performance improvement of over 12%!

Game of Trees 0.78 released

Contributed by rueda on from the more-control-igor dept.

Version 0.78 of Game of Trees has been released (and the port updated):

* got 0.78; 2022-11-03
- gotsh.1: Use Sx for referencing EXAMPLES (patch by Josiah Frentsos)
- change got_pack_parse_offset_delta tslen argument to size_t (op)
- fix regression test failures with Git 2.30.5 / 2.38.1 or later installed
- fix gotd(8) usage() string (patch by Josiah Frentsos)
- regress/rebase.sh: remove accidentally included absolute path to "got" (naddy)
- fix off_t type mismatches in printf format string arguments (naddy, op)
- fix spelling of "FastCGI" (patch by Josiah Frentsos)
- add missing `goto done;' on error path of read_raw_delta_data() (op)
- add bounds check when reading a delta offset from a packed object (op)
- check size before calling mmap(2) (op)
- sort getopt() option lists and switch statements (patch by Josiah Frentsos)
- make got.conf(5) warn about remotes configured in locally-shared repositories
- add missing check for errors from got_gotconfig_read() in open_worktree()
- plug a memory leak on error in got_gotconfig_read()
- convert pack filesize variables to off_t for large packs on 32-bit arch (op)
- remove sendfd pledge promise from gotd repo_read and repo_write processes
- add gotctl(8); initially supported commands are 'info' and 'stop'
- respect umask when creating or changing files and directories (op)
- fix typo which caused a double-free in gotd repo_write_shutdown()
- got-fetch-pack: fix wrong memmove length leading to dubious checksum failures
- avoid incomplete writes of pack file data in gotsh and got-send-pack
- add a test suite for gotd(8); check basic clone and send functionality
- require space between commit author name and email, for Git compatibility
- gotwebd: avoid 500 error code if erroring out in plaintext mode (landry)
- gotwebd: add respect_exportok flag, defaulting to off (landry)
- respect open files resource limit when sizing pack cache; regression from 0.71
- provide a diff of changes in a temp file while editing a commit log message
- fix memory and file descriptor leak for raw objects (regression from 0.77)
- remove casts which made older gcc versions unhappy
- fix free of wrong address on error in gotweb's parse.y

This release sees the introduction of gotctl(8), a utility for controlling gotd(8).

LibreSSL 3.6.1 released

Contributed by rueda on from the not-to-be-confused-with-any-other-xSSL-releases dept.

Brent Cook (bcook@) has announced the release of LibreSSL verion 3.6.1:

We have released LibreSSL 3.6.1, which will be arriving in the
LibreSSL directory of your local OpenBSD mirror soon. This is the first
stable portable LibreSSL release from the OpenBSD 7.2 branch.

It includes the following fixes from LibreSSL 3.6.0:

 - Custom verification callbacks could cause the X.509 verifier to
   fail to store errors resulting from leaf certificate verification.
     Reported by Ilya Shipitsin.
 - Unbreak ASN.1 indefinite length encoding.
     Reported by Niklas Hallqvist.
 - Fix endian detection on macOS
     Reported by jiegec on Github

For the changes from LibreSSL 3.5.x, see the 3.6.0 release notes here:
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.0-relnotes.txt

The LibreSSL project continues improvement of the codebase to reflect modern,
safe programming practices. We welcome feedback and improvements from the
broader community. Thanks to all of the contributors who helped make this
release possible.

Donate!

Donate to OpenBSD

Features

We are constantly on the lookout for stories of how you put OpenBSD to work. Please submit any informative articles on how OpenBSD is helping your company.

OpenBSD Errata

OpenBSD 7.2

0082022-11-26 RELIABILITY Fix a assertion crash during pfsync state update.
0072022-11-26 SECURITY A crafted TCP query from localhost could crash the unwind(8) daemon.
0062022-11-26 RELIABILITY Incorrect reference counting and locking caused a vmm(4) performance regression.
0052022-11-14 SECURITY CVE-2022-44638: An integer overflow in pixman may lead to an out-of-bounds write.
0042022-11-01 SECURITY In libexpat fix heap use-after-free vulnerability CVE-2022-43680.
0032022-10-27 RELIABILITY Restore operation of Apple-specific Fn-key keyboard sequences.

Unofficial RSS feed of OpenBSD errata

XML/RSS/RDF

Users wishing RSS/RDF summary files of OpenBSD Journal can retrieve: RSS feed

Options are available.

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]