Friday, December 23, 2011

[FreeBSD-Announce] Merry Christmas from the FreeBSD Security Team

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all,

No, the Grinch didn't steal the FreeBSD security officer GPG key, and your eyes
aren't deceiving you: We really did just send out 5 security advisories.

The timing, to put it bluntly, sucks. We normally aim to release advisories on
Wednesdays in order to maximize the number of system administrators who will be
at work already; and we try very hard to avoid issuing advisories any time close
to holidays for the same reason. The start of the Christmas weekend -- in some
parts of the world it's already Saturday -- is absolutely not when we want to be
releasing security advisories.

Unfortunately my hand was forced: One of the issues (FreeBSD-SA-11:08.telnetd)
is a remote root vulnerability which is being actively exploited in the wild;
bugs really don't come any worse than this. On the positive side, most people
have moved past telnet and on to SSH by now; but this is still not an issue we
could postpone until a more convenient time.

While I'm writing, a note to freebsd-update users: FreeBSD-SA-11:07.chroot has a
rather messy fix involving adding a new interface to libc; this has the awkward
side effect of causing the sizes of some "symbols" (aka. functions) in libc to
change, resulting in cascading changes into many binaries. The long list of
updated files is irritating, but isn't a sign that anything in freebsd-update
went wrong.

- --
Colin Percival
Security Officer, FreeBSD | freebsd.org | The power to serve
Founder / author, Tarsnap | tarsnap.com | Online backups for the truly paranoid
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)

iEYEARECAAYFAk70oKgACgkQFdaIBMps37IsdACgh01CeO+zVGe3o9dn2cLvhh70
ISoAoJCeLUAbJ+0ibyfbVM4fYxpiEfo0
=vt5I
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"

[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-11:10.pam

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-11:10.pam Security Advisory
The FreeBSD Project

Topic: pam_start() does not validate service names

Category: contrib
Module: pam
Announced: 2011-12-23
Credits: Matthias Drochner
Affects: All supported versions of FreeBSD.
Corrected: 2011-12-13 13:03:11 UTC (RELENG_7, 7.4-STABLE)
2011-12-23 15:00:37 UTC (RELENG_7_4, 7.4-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_7_3, 7.3-RELEASE-p9)
2011-12-13 13:02:52 UTC (RELENG_8, 8.2-STABLE)
2011-12-23 15:00:37 UTC (RELENG_8_2, 8.2-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_8_1, 8.1-RELEASE-p7)
2011-12-13 12:59:39 UTC (RELENG_9, 9.0-STABLE)
2011-12-13 13:02:31 UTC (RELENG_9_0, 9.0-RELEASE)
CVE Name: CVE-2011-4122

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit http://security.FreeBSD.org/>.

I. Background

The PAM (Pluggable Authentication Modules) library provides a flexible
framework for user authentication and session setup / teardown. It is
used not only in the base system, but also by a large number of
third-party applications.

Various authentication methods (UNIX, LDAP, Kerberos etc.) are
implemented in modules which are loaded and executed according to
predefined, named policies. These policies are defined in
/etc/pam.conf, /etc/pam.d/, /usr/local/etc/pam.conf or
/usr/local/etc/pam.d/.

The PAM API is a de facto industry standard which has been implemented
by several parties. FreeBSD uses the OpenPAM implementation.

II. Problem Description

Some third-party applications, including KDE's kcheckpass command,
allow the user to specify the name of the policy on the command line.
Since OpenPAM treats the policy name as a path relative to /etc/pam.d
or /usr/local/etc/pam.d, users who are permitted to run such an
application can craft their own policies and cause the application
to load and execute their own modules.

III. Impact

If an application that runs with root privileges allows the user to
specify the name of the PAM policy to load, users who are permitted to
run that application will be able to execute arbitrary code with root
privileges.

There are no vulnerable applications in the base system.

IV. Workaround

No workaround is available, but systems without untrusted users are
not vulnerable.

Inspect any third-party setuid / setgid binaries which use the PAM
library and ascertain whether they allow the user to specify the
policy name, then either change the binary's permissions to prevent
its use or remove it altogether.

The following command will output a non-zero number if a dynamically
linked binary uses libpam:

# ldd /usr/local/bin/suspicious_binary | grep -c libpam

The following command will output a non-zero number if a statically
linked binary uses libpam:

# grep -acF "/etc/pam.d/" /usr/local/bin/suspicious_binary

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 7-STABLE or 8-STABLE, or to
the RELENG_8_2, RELENG_8_1, RELENG_7_4, or RELENG_7_3 security
branch dated after the correction date.

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to FreeBSD 7.4, 7.3,
8.2 and 8.1 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch http://security.FreeBSD.org/patches/SA-11:10/pam.patch
# fetch http://security.FreeBSD.org/patches/SA-11:10/pam.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/lib/libpam
# make obj && make depend && make && make install

NOTE: On the amd64 platform, the above procedure will not update the
lib32 (i386 compatibility) libraries. On amd64 systems where the i386
compatibility libraries are used, the operating system should instead
be recompiled as described in
http://www.FreeBSD.org/handbook/makeworld.html>

3) To update your vulnerable system via a binary patch:

Systems running 7.4-RELEASE, 7.3-RELEASE, 8.2-RELEASE, or 8.1-RELEASE on
the i386 or amd64 platforms can be updated via the freebsd-update(8)
utility:

# freebsd-update fetch
# freebsd-update install

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

CVS:

Branch Revision
Path
- -------------------------------------------------------------------------
RELENG_7
src/contrib/openpam/lib/openpam_configure.c 1.1.1.7.20.2
RELENG_7_4
src/UPDATING 1.507.2.36.2.7
src/sys/conf/newvers.sh 1.72.2.18.2.10
src/contrib/openpam/lib/openpam_configure.c 1.1.1.7.20.1.8.1
RELENG_7_3
src/UPDATING 1.507.2.34.2.11
src/sys/conf/newvers.sh 1.72.2.16.2.13
src/contrib/openpam/lib/openpam_configure.c 1.1.1.7.20.1.6.1
RELENG_8
src/contrib/openpam/lib/openpam_configure.c 1.1.1.8.2.1
RELENG_8_2
src/UPDATING 1.632.2.19.2.7
src/sys/conf/newvers.sh 1.83.2.12.2.10
src/contrib/openpam/lib/openpam_configure.c 1.1.1.8.8.1
RELENG_8_1
src/UPDATING 1.632.2.14.2.10
src/sys/conf/newvers.sh 1.83.2.10.2.11
src/contrib/openpam/lib/openpam_configure.c 1.1.1.8.6.1
RELENG_9
src/contrib/openpam/lib/openpam_configure.c 1.1.1.8.10.1
RELENG_9_0
src/contrib/openpam/lib/openpam_configure.c 1.1.1.8.12.1
- -------------------------------------------------------------------------

Subversion:

Branch/path Revision
- -------------------------------------------------------------------------
stable/7/ r228467
releng/7.4/ r228843
releng/7.3/ r228843
stable/8/ r228466
releng/8.2/ r228843
releng/8.1/ r228843
stable/9/ r228464
releng/9.0/ r228465
- -------------------------------------------------------------------------

VII. References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4122

The latest revision of this advisory is available at
http://security.FreeBSD.org/advisories/FreeBSD-SA-11:10.pam.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)

iEYEARECAAYFAk70nOoACgkQFdaIBMps37KEWgCgiD/7EymFrnFueD7yyLiI3hLV
lU4An2FUTQRJ0GakViobm9ejHdfmf2Vb
=9COS
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"

[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-11:08.telnetd

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-11:08.telnetd Security Advisory
The FreeBSD Project

Topic: telnetd code execution vulnerability

Category: core
Module: contrib
Announced: 2011-12-23
Affects: All supported versions of FreeBSD.
Corrected: 2011-12-23 15:00:37 UTC (RELENG_7, 7.4-STABLE)
2011-12-23 15:00:37 UTC (RELENG_7_4, 7.4-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_7_3, 7.3-RELEASE-p9)
2011-12-23 15:00:37 UTC (RELENG_8, 8.2-STABLE)
2011-12-23 15:00:37 UTC (RELENG_8_2, 8.2-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_8_1, 8.1-RELEASE-p7)
2011-12-23 15:00:37 UTC (RELENG_9, 9.0-STABLE)
2011-12-23 15:00:37 UTC (RELENG_9_0, 9.0-RELEASE)
CVE Name: CVE-2011-4862

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit http://security.FreeBSD.org/>.

I. Background

The FreeBSD telnet daemon, telnetd(8), implements the server side of the
TELNET virtual terminal protocol. It has been disabled by default in
FreeBSD since August 2001, and due to the lack of cryptographic security
in the TELNET protocol, it is strongly recommended that the SSH protocol
be used instead. The FreeBSD telnet daemon can be enabled via the
/etc/inetd.conf configuration file and the inetd(8) daemon.

The TELNET protocol has a mechanism for encryption of the data stream
(but it is not cryptographically strong and should not be relied upon
in any security-critical applications).

II. Problem Description

When an encryption key is supplied via the TELNET protocol, its length
is not validated before the key is copied into a fixed-size buffer.

III. Impact

An attacker who can connect to the telnetd daemon can execute arbitrary
code with the privileges of the daemon (which is usually the "root"
superuser).

IV. Workaround

No workaround is available, but systems not running the telnet daemon
are not vulnerable.

Note that the telnet daemon is usually run via inetd, and consequently
will not show up in a process listing unless a connection is currently
active; to determine if it is enabled, run

$ ps ax | grep telnetd | grep -v grep
$ grep telnetd /etc/inetd.conf | grep -vE '^#'

If any output is produced, your system may be vulnerable.

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 7-STABLE or 8-STABLE, or to the
RELENG_8_2, RELENG_8_1, RELENG_7_4, or RELENG_7_3 security branch dated
after the correction date.

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to FreeBSD 7.4, 7.3,
8.2, and 8.1 systems.

a) Download the patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch http://security.FreeBSD.org/patches/SA-11:08/telnetd.patch
# fetch http://security.FreeBSD.org/patches/SA-11:08/telnetd.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/lib/libtelnet
# make obj && make depend && make && make install
# cd /usr/src/libexec/telnetd
# make obj && make depend && make && make install

3) To update your vulnerable system via a binary patch:

Systems running 7.4-RELEASE, 7.3-RELEASE, 8.2-RELEASE, or 8.1-RELEASE on
the i386 or amd64 platforms can be updated via the freebsd-update(8)
utility:

# freebsd-update fetch
# freebsd-update install

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

CVS:

Branch Revision
Path
- -------------------------------------------------------------------------
RELENG_7
src/crypto/heimdal/appl/telnet/libtelnet/encrypt.c 1.1.1.2.24.1
src/contrib/telnet/libtelnet/encrypt.c 1.9.24.1
RELENG_7_4
src/UPDATING 1.507.2.36.2.7
src/sys/conf/newvers.sh 1.72.2.18.2.10
src/crypto/heimdal/appl/telnet/libtelnet/encrypt.c 1.1.1.2.38.1
src/contrib/telnet/libtelnet/encrypt.c 1.9.40.2
RELENG_7_3
src/UPDATING 1.507.2.34.2.11
src/sys/conf/newvers.sh 1.72.2.16.2.13
src/crypto/heimdal/appl/telnet/libtelnet/encrypt.c 1.1.1.2.36.1
src/contrib/telnet/libtelnet/encrypt.c 1.9.38.2
RELENG_8
src/crypto/heimdal/appl/telnet/libtelnet/encrypt.c 1.1.1.3.2.1
src/contrib/telnet/libtelnet/encrypt.c 1.9.36.2
RELENG_8_2
src/UPDATING 1.632.2.19.2.7
src/sys/conf/newvers.sh 1.83.2.12.2.10
src/crypto/heimdal/appl/telnet/libtelnet/encrypt.c 1.1.1.3.8.1
src/contrib/telnet/libtelnet/encrypt.c 1.9.36.1.6.2
RELENG_8_1
src/UPDATING 1.632.2.14.2.10
src/sys/conf/newvers.sh 1.83.2.10.2.11
src/crypto/heimdal/appl/telnet/libtelnet/encrypt.c 1.1.1.3.6.1
src/contrib/telnet/libtelnet/encrypt.c 1.9.36.1.4.2
RELENG_9
src/crypto/heimdal/appl/telnet/libtelnet/encrypt.c 1.1.1.3.10.1
src/contrib/telnet/libtelnet/encrypt.c 1.9.42.2
RELENG_9_0
src/crypto/heimdal/appl/telnet/libtelnet/encrypt.c 1.1.1.3.12.1
src/contrib/telnet/libtelnet/encrypt.c 1.9.42.1.2.2
- -------------------------------------------------------------------------

Subversion:

Branch/path Revision
- -------------------------------------------------------------------------
stable/7/ r228843
releng/7.4/ r228843
releng/7.3/ r228843
stable/8/ r228843
releng/8.2/ r228843
releng/8.1/ r228843
stable/9/ r228843
releng/9.0/ r228843
- -------------------------------------------------------------------------

VII. References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4862

The latest revision of this advisory is available at
http://security.FreeBSD.org/advisories/FreeBSD-SA-11:08.telnetd.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)

iEYEARECAAYFAk70nOoACgkQFdaIBMps37IYcwCfXn5aQTfQDe/AnS31JBg+BB1m
HJMAmgOE5pUKTlFqLw5UBouMNFfUmu2u
=dcyj
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"

[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-11:06.bind

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-11:06.bind Security Advisory
The FreeBSD Project

Topic: Remote packet Denial of Service against named(8) servers

Category: contrib
Module: bind
Announced: 2011-12-23
Affects: All supported versions of FreeBSD.
Corrected: 2011-11-17 01:10:16 UTC (RELENG_7, 7.4-STABLE)
2011-12-23 15:00:37 UTC (RELENG_7_4, 7.4-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_7_3, 7.3-RELEASE-p9)
2011-11-17 00:36:10 UTC (RELENG_8, 8.2-STABLE)
2011-12-23 15:00:37 UTC (RELENG_8_2, 8.2-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_8_1, 8.1-RELEASE-p7)
2011-12-01 21:13:41 UTC (RELENG_9, 9.0-STABLE)
2011-12-01 21:17:59 UTC (RELENG_9_0, 9.0-RC3)
2011-11-16 23:41:13 UTC (ports tree)
CVE Name: CVE-2011-4313

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit http://security.FreeBSD.org/>.

I. Background

BIND 9 is an implementation of the Domain Name System (DNS) protocols.
The named(8) daemon is an Internet Domain Name Server.

II. Problem Description

A remote attacker could cause the BIND resolver to cache an invalid
record, which could cause the BIND daemon to crash when that record
is being queried.

III. Impact

An attacker that is able to send an specifically crafted response to the
BIND daemon can cause it to crash, resulting in a denial of service.

Note that due to the nature of this vulnerability, the attacker does
not necessarily have to have query access to the victim server. The
vulnerability can be triggered by tricking legitimate clients, for
instance spam filtering systems or an end user browser, which can be
made to the query on their behalf.

IV. Workaround

No workaround is available, but systems not running the BIND resolving
name server are not affected.

Servers that are running in authoritative-only mode appear not to be
affected by this vulnerability.

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 7-STABLE or 8-STABLE, or to the
RELENG_8_2, RELENG_8_1, RELENG_7_4, or RELENG_7_3 security branch dated
after the correction date.

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to FreeBSD 7.4, 7.3,
8.2 and 8.1 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 7.3-RELEASE and 7.4-RELEASE]
# fetch http://security.FreeBSD.org/patches/SA-11:06/bind7.patch
# fetch http://security.FreeBSD.org/patches/SA-11:06/bind7.patch.asc

[FreeBSD 8.1-RELEASE and 8.2-RELEASE]
# fetch http://security.FreeBSD.org/patches/SA-11:06/bind8.patch
# fetch http://security.FreeBSD.org/patches/SA-11:06/bind8.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/lib/bind/
# make obj && make depend && make && make install
# cd /usr/src/usr.sbin/named
# make obj && make depend && make && make install

3) To update your vulnerable system via a binary patch:

Systems running 7.4-RELEASE, 7.3-RELEASE, 8.2-RELEASE, or 8.1-RELEASE on
the i386 or amd64 platforms can be updated via the freebsd-update(8)
utility:

# freebsd-update fetch
# freebsd-update install

4) Install and run BIND from the Ports Collection after the correction
date. The following versions and newer versions of BIND installed from
the Ports Collection already have the mitigation measure:

bind96-9.6.3.1.ESV.R5.1
bind97-9.7.4.1
bind98-9.8.1.1

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

CVS:

Branch Revision
Path
- -------------------------------------------------------------------------
RELENG_7
src/contrib/bind9/lib/dns/rbtdb.c 1.1.1.4.2.9
src/contrib/bind9/bin/named/query.c 1.1.1.6.2.8
RELENG_7_4
src/UPDATING 1.507.2.36.2.7
src/sys/conf/newvers.sh 1.72.2.18.2.10
src/contrib/bind9/lib/dns/rbtdb.c 1.1.1.4.2.6.2.1
src/contrib/bind9/bin/named/query.c 1.1.1.6.2.6.2.1
RELENG_7_3
src/UPDATING 1.507.2.34.2.11
src/sys/conf/newvers.sh 1.72.2.16.2.13
src/contrib/bind9/lib/dns/rbtdb.c 1.1.1.4.2.3.2.2
src/contrib/bind9/bin/named/query.c 1.1.1.6.2.3.2.2
RELENG_8
src/contrib/bind9/lib/dns/rbtdb.c 1.3.2.9
src/contrib/bind9/bin/named/query.c 1.3.2.8
RELENG_8_2
src/UPDATING 1.632.2.19.2.7
src/sys/conf/newvers.sh 1.83.2.12.2.10
src/contrib/bind9/lib/dns/rbtdb.c 1.3.2.5.2.1
src/contrib/bind9/bin/named/query.c 1.3.2.5.2.1
RELENG_8_1
src/UPDATING 1.632.2.14.2.10
src/sys/conf/newvers.sh 1.83.2.10.2.11
src/contrib/bind9/lib/dns/rbtdb.c 1.3.2.3.2.1
src/contrib/bind9/bin/named/query.c 1.3.2.3.2.1
RELENG_9
src/contrib/bind9/lib/dns/rbtdb.c 1.13.2.1
src/contrib/bind9/bin/named/query.c 1.11.2.1
RELENG_9_0
src/contrib/bind9/lib/dns/rbtdb.c 1.13.4.1
src/contrib/bind9/bin/named/query.c 1.11.4.1
- -------------------------------------------------------------------------

Subversion:

Branch/path Revision
- -------------------------------------------------------------------------
stable/7/ r227603
releng/7.4/ r228843
releng/7.3/ r228843
stable/8/ r227599
releng/8.2/ r228843
releng/8.1/ r228843
stable/9/ r228189
releng/9.0/ r228190
- -------------------------------------------------------------------------

VII. References

https://www.isc.org/software/bind/advisories/cve-2011-4313

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4313

The latest revision of this advisory is available at
http://security.FreeBSD.org/advisories/FreeBSD-SA-11:06.bind.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)

iEYEARECAAYFAk70nOoACgkQFdaIBMps37K18wCeLYPkREXJsMXYdzt+guRFcPZR
VY4AoII3kmCzRX/gYRmPW7lwGqWIgwlM
=wMSJ
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"

[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-11:09.pam_ssh

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-11:09.pam_ssh Security Advisory
The FreeBSD Project

Topic: pam_ssh improperly grants access when user account has
unencrypted SSH private keys

Category: contrib
Module: pam
Announced: 2011-12-23
Credits: Guy Helmer, Dag-Erling Smorgrav
Affects: All supported versions of FreeBSD.
Corrected: 2011-12-11 20:40:23 UTC (RELENG_7, 7.4-STABLE)
2011-12-23 15:00:37 UTC (RELENG_7_4, 7.4-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_7_3, 7.3-RELEASE-p9)
2011-12-11 20:38:36 UTC (RELENG_8, 8.2-STABLE)
2011-12-23 15:00:37 UTC (RELENG_8_2, 8.2-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_8_1, 8.1-RELEASE-p7)
2011-12-11 16:57:27 UTC (RELENG_9, 9.0-STABLE)
2011-12-11 17:32:37 UTC (RELENG_9_0, 9.0-RELEASE)

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit http://security.FreeBSD.org/>.

I. Background

The PAM (Pluggable Authentication Modules) library provides a flexible
framework for user authentication and session setup / teardown. It is
used not only in the base system, but also by a large number of
third-party applications.

Various authentication methods (UNIX, LDAP, Kerberos etc.) are
implemented in modules which are loaded and executed according to
predefined, named policies. These policies are defined in
/etc/pam.conf, /etc/pam.d/, /usr/local/etc/pam.conf or
/usr/local/etc/pam.d/.

The base system includes a module named pam_ssh which, if enabled,
allows users to authenticate themselves by typing in the passphrase of
one of the SSH private keys which are stored in encrypted form in the
their .ssh directory. Authentication is considered successful if at
least one of these keys could be decrypted using the provided
passphrase.

By default, the pam_ssh module rejects SSH private keys with no
passphrase. A "nullok" option exists to allow these keys.

II. Problem Description

The OpenSSL library call used to decrypt private keys ignores the
passphrase argument if the key is not encrypted. Because the pam_ssh
module only checks whether the passphrase provided by the user is
null, users with unencrypted SSH private keys may successfully
authenticate themselves by providing a dummy passphrase.

III. Impact

If the pam_ssh module is enabled, attackers may be able to gain access
to user accounts which have unencrypted SSH private keys.

IV. Workaround

No workaround is available, but systems that do not have the pam_ssh module
enabled are not vulnerable. The pam_ssh module is not enabled in any
of the default policies provided in the base system.

The system administrator can use the following procedure to inspect all
PAM policy files to determine whether the pam_ssh module is enabled.
If the following command produces any output, the system may be
vulnerable:

# egrep -r '^[^#].*\' /etc/pam.* /usr/local/etc/pam.*

The following command will disable the pam_ssh module in all PAM
policies present in the system:

# sed -i '' -e '/^[^#].*pam_ssh/s/^/#/' /etc/pam.conf /etc/pam.d/* \
/usr/local/etc/pam.conf /usr/local/etc/pam.d/*

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 7-STABLE or 8-STABLE, or to
the RELENG_8_2, RELENG_8_1, RELENG_7_4, or RELENG_7_3 security
branch dated after the correction date.

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to FreeBSD 7.4, 7.3,
8.2 and 8.1 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch http://security.FreeBSD.org/patches/SA-11:09/pam_ssh.patch
# fetch http://security.FreeBSD.org/patches/SA-11:09/pam_ssh.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/lib/libpam/modules/pam_ssh
# make obj && make depend && make && make install

NOTE: On the amd64 platform, the above procedure will not update the
lib32 (i386 compatibility) libraries. On amd64 systems where the i386
compatibility libraries are used, the operating system should instead
be recompiled as described in
http://www.FreeBSD.org/handbook/makeworld.html>

3) To update your vulnerable system via a binary patch:

Systems running 7.4-RELEASE, 7.3-RELEASE, 8.2-RELEASE, or 8.1-RELEASE on
the i386 or amd64 platforms can be updated via the freebsd-update(8)
utility:

# freebsd-update fetch
# freebsd-update install

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

CVS:

Branch Revision
Path
- -------------------------------------------------------------------------
RELENG_7
src/lib/libpam/modules/pam_ssh/pam_ssh.c 1.44.2.2
RELENG_7_4
src/UPDATING 1.507.2.36.2.7
src/sys/conf/newvers.sh 1.72.2.18.2.10
src/lib/libpam/modules/pam_ssh/pam_ssh.c 1.44.2.1.8.2
RELENG_7_3
src/UPDATING 1.507.2.34.2.11
src/sys/conf/newvers.sh 1.72.2.16.2.13
src/lib/libpam/modules/pam_ssh/pam_ssh.c 1.44.2.1.6.2
RELENG_8
src/lib/libpam/modules/pam_ssh/pam_ssh.c 1.45.2.3
RELENG_8_2
src/UPDATING 1.632.2.19.2.7
src/sys/conf/newvers.sh 1.83.2.12.2.10
src/lib/libpam/modules/pam_ssh/pam_ssh.c 1.45.2.2.4.2
RELENG_8_1
src/UPDATING 1.632.2.14.2.10
src/sys/conf/newvers.sh 1.83.2.10.2.11
src/lib/libpam/modules/pam_ssh/pam_ssh.c 1.45.2.2.2.2
RELENG_9
src/lib/libpam/modules/pam_ssh/pam_ssh.c 1.47.2.2
RELENG_9_0
src/lib/libpam/modules/pam_ssh/pam_ssh.c 1.47.2.1.2.2
- -------------------------------------------------------------------------

Subversion:

Branch/path Revision
- -------------------------------------------------------------------------
stable/7/ r228421
releng/7.4/ r228843
releng/7.3/ r228843
stable/8/ r228420
releng/8.2/ r228843
releng/8.1/ r228843
stable/9/ r228410
releng/9.0/ r228414
- -------------------------------------------------------------------------

VII. References

The latest revision of this advisory is available at
http://security.FreeBSD.org/advisories/FreeBSD-SA-11:09.pam_ssh.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)

iEYEARECAAYFAk70nOoACgkQFdaIBMps37JTSwCfS+bmWBxv5hote7Hrcl7VZjjk
vKMAn116aLADxmdYsyZ5WdSrfFTRt3Xm
=Y+ar
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"

[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-11:07.chroot

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-11:07.chroot Security Advisory
The FreeBSD Project

Topic: Code execution via chrooted ftpd

Category: core
Module: libc
Announced: 2011-12-23
Affects: All supported versions of FreeBSD.
Corrected: 2011-12-23 15:00:37 UTC (RELENG_7, 7.4-STABLE)
2011-12-23 15:00:37 UTC (RELENG_7_4, 7.4-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_7_3, 7.3-RELEASE-p9)
2011-12-23 15:00:37 UTC (RELENG_8, 8.2-STABLE)
2011-12-23 15:00:37 UTC (RELENG_8_2, 8.2-RELEASE-p5)
2011-12-23 15:00:37 UTC (RELENG_8_1, 8.1-RELEASE-p7)
2011-12-23 15:00:37 UTC (RELENG_9, 9.0-STABLE)
2011-12-23 15:00:37 UTC (RELENG_9_0, 9.0-RELEASE)

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit http://security.FreeBSD.org/>.

I. Background

Chroot is an operation that changes the apparent root directory for the
current process and its children. The chroot(2) system call is widely
used in many applications as a measure of limiting a process's access to
the file system, as part of implementing privilege separation.

The nsdispatch(3) API implementation has a feature to reload its
configuration on demand. This feature may also load shared libraries
and run code provided by the library when requested by the configuration
file.

II. Problem Description

The nsdispatch(3) API has no mechanism to alert it to whether it is
operating within a chroot environment in which the standard paths for
configuration files and shared libraries may be untrustworthy.

The FreeBSD ftpd(8) daemon can be configured to use chroot(2), and
also uses the nsdispatch(3) API.

III. Impact

If ftpd is configured to place a user in a chroot environment, then an
attacker who can log in as that user may be able to run arbitrary code
with elevated ("root") privileges.

IV. Workaround

Don't use ftpd with the chroot option.

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 7-STABLE or 8-STABLE, or to
the RELENG_8_2, RELENG_8_1, RELENG_7_4, or RELENG_7_3 security
branch dated after the correction date.

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to FreeBSD 7.4, 7.3,
8.2 and 8.1 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 7.3 and 7.4]
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot7.patch
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot7.patch.asc

[FreeBSD 8.1 and 8.2]
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot8.patch
# fetch http://security.FreeBSD.org/patches/SA-11:07/chroot8.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile the operating system as described in
http://www.freebsd.org/handbook/makeworld.html> and reboot the
system.

3) To update your vulnerable system via a binary patch:

Systems running 7.4-RELEASE, 7.3-RELEASE, 8.2-RELEASE, or 8.1-RELEASE on
the i386 or amd64 platforms can be updated via the freebsd-update(8)
utility:

# freebsd-update fetch
# freebsd-update install

4) This update adds a new API, __FreeBSD_libc_enter_restricted_mode()
to the C library, which completely disables loading of shared libraries
upon return. Applications doing chroot(2) jails need to be updated
to call this API explicitly right after the chroot(2) operation as a
safety measure.

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

CVS:

Branch Revision
Path
- -------------------------------------------------------------------------
RELENG_7
src/include/unistd.h 1.80.2.4
src/lib/libc/include/libc_private.h 1.17.2.4
src/lib/libc/Versions.def 1.3.2.3
src/lib/libc/net/nsdispatch.c 1.14.2.3
src/lib/libc/gen/Symbol.map 1.6.2.7
src/lib/libc/gen/Makefile.inc 1.128.2.6
src/lib/libc/gen/libc_dlopen.c 1.2.2.2
src/libexec/ftpd/popen.c 1.26.10.2
src/libexec/ftpd/ftpd.c 1.212.2.2
RELENG_7_4
src/UPDATING 1.507.2.36.2.7
src/sys/conf/newvers.sh 1.72.2.18.2.10
src/include/unistd.h 1.80.2.3.4.2
src/lib/libc/include/libc_private.h 1.17.2.3.4.2
src/lib/libc/Versions.def 1.3.2.2.4.2
src/lib/libc/net/nsdispatch.c 1.14.2.2.2.2
src/lib/libc/gen/Symbol.map 1.6.2.6.4.2
src/lib/libc/gen/Makefile.inc 1.128.2.5.4.2
src/lib/libc/gen/libc_dlopen.c 1.2.4.2
src/libexec/ftpd/popen.c 1.26.10.1.2.2
src/libexec/ftpd/ftpd.c 1.212.2.1.6.2
RELENG_7_3
src/UPDATING 1.507.2.34.2.11
src/sys/conf/newvers.sh 1.72.2.16.2.13
src/include/unistd.h 1.80.2.3.2.2
src/lib/libc/include/libc_private.h 1.17.2.3.2.2
src/lib/libc/Versions.def 1.3.2.2.2.2
src/lib/libc/net/nsdispatch.c 1.14.2.1.6.2
src/lib/libc/gen/Symbol.map 1.6.2.6.2.2
src/lib/libc/gen/Makefile.inc 1.128.2.5.2.2
src/lib/libc/gen/libc_dlopen.c 1.1.2.1
src/libexec/ftpd/popen.c 1.26.24.2
src/libexec/ftpd/ftpd.c 1.212.2.1.4.2
RELENG_8
src/include/unistd.h 1.95.2.2
src/lib/libc/include/libc_private.h 1.20.2.3
src/lib/libc/Versions.def 1.8.2.3
src/lib/libc/net/nsdispatch.c 1.18.2.3
src/lib/libc/gen/Symbol.map 1.21.2.6
src/lib/libc/gen/Makefile.inc 1.144.2.7
src/lib/libc/gen/libc_dlopen.c 1.1.4.2
src/libexec/ftpd/popen.c 1.26.22.3
src/libexec/ftpd/ftpd.c 1.214.2.3
RELENG_8_2
src/UPDATING 1.632.2.19.2.7
src/sys/conf/newvers.sh 1.83.2.12.2.10
src/include/unistd.h 1.95.2.1.6.2
src/lib/libc/include/libc_private.h 1.20.2.2.4.2
src/lib/libc/Versions.def 1.8.2.2.4.2
src/lib/libc/net/nsdispatch.c 1.18.2.2.2.2
src/lib/libc/gen/Symbol.map 1.21.2.5.2.2
src/lib/libc/gen/Makefile.inc 1.144.2.6.2.2
src/lib/libc/gen/libc_dlopen.c 1.2.8.2
src/libexec/ftpd/popen.c 1.26.22.2.4.2
src/libexec/ftpd/ftpd.c 1.214.2.1.6.2
RELENG_8_1
src/UPDATING 1.632.2.14.2.10
src/sys/conf/newvers.sh 1.83.2.10.2.11
src/include/unistd.h 1.95.2.1.4.2
src/lib/libc/include/libc_private.h 1.20.2.2.2.2
src/lib/libc/Versions.def 1.8.2.2.2.2
src/lib/libc/net/nsdispatch.c 1.18.2.1.4.2
src/lib/libc/gen/Symbol.map 1.21.2.3.2.2
src/lib/libc/gen/Makefile.inc 1.144.2.4.2.2
src/lib/libc/gen/libc_dlopen.c 1.2.10.2
src/libexec/ftpd/popen.c 1.26.22.2.2.2
src/libexec/ftpd/ftpd.c 1.214.2.1.4.2
RELENG_9
src/include/unistd.h 1.101.2.2
src/lib/libc/include/libc_private.h 1.26.2.2
src/lib/libc/Versions.def 1.9.2.2
src/lib/libc/net/nsdispatch.c 1.19.2.2
src/lib/libc/gen/Symbol.map 1.38.2.2
src/lib/libc/gen/Makefile.inc 1.159.2.2
src/lib/libc/gen/libc_dlopen.c 1.1.6.2
src/lib/libc/iconv/citrus_module.c 1.1.2.2
src/libexec/ftpd/popen.c 1.27.2.2
src/libexec/ftpd/ftpd.c 1.220.2.2
RELENG_9_0
src/include/unistd.h 1.101.2.1.2.2
src/lib/libc/include/libc_private.h 1.26.2.1.2.2
src/lib/libc/Versions.def 1.9.2.1.2.2
src/lib/libc/net/nsdispatch.c 1.19.2.1.2.2
src/lib/libc/gen/Symbol.map 1.38.2.1.2.2
src/lib/libc/gen/Makefile.inc 1.159.2.1.2.2
src/lib/libc/gen/libc_dlopen.c 1.2.6.2
src/lib/libc/iconv/citrus_module.c 1.1.2.1.2.2
src/libexec/ftpd/popen.c 1.27.2.1.2.2
src/libexec/ftpd/ftpd.c 1.220.2.1.2.2
- -------------------------------------------------------------------------

Subversion:

Branch/path Revision
- -------------------------------------------------------------------------
stable/7/ r228843
releng/7.4/ r228843
releng/7.3/ r228843
stable/8/ r228843
releng/8.2/ r228843
releng/8.1/ r228843
stable/9/ r228843
releng/9.0/ r228843
- -------------------------------------------------------------------------

VII. References

The latest revision of this advisory is available at
http://security.FreeBSD.org/advisories/FreeBSD-SA-11:07.chroot.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.18 (FreeBSD)

iEYEARECAAYFAk70nOoACgkQFdaIBMps37ILmgCgjVxRH+NsPpnXOVdwWmuxlSDp
h9wAniE0tokORcqQlFJim5Pc1Z65ybwl
=45yE
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"

Friday, December 16, 2011

[FreeBSD-Announce] FreeBSD Foundation&apos;s End-of-Year Newsletter

Dear FreeBSD Community,

We are pleased to announce the publication of The FreeBSD Foundation's
2011 End-of-Year Newsletter.

Go to http://www.freebsdfoundation.org/press/2011Dec-newsletter.shtml
to find out how we have supported the FreeBSD Project and community
this year.

Please help us continue and increase our support of FreeBSD by making
a donation to the Foundation. You can go to
http://www.freebsdfoundation.org/donate/
to find out how to make a donation.


Sincerely,


The FreeBSD Foundation


_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"

Wednesday, December 14, 2011

[FreeBSD-Announce] FreeBSD Foundation&apos;s End-of-Year Newsletter

Dear FreeBSD Community,

We are pleased to announce the publication of The FreeBSD Foundation's
2011 End-of-Year Newsletter.

Go to http://www.freebsdfoundation.org/press/2011Dec-newsletter.shtml
to find out how we have supported the FreeBSD Project and community
this year.

Please help us continue and increase our support of FreeBSD by making
a donation to the Foundation. You can go to
http://www.freebsdfoundation.org/donate/
to find out how to make a donation.


Sincerely,


The FreeBSD Foundation

_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"

[FreeBSD-Announce] FreeBSD Foundation&apos;s End-of-Year Newsletter

Dear FreeBSD Community,

We are pleased to announce the publication of The FreeBSD Foundation's
2011 End-of-Year Newsletter.

Go to http://www.freebsdfoundation.org/press/2011Dec-newsletter.shtml
to find out how we have supported the FreeBSD Project and community
this year.

Please help us continue and increase our support of FreeBSD by making
a donation to the Foundation. You can go to
http://www.freebsdfoundation.org/donate/
to find out how to make a donation.


Sincerely,


The FreeBSD Foundation
_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"

Monday, December 5, 2011

[FreeBSD-Announce] FreeBSD Foundation End-of-Year Fundraising Campaign!

Dear FreeBSD Community,

The FreeBSD Foundation has been proudly supporting the FreeBSD Project
and community for 11 years now. Every year we sponsor BSD conferences
and events around the globe, help developers with their travel expenses
to attend these conferences, work to protect the intellectual property
of the FreeBSD project, visit institutions and corporations to promote
the use of FreeBSD, purchase equipment to grow the FreeBSD
infrastructure, and fund research and development projects that enhance
the FreeBSD OS.

We are deeply grateful for all the support we receive from so many
individuals and organizations who value FreeBSD. We currently are at the
half way point towards our goal of raising $400,000 this year. We are
hoping that you, the FreeBSD community, will help us meet our goal by
making a donation this month. By donating to the foundation, you are
donating to the FreeBSD Project and community as a whole.

I have had the privilege of meeting many FreeBSD enthusiasts in person,
through email, and on the phone. I am always impressed with the passion
that these people have for FreeBSD. Most volunteer their precious time
after work and some are more fortunate where they actually get paid by
their companies to work with FreeBSD. When there is a BSD related
conference we usually get quite a few travel grant applications
requesting help with developers' travel expenses. Thanks to your
support, we have been able to sponsor the travel expenses of developers
from Mexico, Lithuania, New Zealand, Germany, Japan, Denmark, and many
other countries.

Some of these developers recently wrote personal stories about how
receiving help with their travel expenses to attend conferences helped
them with their FreeBSD work. These stories will be published in our
upcoming newsletter. One developer from Japan, whose attendance we've
sponsored more than once, is a technical writer. He told me that the
Japanese development community is comprised of earnest and skillful
people. They are sharp programmers who know many programming languages,
but learning and understanding English is difficult for many of them. He
attends the conferences so he can keep up with the latest FreeBSD
information and provide this information to the Japanese FreeBSD
community in their native spoken language.

Another recent travel grant recipient runs a FreeBSD mirror server in
Sweden, a country that apparently does not have many BSD users. He had a
chance to meet many FreeBSD developers for the first time by attending
EuroBSDCon. He has recently started submitting patches to our FreeBSD
documentation set, and will hopefully become a committer, literally
doubling the number of committers in Sweden!

Lastly, a Canadian developer that we've sponsored told us, "By attending
these conferences I have gained valuable experience, connected with
fascinating people that use FreeBSD, learned from presenters and most
importantly, forged some friendships that will last a lifetime."

These grant recipients have given far more back to the FreeBSD community
than what they have received from the foundation. And, this is only one
area where your donations provide a significant, tangible, measurable
benefit for the entire FreeBSD community.

If you benefit from FreeBSD, please donate. With your donation, we can
continue to support FreeBSD activities like:

- development projects to support emerging technologies such as IPv6
support in FreeBSD, GEM, KMS, and DRI support for Intel drivers, Five
New TCP Congestion Control Algorithms, and much more.
- BSD conferences around the globe, including Europe, Japan, Canada, US,
and Ukraine.
- giving students and contributors the opportunity to attend conferences
and developer summits.
- maintaining the infrastructure of computers and equipment that support
our community.
- growing the FreeBSD community through marketing and outreach to users
and businesses.
- protecting the FreeBSD trademarks and providing the project with
access to legal counsel.
- helping FreeBSD continue to serve as the foundation for research and
enterprise.

Please consider making a donation so we can continue -- and increase our
support of the FreeBSD Project and community! Making a donation is easy
and quick. Please visit The FreeBSD Foundation website to find out how
you can make a difference for FreeBSD today.


Thank you for your support!

Sincerely,

Deb Goodkin
Secretary/Treasurer
The FreeBSD Foundation

_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"

Tuesday, November 8, 2011

[FreeBSD-Announce] FreeBSD Status Report July-September, 2011

FreeBSD Quarterly Status Report - Q3/2011

Introduction

This report covers FreeBSD-related projects between July and September
2011. It is the third of the four reports planned for 2011. This
quarter was mainly devoted to polishing the bits for the next major
version of FreeBSD, 9.0, which is to be released by then end of this
year.

Thanks to all the reporters for the excellent work! This report
contains 28 entries and we hope you enjoy reading it.

Please note that the deadline for submissions covering the period
between October and December 2011 is January 15th, 2012.
__________________________________________________________________

Projects

* GELI status update
* HAST (Highly Available Storage) status update
* pfSense
* Tool for providing FreeBSD VM Images
* ZFSguru
* ZRouter.org project -- a FreeBSD-based firmware for embedded
devices

FreeBSD Team Reports

* Ports Collection
* The FreeBSD Foundation
* The FreeBSD Release Engineering Team

Network Infrastructure

* 802.11n / atheros
* DIstributed Firewall and Flow-shaper Using Statistical Evidence
(DIFFUSE)
* Ethernet Switch Framework

Kernel

* The new CARP
* VM layer for allocations larger than a page

Documentation

* Doc sprint on IRC, September 5, 2011
* The FreeBSD German Documentation Project Status Report
* The FreeBSD Greek Documentation Project
* The FreeBSD Japanese Documentation Project

Architectures

* FreeBSD/arm on Marvell Armada XP
* FreeBSD/powerpc on AppliedMicro APM86290

Ports

* FreeBSD Haskell Ports
* KDE-FreeBSD
* OpenAFS port
* Portmaster

Miscellaneous

* bsd_day(2011)
* EuroBSDcon 2011
* FreeBSD Developer Summit, Maarssen

Google Summer of Code

* Multibyte Encoding Support in Nvi
__________________________________________________________________

802.11n / atheros

URL: http://wiki.FreeBSD.org/AdrianChadd/AtherosTxAgg

Contact: Adrian Chadd

AR5416, AR9160, and AR9280 functions in both station and hostap mode.
Performance is good.

Software retry of frames is implemented. Aggregation is implemented.

BAR TX is not yet handled. HT protection is not implemented; neither is
MIMO powersave.

Open tasks:

1. BAR TX
2. MIMO powersave
3. Correct handling of flushing TX queues during interface
reset/reconfigure
4. Correct handling of 20<->20/40mhz transitions (without dropping
frames)
5. More intelligent rate control
__________________________________________________________________

bsd_day(2011)

URL: http://bsdday.eu/2011

Contact: Martin Matuska
Contact: Gabor Pali

The purpose of this one-day event was to gather Central European
developers of today's open-source BSD systems to popularize their work
and their organizations, and to meet each other in the real life. We
wanted to motivate potential future developers and users, especially
undergraduate university students, to work with BSD systems.

This year's BSD-Day was be held in Bratislava, Slovakia at Slovak
University of Technology, Faculty of Electrical Engineering and
Information Technology on November 5, 2011.
__________________________________________________________________

DIstributed Firewall and Flow-shaper Using Statistical Evidence (DIFFUSE)

URL: http://caia.swin.edu.au/freebsd/diffused/
URL:
http://www.FreeBSDFoundation.org/project%20announcements.shtml#diffuse
URL: http://caia.swin.edu.au/urp/diffuse/
URL: http://caia.swin.edu.au/urp/diffuse/downloads.html

Contact: Sebastian Zander <szander@swin.edu.au>
Contact: Lawrence Stewart <szander@swin.edu.au>
Contact: Grenville Armitage <garmitage@swin.edu.au>

DIFFUSE enables FreeBSD's IPFW firewall subsystem to classify IP
traffic based on statistical traffic properties.

With DIFFUSE, IPFW computes statistics (such as packet lengths or
inter-packet time intervals) for observed flows, and uses ML (machine
learning) to classify flows into classes. In addition to traditional
packet inspection rules, IPFW rules may now also be expressed in terms
of traffic statistics or classes identified by ML classification. This
can be helpful when direct packet inspection is problematic (perhaps
for administrative reasons, or because port numbers do not reliably
identify applications).

DIFFUSE also enables one instance of IPFW to send flow information and
classes to other IPFW instances, which then can act on such traffic
(e.g. prioritise, accept, deny, etc.) according to its class. This
allows for distributed architectures, where classification at one
location in your network is used to control fire-walling or
rate-shaping actions at other locations.

The FreeBSD Foundation has funded the Centre for Advanced Internet
Architectures at Swinburne University of Technology to undertake the
DIFFUSED (DIFFUSE for freebsD) project, which aims to refine our
publicly released DIFFUSE prototype and integrate all components of the
architecture into FreeBSD.

The project is progressing well in the diffused_head project branch of
the FreeBSD Subversion repository, and is due to be completed by the
end of October 2011. Once the project is completed, the code will be
merged from the project branch into the head branch. An MFC of the code
to 8.x and 9.x should be possible after an appropriate amount of soak
time has elapsed.
__________________________________________________________________

Doc sprint on IRC, September 5, 2011

URL: http://people.FreeBSD.org/~bcr/doc/sprints/20110905-final.html

Contact: Benedict Reuschling
Contact: Dru Lavigne

On September 5, we held another documentation sprint on IRC channel
#bsddocs to discuss various issues that are important for the whole
FreeBSD documentation community. We talked about the status of the
planned documentation repository conversion to SVN and the status of
the XML docbook conversion. At that point in time, we did not have any
documentation regarding the new bsdinstaller in the upcoming release,
which would have been very bad for users that were trying to install
the release. Luckily, a small team formed quickly to start working on a
new bsdinstall chapter from scratch using a separate google code
repository that gjb@ had set up.

Some of the topics we discussed were moved forward and their status was
revisited at EuroBSDcon's devsummit documentation session. Before the
end of the conference, we had a new bsdinstall chapter committed into
the official documentation tree, thanks to the efforts put into the new
chapter by Gavin Atkinson, Warren Block, and Glen Barber. Garrett
Cooper provided valuable instructions on the various installation
methods that are possible with the new bsdinstaller. Thanks to all who
helped make this a reality.

It is nice to see that the things we talked about at the documentation
sprint developed further, which is why we are trying to do these
sprints in regular intervalls.

Open tasks:

1. Plan the next documentation sprint
2. Continue working on the issues that are still open like the
conversion of the repository to SVN
__________________________________________________________________

Ethernet Switch Framework

URL:
http://zrouter.org/hg/FreeBSD/head/file/default/head/sys/dev/switch

Contact: Aleksandr Rybalko

Many embedded devices have an Ethernet switch on board; such switches
are even embedded on some multiport NICs. This embedded switch
framework is designed to give users the ability to easily control basic
features present in managed switches, such as VLANs, QoS, port
mirroring, etc. Currently we are able to control only VLANs on:
* Atheros AR8216/AR8316 (standalone and embedded in AR724X)
* Broadcom BCM5325 switch family (also embedded in BCM5354 SoC)
* Ralink RT3050F/RT3052F internal switch
* Realtek RTL8309
* IP175X
* IP178X

Open tasks:

1. Fix AR8216/AR8316 driver
2. Fix BCM5325 driver, not all ports pass data
3. Add tick handler for RTL8309 to automatically unisolate ports
4. Unify MIB statistic counters access
5. Add mii read/write bus methods
6. Implement pseudo interfaces for switch PHYs
__________________________________________________________________

EuroBSDcon 2011

URL: http://2011.eurobsdcon.org/

Contact: EuroBSDcon Organizers <oc-2011@eurobsdcon.org>
Contact: Gabor Pali

The 10th anniversary European BSD Conference was organized in Maarssen,
The Netherlands with more than 250 registered visitors. There were many
interesting tutorials, including introductions to DTrace and working
with Netgraph. It featured 26 high-quality talks and 2 keynote speakers
on various topics related to FreeBSD, OpenBSD, NetBSD, or even MINIX:
OpenBSD PF, NetBSD NPF, IPv6 support in FreeBSD, virtualization in the
BSD domain, recent developments in OpenSSH, exploration of the recent
FreeNAS, system management with ZFS, practical capabilities for UNIX
known as Capsicum.

It also had a dedicated track for the attendees of the FreeBSD
developer summit, where one could learn more about what is happening
currently in the Project. We had presentations on the new package
management solution, Google Summer of Code 2011, a stacked
cryptographic file system, conversion of documents of different
formats, and status reports on the sparc64 port and the NAND flash
support.
__________________________________________________________________

FreeBSD Developer Summit, Maarssen

URL: http://wiki.FreeBSD.org/201110DevSummit

Contact: Gabor Pali

We had 60 FreeBSD developers and invited guests attending the FreeBSD
Developer Summit organized as part of EuroBSDcon 2011 in Maarssen, The
Netherlands. This year EuroBSDcon organizers offered us their generous
support in handling the details, like registrations, renting the venue,
and providing food for keeping attendees happy.

The Maarssen developer summit spanned over 3 days. It is generally a
workshop-style event that has now adopted the layout of the developer
summit organized successfully in Canada earlier in May. On the first
day, there were working groups on various topics, e.g. Capsicum,
toolchain issues, ports, and documentation. On the second day, there
were various plenary discussions, like how FreeBSD relates to
virtualization or how vendors relate to FreeBSD. Finally, on the third
day, there were many interesting work-in-progress reports given in a
dedicated developer summit track at the main conference.

Photos and slides for the most of the talks are available on the home
page of the summit.
__________________________________________________________________

FreeBSD Haskell Ports

Contact: Gabor Janos PaLI
Contact: Ashish SHUKLA

We updated existing ports to their latest versions and hunted down a
bug in the 9-CURRENT rtld which was causing GHC to crash
intermittently. We also started work on Haskell Platform 2011.3.0.0
(development version) in a separate git branch in our development
repository.

Open tasks:

1. Test GHC to work with clang/LLVM.
2. Add an option to the GHC port to be able to build it with already
installed GHC instead of requiring a separate GHC boostrap tarball.
3. Update Haskell Platform (along with GHC) to 2011.4.0.0 as soon as
it gets out.
4. Add more ports to the Ports collection.
__________________________________________________________________

FreeBSD/arm on Marvell Armada XP

Contact: Grzegorz Bernacki <gjb@semihalf.com>
Contact: Rafal Jaworowski <raj@semihalf.com>

Marvell Armada XP is a complete system-on-chip solution based on the
Sheeva embedded CPUs. These devices integrate up to four ARMv6/v7
compliant Sheeva CPU cores with shared L2 cache.

This work is extending FreeBSD/arm infrastructure towards support for
recent ARM architecture variations along with a basic set of device
drivers for integrated peripherals.

The following code has been implemented since the last status report:
* PCI-Express support
* SMP support
*
+ Created framework for ARM platform dependent code.
+ Initialization and starting of Application Processor.
+ Implementation of sending/handling IPI

Next steps:
* Finalize SMP support (TLB/cache operation broadcast, etc.)
* L2 cache support
* SATA driver
__________________________________________________________________

FreeBSD/powerpc on AppliedMicro APM86290

Contact: Grzegorz Bernacki <gjb@semihalf.com>
Contact: Rafal Jaworowski <raj@semihalf.com>

The APM86290 system-on-chip device is a member of AppliedMicro's
PACKETpro family of embedded processors.

The chip includes two Power Architecture PPC465 processor cores, which
are compliant with the Book-E specification of the architecture, and a
number of integrated peripherals.

This work is extending current Book-E support in FreeBSD towards PPC4xx
processor variants along with device drivers for integrated
peripherials.

The following drivers have been created since the last report:
* Interrupt controller
* EHCI USB driver attachment
* Queue Manager/Traffic Manager support
* Initial support of Ethernet controller
* GPIO, I2C

Next steps:
* Finalize Ethernet controller driver
* L2 cache support
__________________________________________________________________

GELI status update

Contact: Pawel Jakub Dawidek

Selected GELI (disk encryption GEOM class) changes since 2010/Q3
report:
* Implementation of suspend/resume functionality.
* New version subcommand to check GELI providers version.
* New -V option for init subcommand, which allows to create GELI
providers for older FreeBSD versions.
* Significant aesni(4) performance improvements for AES-XTS
algorithm.
__________________________________________________________________

HAST (Highly Available Storage) status update

Contact: Pawel Jakub Dawidek

Contact: Mikolaj Golub

HAST is under active development. Some changes since Q1 report:
* Async replication mode. Unfortunately it will not make it into
9.0-RELEASE (pjd@).
* IPv6 support (pjd@).
* Activemap fix that significantly reduces number of metadata updates
(trociny@).
* Provider's write cache flush after metadata updates (pjd@).
* Possibility to specify pidfile in configuration file (pjd@).
* Many bug fixes and other improvments.
__________________________________________________________________

KDE-FreeBSD

URL: FreeBSD.kde.org
URL:
http://dot.kde.org/2011/06/29/platform-frameworks-kde-hackers-meet-swit
zerland
URL:
http://blogs.FreeBSDish.org/avilla/2011/06/14/call-for-tests-kde-pim-4-
6-0
URL: http://FreeBSD.kde.org/area51.php

Contact: KDE FreeBSD <kde-freebsd@kde.org>

Alberto Villa and Raphael Kubo da Costa went to Randa, Switzerland, to
attend, respectively, the KDE Multimedia/Kdenlive sprint and the
Platform 11 sprint. The sprints afforded them the opportunity to form
closer bonds with the upstream KDE community, to learn about the future
of Qt and KDE and make sure FreeBSD's needs are taken into account. For
more information see the article "From Platform to Frameworks -- KDE
hackers meet in Switzerland" at dot.kde.org.

The KDE on FreeBSD team have continued to improve the experience of KDE
and Qt under FreeBSD. The latest round of improvements include:
* Qt supports Clang as a compiler

The team has also made many releases and upstreamed many fixes and
patches. The latest round of releases include:
* Qt: 4.7.3
* KDE: 4.6.3; 4.6.4; 4.6.5
* Amarok: 2.4.1
* Digikam (and KIPI-plugins): 1.9.0

Further testing is requested for KDE PIM 4.6.0 and Calligra 2.3.72
before the ports are committed. To test the ports please visit Alberto
Villa's call for test and area51.

The team is always looking for more testers and porters so please visit
us at kde-freebsd@kde.org and our homepage.

Open tasks:

1. Testing KDE PIM 4.6.0
__________________________________________________________________

Multibyte Encoding Support in Nvi

URL: http://wiki.FreeBSD.org/ZhihaoSoC2011
URL: https://github.com/lichray/nvi2

Contact: Zhihao Yuan <lichray@gmail.com>

nvi-iconv keeps the behaviors and the license of nvi-1.79 in the base
system and adopts the multibyte encoding support from nvi-1.8x.

Status:
* Known memory leaks, bugs are fixed. make buildworld clear, under
WARNS=1 (the old one was WARNS=0).
* UTF-16 is supported with less hacks.
* The 'windowname' option now restores the xterm title through xprop.
* The file encoding detection modified from file(1) is finished and
considered stable. The detection is always on since nvi-iconv never
change the actual encoding, and the detection failbacks to locale.
* Pavel Timofeev provided a full Russian translation of the catalog.
Thanks to him.
* Now nvi-iconv is able to be compiled with widechar only and without
iconv (inspired by a user on FreeBSDChina.org). In that case, it
only supports your locale.

Open tasks:

1. The wide character support in nvi's message (feedback over the last
line) system.
2. Collect more testing results and get code review.
__________________________________________________________________

OpenAFS port

URL: http://openafs.org
URL: http://wiki.FreeBSD.org/afs

Contact: Benjamin Kaduk <kaduk@mit.edu>
Contact: Derrick Brashear <shadow@gmail.com>

AFS is a distributed network filesystem that originated from the Andrew
Project at Carnegie-Mellon University. OpenAFS 1.6.0 has released, and
is available in the FreeBSD Ports Collection; it is usable under light
load, but heavy usage reveals some issues that remain unresolved. The
OpenAFS kernel module is now built using the bsd.kmod.mk infrastructure
on the git master branch; unfortunately this change required a minor
change in the OS-independent Makefiles and could not be merged in time
for 1.6.0. Some attention has been given to memory leaks, but only one
small leak has been patched so far.

There are several known outstanding issues that are being worked on,
but detailed bug reports are welcome at port-freebsd@openafs.org.

Open tasks:

1. Update VFS locking to allow the use of disk-based client caches as
well as memory-based caches.
2. Track down races and deadlocks that may appear under load.
3. Eliminate a moderate memory leak from the kernel module.
4. PAG (Process Authentication Group) support is not functional.
__________________________________________________________________

pfSense

URL: http://www.pfsense.org/

Contact: Scott Ullrich <sullrich@gmail.com>
Contact: Chris Buechler <cbuechler@gmail.com>

pfSense 2.0 has been released to the world. This brings the past three
years of new feature additions, with significant enhancements to almost
every portion of the system. The changes and new features are
summarized here. This is by far the most widely deployed release we
have put out, thanks to the efforts of thousands of members of the
community.

Open tasks:

1. Work on 2.1 is underway with the biggest changes being IPV6 support
and PBI packaged binaries for the package system.
__________________________________________________________________

Portmaster

URL: http://dougbarton.us/portmaster-proposal.html

Contact: Doug Barton

Portmaster offers several new features since the last quarterly update;
some bug fixes for the package installation code, and various internal
optimizations. The most exciting new feature is probably the ability to
specify the -r option more than once for the same portmaster run. This
greatly increases efficiency when several "branch" and/or "trunk" ports
need updates at the same time, especially for package-building systems.

Open tasks:

1. Splitting out the fetch code is still "on the list" of work to be
done, but it was sidetracked by other priorities in the past
months. I hope to complete it in the quarter to come.
2. Another new feature in the works is support for a list of files for
portmaster to preserve and restore during upgrades of a port.
__________________________________________________________________

Ports Collection

URL: http://www.FreeBSD.org/ports/
URL:
http://www.FreeBSD.org/doc/en_US.ISO8859-1/articles/contributing-ports/
URL: http://portsmon.FreeBSD.org/index.html
URL: http://www.FreeBSD.org/portmgr/index.html
URL: http://blogs.FreeBSDish.org/portmgr/
URL: http://www.twitter.com/freebsd_portmgr/
URL: http://www.facebook.com/group.php?gid=135441496471197

Contact: Thomas Abthorpe
Contact: Port Management Team

The ports tree slowly moves up closer to the 23,000 mark. The PR count
still remains at about 1000.

In Q2 we added 4 new committers, but took in 6 commit bits for safe
keeping.

The Ports Management team have been running -exp runs on an ongoing
basis, verifying how base system updates may affect the ports tree, as
well as providing QA runs for major ports updates. Of note, -exp runs
were done for:
* Python update
* Boost updates
* Gtk3 updates
* clang testing
* pkgng testing
* testing ruby19
* setting the default fortran to lang/gcc46
* setting apache22 as default
* setting the default LDFLAGS in CONFIGURE_ENV

Work continues to refine the new build master pointyhat-west. An
upgrade to -current done in September has proven problematic. We have
enlisted ISC and Josh Paetzel to try to determine a fix. In the
meantime, the source will be downgraded to RELENG_9.

The portsmon instance is being re-homed at Yahoo. Users should not see
any changes. The new instance is currently visible at
portsmonj.FreeBSD.org but will soon take on the portsmon.FreeBSD.org
name. The team would like to express its appreciation to TDC A/S for
the loan of the existing machine for several years.

Work is underway to create a new QAT instance at NYI/NJ.

portmgr also assisted in setting up a sparc64 machine for general
develop access at Yahoo.

Thanks to on-site work by Sean Bruno and Ben Haga, we once again have
access to the powerpc build machine at ISC, and powerpc builds have
been restarted. They also helped us get one more i386 machine back
online.

linimon is working on a set of scripts to more quickly produce
pre-configured PXEboot images for package build nodes.

The update of __FreeBSD_version in param.h to 1000000 proved very
disruptive to the ports tree, triggering lots of bad assumption in code
that interpreted it as FreeBSD 1. A great deal of work has gone into
identifying the instances of broken code and fixing and upstreaming
them. While this is taking place, one recommended workaround is to set
your version to 999999.

Open tasks:

1. Looking for help getting ports to build with clang.
2. Looking for help fixing ports broken on CURRENT. (List needs
updating, too)
3. Looking for help with Tier-2 architectures. (List needs updating,
too)
4. Most ports PRs are assigned, we now need to focus on testing,
committing and closing.
__________________________________________________________________

The FreeBSD Foundation

URL: http://www.FreeBSDFoundation.org/

Contact: Deb Goodkin

The Foundation sponsored KyivBSD 2011 which was held in Kiev, Ukraine
on September 24. We were represented at Ohio LinuxFest in Columbus,
Ohio. And, we approved six travel grants for EuroBSDCon. Stop by and
visit us at the FreeBSD booth during LISA '11, December 7-8, in Boston,
MA.

Three Foundation funded projects were completed during this period:
implementing xlocale APIs to enable porting libc++ by David Chisnall,
implementing DIFFUSE for FreeBSD by Swinburne University, and adding
GEM, KMS, and DRI support for Intel drivers by Konstantin Belousov.

We published our semi-annual newsletter. We purchased servers and other
hardware for the FreeBSD co-location centers at Sentex and NYI.

The work above, as well as many other tasks which we do for the FreeBSD
Project, could not be done without donations. Please help us by making
a donation or asking your company to make a donation. We would be happy
to send marketing literature to you or your company. Find out how to
make a donation at our donate page.

Find out more up-to-date Foundation news by reading our blog and
Facebook page.
__________________________________________________________________

The FreeBSD German Documentation Project Status Report

URL: https://doc.bsdgroup.de

Contact: Johann Kois
Contact: Benedict Reuschling

We managed to update the German version of the documentation just in
time to get it included in the upcoming 9.0-RELEASE. The website
translations were also kept in sync with the ones on FreeBSD.org.

We tried to re-activate committers who did not contribute for some time
but most of them are currently unable to free up enough time. We hope
to gain fresh contributor blood as we are getting occasional reports
about bugs and grammar in the German translation.

Open tasks:

1. Submit grammar, spelling or other errors you find in the German
documents and the website
2. Translate more articles and other open handbook sections
(especially the new chapter about the new FreeBSD installer).
__________________________________________________________________

The FreeBSD Greek Documentation Project

URL: http://www.FreeBSDgr.org
URL: http://www.FreeBSD.org/doc/el/books/handbook

Contact: Manolis Kiagias
Contact: Giorgos Keramidas

After a few rather quiet months, the FreeBSD Greek Documentation
Project is back on track, translating and improving the Handbook, FAQ
and FreeBSD articles. The new bsdinstall chapter has been translated
and is now present in the Handbook. Our experimental Handbook builds
are also available at the project's hub. Three new status pages have
been added:
* Merge Status for the en_US tree shows whether the local en_US repo
is in sync with the official CVS
* Merge Status for the el_GR tree - as above but for the Greek tree
* Pending Commits shows newer yet to be committed versions of the
Greek docs

For more information, please visit http://www.freebsdgr.org. Patches,
fixes and contributions are always welcome.

Open tasks:

1. Translate the remaining chapters of the Handbook to Greek.
2. Complete the translation of the FreeBSD FAQ.
3. Keep the currently translated docs in sync with the English
versions.
__________________________________________________________________

The FreeBSD Japanese Documentation Project

URL: http://www.FreeBSD.org/ja/
URL: http://www.jp.FreeBSD.org/doc-jp/

Contact: Hiroki Sato
Contact: Ryusuke Suzuki

The www/ja and doc/ja_JP.eucJP/books/handbook subtrees have constantly
been updated since the last report.

www/ja: During this period, many areas of outdated content in the
www/ja subtree were updated to the latest versions in the English
counterparts. The Japanese version of 8.2R release announcement was
added and the upcoming 9.0R announcement will be translated in a timely
manner.

Handbook: The Japanese "kernelconfig" section finally caught up with
the original English version. The next targets are "cutting-edge" and
new installer section.

Open tasks:

1. Further translation work for outdated documents in both
doc/ja_JP.eucJP and www/ja.
__________________________________________________________________

The FreeBSD Release Engineering Team

URL: http://www.FreeBSD.org/releng/

Contact: Release Engineering Team

The Release Engineering Team has been coordinating the upcoming FreeBSD
9.0-RELEASE. Thanks to work done by many of the developers. The
release, though delayed, is taking the shape nicely. We have reached
the stage of doing the second Release Candidate. At this time we expect
to have one more Release Candidate, to be followed by the final release
itself.
__________________________________________________________________

The new CARP

URL: http://people.FreeBSD.org/~glebius/newcarp/

Contact: Gleb Smirnoff

I am now working on significant rewrite of CARP in FreeBSD.

The reason for this work is that the CARP protocol actually does not
bring a new interface, but is a property of interface address.
Rewriting it in this way helps to remove several hacks from incoming
packet processing, simplifies some code, makes CARP addresses more sane
from the viewpoint of routing daemons such as quagga/zebra and closes
many CARP-related PRs in GNATS. It also brings support for a single
redundant address on the subnet, the thing that is called "carpdev
feature" in OpenBSD, long awaited in FreeBSD.

For this moment I have a patch against head/ that compiles and works in
my test environment that I am going to deploy soon on some of servers
under my control.

The patch has been reviewed by Bjoern Zeeb (bz@).

Open tasks:

1. More testing requested!
2. Implement arpbalance and ipbalance features. This requires a next
step of rewriting, probably borrowing some ideas from OpenBSD.
3. Update documentation.
__________________________________________________________________

Tool for providing FreeBSD VM Images

URL: https://github.com/yerenkow/freebsd-vm-image

Contact: Alexander Yerenkow <yerenkow@gmail.com>

A set of scripts to make building FreeBSD VM images easy.

Providing a way to make regular build images of the latest version from
SVN. Images currently can be copied with `dd` to USB flash (for testing
on real hardware) and VirtualBox (.vdi).

Open tasks:

1. Build images with ports-set from main port-tree
2. Build images with ports-set from main port-tree plus overrides form
area51 (like experimental images)
3. Build images with special development branches included (like for
testing drivers)
__________________________________________________________________

VM layer for allocations larger than a page

Contact: Alan Cox
Contact: Davide Italiano <davide.italiano@gmail.com>

The aim of this project is to create a new layer that sits between UMA
and the virtual memory system managing chunks of kernel virtual memory
on the order of 2 to 4 MB in size. At the end of the work, UMA
page_alloc() would no longer call directly into the VM system. It would
instead call into this new layer. Thus, uma_large_malloc() and
uma_large_free() would no longer be immediately allocating and
deallocating kernel virtual memory. This results in a gain in terms of
performances (there is a relatively high cost in the approach adopted
until now), and also in terms of reduction of fragmentation (the VM
system uses a first-fit policy of allocation so there is room for
improvements).
__________________________________________________________________

ZFSguru

URL: http://zfsguru.com
URL: http://zfsguru.com

Contact: Jason Edwards

ZFSguru is a newly designed Network Attached Storage operating system,
much like FreeNAS. The difference is that ZFSguru focuses heavily on
ZFS and user friendly operation, and uses a full FreeBSD distribution
with no elements stripped down. This allows people new to FreeBSD and
UNIX in general to access the power of ZFS, while still allowing more
advanced users to tweak their NAS with additional functionality and use
it as a normal FreeBSD distribution.

Started a little over a year ago, the ZFSguru project is making good
progress. It should already be one of the most user friendly
distributions focused on ZFS, and sports some very unique features. The
advanced ZFS benchmarking and convenient Root-on-ZFS installation are
good examples. Priority is given to finishing the missing core
functionality, and extending the number of available service addons
which currently are limited to iSCSI-target and VirtualBox extensions.

Open tasks:

1. Finish ZFS and network related functionality in the web-interface.
2. Introduce new service addons, adding optional functionality to
ZFSguru.
3. Extend the documentation.
__________________________________________________________________

ZRouter.org project -- a FreeBSD-based firmware for embedded devices

URL: http://zrouter.org
URL: http://lists.zrouter.org
URL: http://zrouter.org/hg/zrouter/
URL: http://zrouter.org/hg/FreeBSD/head/

Contact: Aleksandr Rybalko

ZRouter.org is a young project that aims to produce FreeBSD-based
firmware for small boxes such as SOHO router, APs, etc. At the present
time ZRouter.org is able to build working firmware for:
* D-Link DAP-1350
* D-Link DIR-320
* D-Link DIR-320-NRU
* D-Link DIR-330
* D-Link DIR-615-E4
* D-Link DIR-620
* D-Link DIR-632
* D-Link DSA-3110-A1
* D-Link DSR-1000N
* NorthQ NQ-900
* TPLink TL-WR941ND-v3_2
* Ubiquiti RSPRO

Currently we are working on most parts of the core system but we are
also in the planning phase for implementing a simple web-based GUI
which we hope will have taken form before the next FreeBSD status
report.

We still have many items not done, so devices in that list cannot be
called "Production Ready" yet. But we work on that.

It is easy to add new devices, because we have separate definition of
board and SoC(System on Chip), so if you have "Asus WL-500g Premium v2"
for example, you can copy D-Link/DIR-320 directory and tweak to work
for your device. We already have basic support for:
* Broadcom BCM5354
* Broadcom BCM5836
* Ralink RT3052F
* Ralink RT3050F
* Ralink RT5350F
* Atheros AR7161
* Atheros AR7242
* Atheros AR7241
* Atheros AR7240
* Atheros AR9132
* Intel ixp435
* Cavium CN5010

If you have ability and time, please join us at http://zrouter.org
(Redmine iface and mailing lists)

Open tasks:

1. Device drivers
2. Web UI
3. Control scripts
4. Watchdog
5. etc.
__________________________________________________________________

(c) 1995-2011 The FreeBSD Project. All rights reserved.
_______________________________________________
freebsd-announce@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"