Sunny summer ?

Hi folks,

The sun is surprisingly present these days in the emerald island !

Couple of tiny updates, took my first take at golang mainly targeted at FreeBSD (anyway the usual OpenBSD contributors are already doing an excellent work :-)), small things really just adding get random support for FreeBSD 12.x we ll see in November ...

About the future php 7.3 version, the feature freeze time is for August ; so i try to push in similar manner this new getrandom usage ... Beyond that a lot of zend engine optimisations had been done since 7.2 among other things.

And LLVM, as promised now OpenBSD is able to run most of UBsan unit tests, for next will try to make available X-ray and maybe fuzzer ones.

Also noted gzdoom is going to be available as package on OpenBSD, after LMMS ; things start to be visible slowly but surely ;-) ...

Finally contributed to musl libc, pretty well reputated, to add explicit_bzero. They just started to discuss adding an arc4random implementation, the hardest part is the blocking side as always ... I do not think they will choose Chacha family though but ... we ll see.

Professionally a little loop back to Windows programming very shortly back to unixes :)

Enjoy your summer !

Stack smashing protection by default on FreeBSD and other things ...

Hi folks,

Recently, the Stack Smashing Protection is enabled by default in ports, hence -fstack-protector flag is added which protects against stack buffer overflow (This feature is by default on OpenBSD since ... 12 years). So, concretally, what is the purpose ? Let's try by an example ... with our C wrapper for change ;-)

#include <mtld/devatlas-c.h>
#include <stdio.h>
int
main(int argc, char *argv[])
{
       mobi_devatlas *atlas;
       mobi_devatlas_ctx *ctx;
       mobi_http_header headers[1] = { 0 };
       char buf[10];
       printf("Please enter an user agent:\n");
       /* Bad idea !! but this is just for the sake of the example */
       gets(buf);
       atlas = mobi_mtld_da_init(NULL);
       if (atlas != NULL)
       {
               headers[0].name = "user-agent";
               headers[0].value = buf;
               ctx = mobi_mtld_da_ctx_init(atlas, NULL, headers, 1, NULL);
               ... etc ...
       }
}

In first glance, that looks good. Sure. But what if the user type more than 10 characters ? Buffer overflow. gets does not perform any boundaries checking ...
In that case, with this stack protection flag, you can get this kind of message "stack overflow detected" then the program aborts ... One detail ... that does NOT protect for attacks in the heap.

About HardenedBSD, I added recently my second syscall, getdtablecount which gives you the number of file descriptors open by the current process, that comes from OpenBSD (Linux has a similar function I think with a different name...) so hopefully the maintainer of the FreeBSD relayd port (load balancer from OpenBSD), for example, can find usefulness ... indeed OpenBSD version uses this to protect against Dos attacks. Unluckily, another syscall, ppoll (I think the Linux emulation layer needs this ...) arrived the same time, so we got some conflicts with syscalls ids on git at some point :-)

Working on both OpenBSD and FreeBSD is a great advantage for me as if I need to port something, it is quite fast in general !

Ah another small detail, my port of arc4random is merged in master branch :-)

Outside of pure technical topics, Shawn Webb began to get our development servers and began to play with Jenkins (which, honestly, I find it much better than I thought...). Now that he wants to take care of HardenedBSD communication, I prefer to let him speaks about what he and Oliver do specifically and the "biggest picture" as well ... But you can be sure they have numerous great ideas to add ;-)

PIC my PIE

Hi folks,

Quite a lot of events happen since the last time. some awesome features mostly done by Shawn and Oliver like a mprotect protection which blocks a memory area to be set as executable if, it in first place, it was not set this way. An official Intel SMAP support was added lately. In my side, what I mentioned previously, arc4random (kernel and userland) updates (chacha 20 + minherit new flag INHERIT_ZERO) then adding getentropy syscall are done and merged. Plus, at the moment, I continue the work started by Shawn about the integration of PIC (Position Independant Code) on some libraries and PIE (Position Independant Executable) in a subset of binaries (let's say the most popular attack targets) ... for a start, rather than to apply it widely. The discussion about it started already on arch@ and it goes not badly ... The hope is, for sure, to push it upstream. Few of my under/overflow fixes on base were pushed (like sysctl) for last ...

As many of my fellows, I eat my own "dog food", hence I have a guenine laptop which runs HardenedBSD (and not only in a VM ;-)) daily, ... was important, for example, to test arc4random (used for so many things like creating processes id ...) widely by provoking many events ... compiling ... launching various daemons etc etc ... during hours.

Apart of pure technical topics, Shawn was able to desposit HardenedBSD and it is mentioned in FreeBSD Quaterly report ... Once ASLR is pushed upstream other security features would be as well ... Nice ! it is getting concrete :-)

For next, some features and fixes are planned. Plus a little something in my side ... hopefully ;-)

EuroBSDCon 2014, arc4random and co ...

Hi folks,

As expected, the last EuroBSDCon 2014 in Bulgaria this last week end provided enough very good talks. I could not attend but followed the livestreams (during the multiple compilations of my various FreeBSD instances :-)), mostly OpenBSD and FreeBSD ones, plus few NetBSD. I paid attention especially to Ted Unangst talk, Theo de Raadt one as well. The latter was about arc4random mostly. It raised then two needs in FreeBSD. Making arc4random from userspace, fork safe then also using ChaCha 20 algorithm instead of the actual RC4.

For the first point, it exists different opinions to address proper reseeding in a fork basis. Indeed a fork should not share any random data from the parent process. The actual strategy is using getpid() call which some people think (me included) is working but not solid enough without mentioning of the cost of this call. Also using pthread_atfork which needs -pthread flag then. The last one, which get inspiration from OpenBSD is using MAP_INHERIT_ZERO flag to guarantee zero'd memory mappings for the fork. This is the one, some guys and I think, is the best. It is actually in discussion between us, HardenedBSD guys and FreeBSD's experts, we'll see what will come up ;-) So The user part is nearly done, just started the kernel counterpart where I had already replaced the RC4 by the ChaCha 20 calls then also I use current timestamp to put some data very early, right after read_random (might be useful if read_random does not return any data) ... Still needs work to do for sure and above all needs to be reviewed also by crypto experts ;-)

For last, I of course watched Shawn Webb talk which was great (he had even a short word about me, was surprised :-)), even Ilya Bakulin was able to fix the ARM issue, very nice !