src

And considering all the interesting work that OpenBSD is doing to Clang, i.e: retguard [0] [1], ROP gadget reduction framework [2]. Ignoring the fact that two major open source *BSD operating systems use and ship LLVM/Clang as their default system compiler. Their entire system compiled with clang, LLD as the default linker for an increasing number of supported platforms. A ports tree with between 10,000 (OpenBSD) to 30,000 (FreeBSD) ports compiled with Clang, maintaining patches upstreams won't take.. .. You might think that objection would be listened to more readily, or do the interest of a handful of corporations hold greater weight? OpenBSD will undoubtedly be forced to fork LLVM 8, and likely have to take on the burden of asking individual developers to dual-license contributions they backport going forward. This will place them in a

I'm not sure there is a reliable, generic approach for detecting overflow in conformant C; you probably have to come up with the appropriate proof for the specific operation that you're about to do. OpenBSD does it for multiplication in reallocarray() [1], which was introduced because it was easy to code an integer overflow when doing something like malloc(sizeof(member) * nmembers). [1] https://github.com/openbsd/src/blob/master/lib/libc/stdlib/r...

Nice write up. It reminded me of the time I spent several weeks once trying to get OpenBGPD to work on OpenBSD. First I tried getting some test VMs up and talking to each other. When I couldn't get that to work, I setup a few physical boxes to test it out.. When that didn't work either, I started debugging the code. A few strace's and some routine C debugging work later and I found a bug that would prevent any BGP connection from ever establishing. A quick post on the OpenBSD listserv and the problem was fixed within day. (Wow that was almost 10 years ago?! How time flies) https://github.com/openbsd/src/commit/13fba73cec6be16d64c86e... We ultimately went with VyOS (back then called Vyatta) and Quagga but it felt good to find a bug like this. Most of the work went in to confirming that there was an actual bug. Finding out where the

GitHub mirror: https://github.com/openbsd/src/tree/master/usr.bin/nc

Why not use the routines from the Linux kernel, which are battle tested? https://elixir.bootlin.com/linux/latest/source/arch/x86/incl... Or even NetBSD: http://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/net/... EDIT: freebsd: https://github.com/freebsd/freebsd/blob/master/sys/netinet/i... openbsd: https://github.com/openbsd/src/blob/master/sys/netinet/in4_c...

OpenBSD's carrying some local patches, Perl rand appears to be using the libc drand48(3) on OpenBSD, which uses arc4random_buf(3) internally, unless Perl srand is called, then it uses srand48_deterministic(3)? Not sure precisely as it's also using arc4random(3) directly to seed something. This is slightly different from how it's handled outside the Perl software ecosystem, as all the srand* functions effectively became nops on OpenBSD in favour of strong random numbers, and userland ports had to be patched to use the deterministic variants if needed. I guess that would be hard with things like CPAN. https://github.com/openbsd/src/commit/2e109fb9e8c0dc273648dd... https://github.com/openbsd/src/commit/2e109fb9e8c0dc273648dd... https://github.com/openbsd/src/commit/2e109fb9e8c0dc273648dd... Looks like upstream Perl also uses drand48 from Fre

Bad example ;) Updated on June 17th: https://github.com/coreutils/coreutils/commit/24053fbd8f9bd3... OpenBSD true(1) however... seems pretty much dead. https://github.com/openbsd/src/tree/master/usr.bin/true

This is correct, however generation is mostly needed (and was created) for NFS, and rarely used for anything else. Unveal lives in kernel, it just keeps a reference to vnode (https://github.com/openbsd/src/blob/03249988e9bbffb48a568839...)

I say it again: This is a kernel mechanism. Every operating system based upon Linux provides programs with this mechanism. This is not some ioctl() introduced by a Debian patch. This is a mechanism added to Linux by Linus Torvalds on 1993-12-23. * http://repo.or.cz/davej-history.git/commitdiff/9d09486414951... Pete French added it to FreeBSD against his better judgement on 2010-01-04. It might have been in an earlier implementation of the terminal line discipline, too. * https://github.com/freebsd/freebsd/commit/74b0526bbe6326adb7... OpenBSD, which no longer implements the kernel mechanism, had had it since the initial import from NetBSD in 1995. * https://github.com/openbsd/src/blob/df930be708d50e9715f173ca... Illumos has it, and has had since at least the OpenSolaris launch. * https://github.com/illumos/illumos-gate/blob/9a2c4685271c

This is old news, that keeps being reported over and over. Part of the problem, I suspect, is that people keep pointing to the wrong locus of the problem. Even here, this is being characterized as a Debian problem. This is a kernel mechanism. * https://nvd.nist.gov/vuln/detail/CVE-2013-6409 * https://nvd.nist.gov/vuln/detail/CVE-2015-6565 * https://nvd.nist.gov/vuln/detail/CVE-2016-2779 * https://nvd.nist.gov/vuln/detail/CVE-2016-7545 * https://nvd.nist.gov/vuln/detail/CVE-2017-5226 Some kernel people take the view that TIOCSTI is of no Earthly use, and there are other ways to implement line editing, and just make using it an error. * http://undeadly.org/cgi?action=article&sid=20170701132619 * https://github.com/openbsd/src/commit/baecf150995d4609cd1479... Others take a different view. * http://www.openwall.com/lists/oss-security/2017/0

That is the previous design which changed significantly from what's been committed today (see other comments). Github mirror, for easier review: https://github.com/openbsd/src/commit/e688c2b0648a80551cf735...

> This triggered my interest to go look at the C source code for linux[1]. Coreutils is not Linux, and GNU tools are notoriously heavyweight. For contrast, here is Toybox implementation of rm: https://github.com/landley/toybox/blob/master/toys/posix/rm.... busybox: https://git.busybox.net/busybox/tree/coreutils/rm.c https://git.busybox.net/busybox/tree/libbb/remove_file.c And finally openbsd: https://github.com/openbsd/src/blob/master/bin/rm/rm.c