Episode Details

This week, we look forward with the latest OpenBSD release, look back with Dennis Ritchie’s paper on the evolution of Unix Time Sharing, have an Interview with Kris

This episode was brought to you by

href="http://www.digitalocean.com/" title="DigitalOcean"> href="http://www.tarsnap.com/bsdnow" title="Tarsnap">

OpenBSD 6.1 RELEASED

• Mailing list post
• We are pleased to announce the official release of OpenBSD 6.1. This is our 42nd release.
• New/extended platforms:
  • New arm64 platform, using clang(1) as the base system compiler.
  • The loongson platform now supports systems with Loongson 3A CPU and RS780E chipset.
  • The following platforms were retired: armish, sparc, zaurus
• New vmm(4)/ vmd(8)
• IEEE 802.11 wireless stack improvements
• Generic network stack improvements
• Installer improvements
• Routing daemons and other userland network improvements
• Security improvements
• dhclient(8)/ dhcpd(8)/ dhcrelay(8) improvements
• Assorted improvements
• OpenSMTPD 6.0.0
• OpenSSH 7.4
• LibreSSL 2.5.3
• mandoc 1.14.1 ***

Fuzz Testing OpenSSH

• Vegard Nossum writes a blog post explaining how to fuzz OpenSSH using AFL
• It starts by compiling AFL and SSH with LLVM to get extra instrumentation to make the fuzzing process better, and faster
• Sandboxing, PIE, and other features are disabled to increase debuggability, and to try to make breaking SSH easier
• Privsep is also disabled, because when AFL does make SSH crash, the child process crashing causes the parent process to exit normally, and AFL then doesn’t realize that a crash has happened. A one-line patch disables the privsep feature for the purposes of testing
• A few other features are disabled to make testing easier (disabling replay attack protection allows the same inputs to be reused many times), and faster:
  • the local arc4random_buf() is patched to return a buffer of zeros
  • disabling CRC checks
  • disabling MAC checks
  • disabling encryption (allow the NULL cipher for everything)
  • add a call to __AFL_INIT(), to enable “deferred forkserver mode”
  • disabling closefrom()
  • “Skipping expensive DH/curve and key derivation operations”
• Then, you can finally get around to writing some test cases
• The steps are all described in detail
• In one day of testing, the author found a few NULL dereferences that have since been fixed.
• Maybe you can think of some other code paths through SSH that should be tested, or want to test another daemon ***

Getting OpenBSD running on Raspberry Pi 3

Ian Darwin writes in about his work deploying the arm64 platform and the Raspberry Pi 3
So I have this empty white birdhouse-like thing in the yard, open at the front. It was intended to house the wireless remote temperature sensor from a low-cost weather station, which had previously been mounted on a dark-colored wall of the house [...]. But when I put the sensor into the birdhouse, the signal is too weak for the weather station to receive