The Tokyo Debrief | BSD Now 133

chris

6 years ago

This week on BSDNow, Allan and I are back from AsiaBSDCon & we have an interview with Brad Davis about the new “Packaging Base” call-for-testing. We’ll be sharing our thoughts and stories on how the week went, along with updating you on the latest news.

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

Become a supporter on Patreon:

– Show Notes: –

Headlines

AsiaBSDCon 2016 – Wrap-up

FreeBSD gets Haswell graphics support in time for 11.0-RELEASE

The moment that many have been waiting for has finally arrived, support for Haswell graphics has been committed to FreeBSD -CURRENT
The brings the DRM/i915 code up to date with Linux kernel 3.8.13
Work has already started on updating to Linux kernel 3.9
It is hoped that subsequent updates will be much easier, and much faster
It does not appear to require setting the i915.preliminary_hw_support loader tunable

OpenBSD vmm/vmd Update

For the third year running, bhyvecon was held last week, during the lead up to AsiaBSDCon
Bhyvecon has expanded, and now covers all virtualization on BSDs
There were presentations on bhyve, Xen Dom0 on FreeBSD, Xen DomU for OpenBSD, and OpenBSD’s vmm
OpenBSD vmm started at the Brisbane 2015 hackathon in Australia
Work continued through the summer and fall thanks to funding by the OpenBSD Foundation
The presentation answered some outstanding questions, such as, why not just port bhyve?
Initial focus is OpenBSD on OpenBSD
Loader currently supports FreeBSD and NetBSD as well
After the initial commits, other developers joined in to help with the work
Reyk reworked the vmd and vmctl commands, to provide a better user interface
Future plans:
Nested VMX
i386 support
AMD SVM support
Filesystem passthru
Live migration (with ZFS like command syntax)
Other developers are working on related projects:
qemu interface: Allow qemu to be accelerated by the vmm backend, while providing emulated hardware, for legacy systems
KVM interface: Make vmm look like KVM, so existing tools like openstack “just work”

Interview – Brad Davis – brd@freebsd.org / @so14k

Packaging Base

News Roundup

Packaging the base system with pkg(8)

The official call for testing for FreeBSD’s pkg(8)’d base is out
Users are requested to checkout the release-pkg branch, and build it as normal (buildworld, buildkernel)
Instead of installworld, run: make packages
This will produce a pkg repo in the /usr/obj directory
The post to the mailing list includes an example pkg repo config file to point to those packages
Run: pkg update -r FreeBSD-base
This will read the metadata from the new repository
Then run: pkg install -g ‘FreeBSD-*’
This will find all packages that start with ‘FreeBSD-’ and install them
In the future, there will be meta packages, so you can just install FreeBSD-base and it will pull in other packages are dependencies
Currently, there are a large number of packages (over 700), because each shared library is packaged separately, and almost all optional features are in a separate package
The number of packages is also increased because there are separate -debug, -profiling, etc versions of each package
New features are being added to pkg(8) to mark important system components, like libc, as ‘vital’, so they cannot be deleted accidently
However, in the case of using pkg(8)’d base to create a jail, the administrator should be able to delete the entire base system
Classic conundrum: “UNIX does not stop you doing something stupid, as that would also stop you doing something clever”
Work is still ongoing
At AsiaBSDCon, after the interview was recorded, bapt@ and brd@ had a whiteboarding session and have come up with how they expect to handle the kernel package, to ensure there is a /boot/kernel.old for you to fall back to incase the newly installer kernel does not work correctly.

FreeBSD 10.3-RC2 Now Available

The second release candidate for FreeBSD 10.3 is now available for testing
Notable changes include:
Import an upstream fix for ‘zfs send -i’ to avoid data corruption in specific instances
Boot loaders and kernel have been taught to handle ELF sections of type SHT_AMD64_UNWIND. This does not really apply to FreeBSD 10.3, but is required for 11.0, so will make upgrades easier
Various mkdb commands (/etc/services, /etc/login.conf, etc) commands now use fsync() instead of opening the files as O_SYNC, greatly increasing the speed of the database generation
From the earlier BETA3, the VFS improvements that were causing ZFS hangs, and the new ‘tryforward’ routing code, have been reverted
Work is ongoing to fix these issues for FreeBSD 11.0
There are two open issues:
A fix for OpenSSH CVE-2016-3115 has not be included yet
the re-addition of AES-CBC ciphers to the default server proposal list. AES-CBC was removed as part of the update to OpenSSH version 7.1p2, but the plan is to re-add it, specifically for lightweight clients who rely on hardware crypto offload to have acceptable SSH performance
Please go out and test

OPNsense 16.1.6 released

A new point-release of OPNsense has dropped, and apart from the usual security updates, some new features have been included

firmware: bootstrap utility can now directly install e.g. the development version

dhcp: all GUI pages have been reworked for a polished look and feel

proxy: added category-based remote file support if compressed file contains multiple files

proxy: added ICAP support (contributed by Fabian Franz)

proxy: hook up the transparent FTP proxy

proxy: add intercept on IPv6 for FTP and HTTP proxy options

logging: syslog facilities, like services, are now fully pluggable

vpn: stripped an invalid PPTP server configuration from the standard configuration

vpn: converted to pluggable syslog, menu and ACL

dyndns: all GUI pages have been reworked for a polished look and feel

dyndns: widget now shows IPv6 entries too

dns forwarder: all GUI pages have been reworked for a polished look and feel

dns resolver: all GUI pages have been reworked for a polished look and feel

dns resolver: rewrote the dhcp lease registration hooks

dns resolver: allow parallel operation on non-standard port when dns forwarder is running as well

firewall: hide outbound nat rule input for “interface address” option and toggle bitmask correctly

interfaces: fix problem when VLAN tags weren’t generated properly

interfaces: improve interface capability reconfigure

ipsec: fix service restart behaviour from GUI

captive portal: add missing chain in certificate generation

configd: improve recovery and reload behaviour

load balancer: reordered menu entries for clarity

ntp: reordered menu entries for clarity

traffic shaper: fix mismatch for direction + dual interfaces setup

languages: updated German and French

Call for testing – ASLR patch

A patch that provides a first pass implementation of basic ASLR (Address Space Layout Randomization) for FreeBSD has been posted to the mailing list
“Stack gap, W^X, shared page randomization, KASLR and other techniques are explicitly out of scope of this work.”
“ASLR is enabled on per-ABI basis, and currently it is only enabled on native i386 and amd64 (including compat 32bit) ABIs. I expect to test and enable ASLR for armv6 and arm64 as well, later”
“Thanks to Oliver Pinter and Shawn Webb of the HardenedBSD project for pursuing ASLR for FreeBSD. Although this work is not based on theirs, it was inspired by their efforts.”

Feedback/Questions

Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv