Date: Tue, 29 May 2001 19:13:11 -0600 From: Theo de Raadt To: tech@cvs.openbsd.org Subject: ipf Precedence: bulk
sometime in the next 20 hours, i will be removing ipf from the source tree since it does not meet our freedom requirements, as have been outlined in policy.html and goals.html since the start of our project.
>>153 www.openbsd.org/goals.html にかかれていることからすれば、自然なことだよ。 やーなら、他の OS もあるしね。
とうとう消されちゃった
Date: Wed, 30 May 2001 11:12:59 JST From: Theo de Raadt <deraadt@cvs.openbsd.org> To: source-changes@cvs.openbsd.org
Log message: Remove ipf. Darren Reed has interpreted his (old, new, whichever) licence in a way that makes ipf not free according to the rules we established over 5 years ago, at www.openbsd.org/goals.html (and those same basic rules govern the other *BSD projects too). Specifically, Darren says that modified versions are not permitted. But software which OpenBSD uses and redistributes must be free to all (be they people or companies), for any purpose they wish to use it, including modification, use, peeing on, or even integration into baby mulching machines or atomic bombs to be dropped on Australia. Furthermore, we know of a number of companies using ipf with modification like us, who are now in the same situation, and we hope that some of them will work with us to fill this gap that now exists in OpenBSD (temporarily, we hope).
>>164 これか openipf 笑 Date: Wed, 30 May 2001 13:39:57 JST From: Jeff Bachtel <sebastion@irelandmail.com> To: Nicholas Janzen <nj@third-net.com>, tech@openbsd.org Subject: Re: ipf
Theo will probably say "show me the code", but the fact is that a functional, stable packet filter implementation is non-trivial, especially one that is high-peformance.
Not to belittle the amount of work that anyone on any project has done, but OpenBSD started with the NetBSD codebase, and OpenSSH started with an older ssh release. And a _hell_ of a lot of work was done to get the two projects to the points they are at today.
If there was an older version of ipfilter that was free, then conceivably an OpenFilter could be created in 6 months. As it is ipfw or Drawbridge [1] are the only two IP packet filters I could find easily with BSD-style licenses. I don't even have an inkling how hard ipfw would be to modify, however the fact that it doesn't have a seperate project page and diff tarball is not encouraging.
To: security-announce@openbsd.org Subject: sendmail patches available Date: Thu, 31 May 2001 03:36:31 JST From: "Todd C. Miller" <Todd.Miller@courtesan.com>
他スレでどさくさにまぎれて質問していたのですが、 OpenBSD特有の問題と判断し、こちらで質問させていただきます。 /usr/ports以下が600MBもあったので、おかしいと思い調べたところ、 どうやらmake install cleanでインストールしているにもかかわらず、 make cleanが行われていないようで、 /usr/ports以下にworkディレクトリが20個くらい残っています。 改めてmake cleanするも、例えば /usr/ports/archivers/bzip2/work が残っている場合 archiversディレクトリで # make clean すると
===> archivers/arc "/usr/ports/infrastructure/mk/bsd.port.mk", line 3: Need an operator "/usr/ports/infrastructure/mk/bsd.port.mk", line 5: Need an operator "/usr/ports/infrastructure/mk/bsd.port.mk", line 7: Need an operator "/usr/ports/infrastructure/mk/bsd.port.mk", line 501: Need an operator "/usr/ports/infrastructure/mk/bsd.port.mk", line 502: if-less endif "/usr/ports/infrastructure/mk/bsd.port.mk", line 502: Need an operator "/usr/ports/infrastructure/mk/bsd.port.mk", line 514: Need an operator "/usr/ports/infrastructure/mk/bsd.port.mk", line 583: Need an operator "/usr/ports/infrastructure/mk/bsd.port.mk", line 2704: Unclosed conditional/for loop "Makefile", line 23: 1 open conditional at line 591 of /usr/ports/infrastructure/mk/bsd.port.mk Fatal errors encountered -- cannot continue *** Error code 1
Stop in /usr/ports/archivers.
となってしまいます。他も同じです。 なにが原因で、どのように解決すればよいでしょうか。
また、workディレクトリを手動で削除するのはまずいでしょうか。 よろしくお願いします。
347 ：名無しさん＠お腹いっぱい。 ：2001/08/04(土) 22:43
>>346 原因はよくわからんです。 自分の 2.9 の環境では cd /usr/ports/archives && make clean の 挙動は問題ありませんでした。 でも最近 infrastructure/mk/bsd.port.mk の改変が行われていて cvsup したりしてると不都合があるかもしれません。 身に覚えはありませんか？ 又、openbsd には stable packages branch が存在します。 こちらは ports ml をチェックしないでも使えるかもしれません。
>また、workディレクトリを手動で削除するのはまずいでしょうか。 問題ないと思いますよ。 find /usr/ports -name work -type d -maxdepth 3 -mindepth 3 | xargs rm -Rf でいいんじゃないかな。未確認です。
courier-imapをpkgでいれて、起動しようとすると #/usr/local/libexec/imapd.rc start /usr/libexec/ld.so: authdaemond.plain: libgdbm.so.2.0: No such file or directory /usr/libexec/ld.so: couriertcpd: libgdbm.so.2.0: No such file or directory となり、起動できないです。どうすればよいでしょうか。
/home/pub/src/lib/libssl/crypto/../src/crypto/bn/bn_lib.c -o bn_lib.o /home/pub/src/lib/libssl/crypto/../src/crypto/bn/bn_lib.c: In function `bn_expand2': /home/pub/src/lib/libssl/crypto/../src/crypto/bn/bn_lib.c:325: `BN_R_BIGNUM_TOO_LONG' undeclared (fi rst use in this function) /home/pub/src/lib/libssl/crypto/../src/crypto/bn/bn_lib.c:325: (Each undeclared identifier is report ed only once /home/pub/src/lib/libssl/crypto/../src/crypto/bn/bn_lib.c:325: for each function it appears in.) *** Error code 1
Stop in /home/pub/src/lib/libssl/crypto. *** Error code 1
016: SECURITY FIX: November 13, 2001 A security issue exists in the vi.recover script that may allow an attacker to remove arbitrary zero-length files, regardless of ownership. つう、事でage。
-- ppp.conf default: set log Phase Chat LCP IPCP CCP tun command set redial 15 0 set reconnect 15 10000
pppoe: set device "!/usr/sbin/pppoe -i fxp0" set mtu 1492 # set mtu max 1492 # set mru max 1492 enable lqr set lqrperiod 5 set cd 5 enable dns enable mssfixup set authname XXXXXXXXXXX set authkey XXXXXXXXX set speed sync disable acfcomp protocomp deny acfcomp # add! default HISADDR set dial set login set timeout 0 --
-- ppp.linkup MYADDR: ! sh -c "/sbin/route flush" ! sh -c "/sbin/route add default HISADDR -mtu 1492" --
/* systemwide totals computed every five seconds */ struct vmtotal { u_int16_t t_rq; /* length of the run queue */ u_int16_t t_dw; /* jobs in ``disk wait'' (neg priority) */ u_int16_t t_pw; /* jobs in page wait */ u_int16_t t_sl; /* jobs sleeping in core */ u_int16_t t_sw; /* swapped out runnable/short block jobs */ u_int32_t t_vm; /* total virtual memory */ u_int32_t t_avm; /* active virtual memory */ u_int32_t t_rm; /* total real memory in use */ u_int32_t t_arm; /* active real memory */ u_int32_t t_vmshr; /* shared virtual memory */ u_int32_t t_avmshr; /* active shared virtual memory */ u_int32_t t_rmshr; /* shared real memory */ u_int32_t t_armshr; /* active shared real memory */ u_int32_t t_free; /* free memory pages */ };
012: SECURITY FIX: January 21, 2002 A race condition between the ptrace(2) and execve(2) system calls allows an attacker to modify the memory contents of suid/sgid processes which could lead to compromise of the super-user account. あげ
> ----- Original Message ----- > From: Darren Reed <avalon@coombs.anu.edu.au> > To: <listener@witworx.com> > Cc: <misc@openbsd.org> > Sent: Friday, March 01, 2002 9:20 AM > Subject: Re: Securing Small Networks with OpenBSD > > > > In some mail from Rod... Whitworth, sie said: > > > > > > On Fri, 1 Mar 2002 11:56:11 +0000, A. Farber wrote: > > > > > > >On Fri, Mar 01, 2002 at 10:48:12PM +1100, Rod... Whitworth wrote: > > > >> On Fri, 1 Mar 2002 11:37:25 +0000, A. Farber wrote: > > > >> > > > >> >http://www.onlamp.com/lpt/a//bsd/2002/02/28/openbsd.html > > > >> > > > > >> It would be nice if it was not 2 revs out of date, eh? In other words > > > >> over 12 months since 2.8 was released. > > > > > > > >There aren't so many articles about OpenBSD, eh? > > > > > > > IPF is obsolete. > > > > Really? > > > > Really.
522 ：名無しさん＠お腹いっぱい。 ：02/03/03 17:40
ここの人たちの中にOpenBSDでVMware for Linuxを動かしているツワモノは・・・ いないですよねぇ
015: RELIABILITY FIX: March 13, 2002 Under some circumstances the zlib compression library can free dynamically allocated memory twice. This is not a security issue on OpenBSD since the BSD free(3) function detects this. There is also a kernel zlib component that may be used by pppd and IPSec. The feasibility of attacking the kernel this way is currently unknown.
ゆえに、age
549 ：名無しさん＠お腹いっぱい。 ：02/03/21 12:39
016: SECURITY FIX: March 19, 2002 Under certain conditions, on systems using YP with netgroups in the password database, it is possible for the rexecd(8) and rshd(8) for the rexecd and rshd daemons to execute the shell from a different user's password entry. Due to a similar problem, atrun(8) may change to the wrong home directory when running at(1) jobs.
あげ！！
550 ：名無しさん＠お腹いっぱい。 ：02/03/22 16:50
ports/*/*/files/md5 から ports/*/*/distinfo に変わった age
551 ：名無しさん＠お腹いっぱい。 ：02/03/28 02:29
017: RELIABILITY FIX: March 26, 2002 isakmpd(8) will crash when receiving a zero length IKE packet due to a too-late length check
018: SECURITY FIX: April 11, 2002 mail(1) will process tilde escapes even in non-interactive mode. This can lead to a local root compromise. A source code patch exists which remedies the problem.
019: SECURITY FIX: April 22, 2002 A local user can gain super-user privileges due to a buffer overflow in sshd(8) if AFS has been configured on the system or if KerberosTgtPassing or AFSTokenPassing has been enabled in the sshd_config file. Ticket and token passing is not enabled by default.
ほい。
605 ：601 ：02/04/25 12:51
boot device: linux file and args: SILO Cannot find /etc/solo.conf(Can't read an inode table
Couldn't load /etc/silo.conf No config file loaded, you can boot just from this command line Type [prompth;]part/path_to_image [parameters] on the prompt E.g. /iommu/sbus/espdma/esp/sd@3,0;4/vmlinux root=/dev/sda4 or 2/vmlinux.live (to load vmlinux.live from 2nd partition of boot disk
>ok boot disk bsd Boot device:(Can't read an inode table)
Couldn't load /etc/silo.conf No config file loaded, you can boot just from this command line Type [prompth;]part/path_to_image [parameters] on the prompt E.g. /iommu/sbus/espdma/esp/sd@3,0;4/vmlinux root=/dev/sda4 or 2/vmlinux.live (to load vmlinux.live from 2nd partition of boot disk
Your imagename 'bsd' and arguments '' have either wrong syntax, or describe a label which is not present in silo.conf Type 'help' at the boot: prompt if you need it and then try again. boot: な感じですがどーすれば起動するんでしょう？ みなさんは普通に入れ終わったあと普通に起動するものなのでしょうか？
004: SECURITY FIX: May 22, 2002 Under certain conditions, on systems using YP with netgroups in the password database, it is possible that sshd(8) does ACL checks for the requested user name but uses the password database entry of a different user for authentication. This means that denied users might authenticate successfully while permitted users could be locked out.
005: SECURITY FIX: June 19, 2002 A buffer overflow can occur during the interpretation of chunked encoding in the http daemon, leading to possible remote crash.
006: SECURITY FIX: June 24, 2002 An (as yet) undisclosed bug exists in OpenSSH which a patch is not forthcoming for yet -- no patch exists yet! However, upgrading to OpenSSH 3.3 with the UsePrivilegeSeparation option enabled will block this problem. All users are advised to update immediately, and keep an eye out for a upcoming OpenSSH 3.4 release on Monday containing a real fix.
008: SECURITY FIX: June 26, 2002 A buffer overflow can occur in the .htaccess parsing code in mod_ssl httpd module, leading to possible remote crash or exploit.
013: SECURITY FIX: July 30, 2002 Several remote buffer overflows can occur in the SSL2 server and SSL3 client of the ssl(8) library, as in the ASN.1 parser code in the crypto(3) library, all of them being potentially remotely exploitable.
012: SECURITY FIX: July 29, 2002 A buffer overflow can occur in the xdr_array(3) RPC code, leading to possible remote crash.
011: SECURITY FIX: July 29, 2002 A race condition exists in the pppd(8) daemon which may cause it to alter the file permissions of an arbitrary file.
CD boot: Booting off the CD provides an El Torito 2.88MB floppy image that contains almost all OpenBSD drivers. This also includes minimal USB support (umass and ukbd devices). <-ここ For the latest list of drivers available on this image, take a look at the RAMDISK_CD config file.
>>796 make build 一発で済むように、 インクルードファイルやライブラリを最初につくってる。 see /usr/src/Makefile. コンパイラとかが入れ換わるときは先に手でつくったりもするけど、 そういうときは misc@ (tech@?) に HEADS UP 出るはず。
800 ：名無しさん＠お腹いっぱい。 ：02/09/03 19:41
make build の内容は知ってるつもりです。というか一つ前のバージョン(3.0)のヘッダでその後のバージョンの(3.1)のコンパイルってそもそも通らないことのほうが多いのではないのでしょうか。リンクも同様ですよね。 手作業が必要な変更もあると思うけど(典型的なのはa.outからELFに移行するときとか)、手作業が必要がない変更でも生成されるバイナリが違う、というような変更もあるのかなぁ、と思って。 まあ、バイナリが多少違っても同じ動作をすれば問題はないんでしょうけど。