Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Fix in Open BSD

code.bsd64.org

Post reply on HN
Print view View original

11–20 of 36 posts

Re: Security Fix in Open BSD

#11

Post by iclelland »

paperclip wrote: post #9

I presume you are attempting to imply that this one of the 'leet' FBI backdoors that the Perry email discussed. It would help if you actually said why you thought this patch was interesting when submitting it to HN. I hope we are not going to get a rash of inarticulate HN submissions for every minor patch to openbsd which may have security implications. I doubt this is in anyway related to the recent drama. The initi…

I figured that v1.61 had the initial line in it; 1.63 added the comment explaining its purpose. (the diffs are ugly, though, and hard to tell what lines went where sometimes)

The fix was in 1.75, though, over a year later. In the middle is v1.69, tagged as the release version for OpenBSD 3.0 (and the branch point for 3.1)

1.75 looks like the release version for 3.1 (and branch point for 3.2), so the bug would have been present in the released 3.0 version.

Re: Security Fix in Open BSD

#12

Post by paperclip »

iclelland wrote: post #11
paperclip wrote: post #9

I presume you are attempting to imply that this one of the 'leet' FBI backdoors that the Perry email discussed. It would help if you actually said why you thought this patch was interesting when submitting it to HN. I hope we are not going to get a rash of inarticulate HN submissions for every minor patch to openbsd which may have security implications. I doubt this is in anyway related to the recent drama. The initi…

I figured that v1.61 had the initial line in it; 1.63 added the comment explaining its purpose. (the diffs are ugly, though, and hard to tell what lines went where sometimes) The fix was in 1.75, though, over a year later. In the middle is v1.69, tagged as the release version for OpenBSD 3.0 (and the branch point for 3.1) 1.75 looks like the release version for 3.1 (and branch point for 3.2), so the bug would have be…

blargh.

You are quite correct - I don't know how I missed that.

I hope the conspiracy theorists don't turn on me for participating in the cover up.

Re: Security Fix in Open BSD

#13

Post by there »

tptacek wrote: post #7

In 2001, Angelos Keromytis --- then a grad student at Penn, now a Columbia professor --- added support for hardware-accelerated IPSEC NICs. When you have an IPSEC NIC, the channel between the NIC and the IPSEC stack keeps state to tell the stack not to bother doing the things the NIC already did, among them validating the IPSEC ESP authenticator. Angelos' code had a bug; it appears to have done the software check onl…

for what it's worth (not much), angelos also contracted for netsec.

Re: Security Fix in Open BSD

#14

Post by jey »

Looking at the dates, this bug was fixed in under a month. Did the buggy code really get released to production environments that fast? A priori unlikely IMO, which means this "vulnerability" is instead just the normal development process at work. I'm sure we've all committed code with mindbogglingly dumb bugs at one point or another.

Re: Security Fix in Open BSD

#15

Post by caf »

tptacek wrote: post #7

In 2001, Angelos Keromytis --- then a grad student at Penn, now a Columbia professor --- added support for hardware-accelerated IPSEC NICs. When you have an IPSEC NIC, the channel between the NIC and the IPSEC stack keeps state to tell the stack not to bother doing the things the NIC already did, among them validating the IPSEC ESP authenticator. Angelos' code had a bug; it appears to have done the software check onl…

The most worrying thing about it is probably just that it took a year to notice - you would think "throw a forged authenticator at it" would be in the regression tests for an IPSEC implementation.

Re: Security Fix in Open BSD

#16

Post by [deleted] »

caf wrote: post #15
tptacek wrote: post #7

In 2001, Angelos Keromytis --- then a grad student at Penn, now a Columbia professor --- added support for hardware-accelerated IPSEC NICs. When you have an IPSEC NIC, the channel between the NIC and the IPSEC stack keeps state to tell the stack not to bother doing the things the NIC already did, among them validating the IPSEC ESP authenticator. Angelos' code had a bug; it appears to have done the software check onl…

The most worrying thing about it is probably just that it took a year to notice - you would think "throw a forged authenticator at it" would be in the regression tests for an IPSEC implementation.

[deleted]

Re: Security Fix in Open BSD

#17

Post by zedshaw »

tptacek wrote: post #7

In 2001, Angelos Keromytis --- then a grad student at Penn, now a Columbia professor --- added support for hardware-accelerated IPSEC NICs. When you have an IPSEC NIC, the channel between the NIC and the IPSEC stack keeps state to tell the stack not to bother doing the things the NIC already did, among them validating the IPSEC ESP authenticator. Angelos' code had a bug; it appears to have done the software check onl…

> It's interesting that the bug was fixed without an advisory (oh to be a fly on the wall on ICB that day; Theo had a, um, a, "way" with his dev team).

This would be my question. That seemingly small change has large security implications since it means that branch was disabled on certain erroneous conditions for some extended period of time and then silently changed back. I think you're right that Jason fixed it, but why wasn't it announced as a major security flaw in OpenBSD 3.0 which I believe released with this code?

Another spin on this drama could be either of these two:

1. Jason actually went in and fixed bugs placed by other NETSEC employees, and now is the victim of reprisals.

2. NETSEC was incompetent, not malicious, and then silently went around fixing things without telling anyone.

Interesting stuff, can't wait to see the rewrite of this file! :-)

Re: Security Fix in Open BSD

#18

Post by dsantos »

tptacek wrote: post #7

In 2001, Angelos Keromytis --- then a grad student at Penn, now a Columbia professor --- added support for hardware-accelerated IPSEC NICs. When you have an IPSEC NIC, the channel between the NIC and the IPSEC stack keeps state to tell the stack not to bother doing the things the NIC already did, among them validating the IPSEC ESP authenticator. Angelos' code had a bug; it appears to have done the software check onl…

de Raadt: "We've been auditing since the mail came in! We have already found two bugs in our cryptographic code. We are assessing the impact."

http://www.itwire.com/opinion-and-analysis/open-sauce/43995-...

"Until 2 days ago I had no idea that both Jason and Angelos in the past did work for a company that does that business"

Re: Security Fix in Open BSD

#19

Post by tptacek »

caf wrote: post #15
tptacek wrote: post #7

In 2001, Angelos Keromytis --- then a grad student at Penn, now a Columbia professor --- added support for hardware-accelerated IPSEC NICs. When you have an IPSEC NIC, the channel between the NIC and the IPSEC stack keeps state to tell the stack not to bother doing the things the NIC already did, among them validating the IPSEC ESP authenticator. Angelos' code had a bug; it appears to have done the software check onl…

The most worrying thing about it is probably just that it took a year to notice - you would think "throw a forged authenticator at it" would be in the regression tests for an IPSEC implementation.

"Regression tests for an IPSEC implementation". Heh.

Re: Security Fix in Open BSD

#20

Post by tptacek »

dsantos wrote: post #18
tptacek wrote: post #7

In 2001, Angelos Keromytis --- then a grad student at Penn, now a Columbia professor --- added support for hardware-accelerated IPSEC NICs. When you have an IPSEC NIC, the channel between the NIC and the IPSEC stack keeps state to tell the stack not to bother doing the things the NIC already did, among them validating the IPSEC ESP authenticator. Angelos' code had a bug; it appears to have done the software check onl…

de Raadt: "We've been auditing since the mail came in! We have already found two bugs in our cryptographic code. We are assessing the impact." http://www.itwire.com/opinion-and-analysis/open-sauce/43995-... "Until 2 days ago I had no idea that both Jason and Angelos in the past did work for a company that does that business"

There is no way Theo didn't know Jason worked at NETSEC; Jason's a co-author of an academic paper about the OpenBSD cryptography implementation, under a NETSEC address.
Post reply on HN