OpenBSD www

https://github.com/openbsd/www
Admin
This repository contains the source code for the OpenBSD HTTP server, a secure and efficient web...
Tokens:41,105
Snippets:387
Trust Score:7.2
Update:3 weeks ago
Show doc for...
Tokens:
Raw
### Build and install KDE4 on OpenBSD: classic make and modern dpb

Source: https://github.com/openbsd/www/blob/master/papers/eurobsdcon_2013_kde4/text64.html

Two alternative ways to build and install KDE4 on OpenBSD. The first is the classic method: change to the workspace port directory and run make with MAKE_JOBS set to the number of CPUs. The second is the modern method: from the ports root, use dpb to build all KDE4 ports matching the pattern x11/kde4/[a-z]*.

```shell
$ cd /usr/ports/x11/kde4/workspace
$ make MAKE_JOBS=`sysctl hw.ncpu` install
```

```shell
$ cd /usr/ports
$ dpb x11/kde4/[a-z]*
```

--------------------------------

### Equivalent PF configuration

Source: https://github.com/openbsd/www/blob/master/papers/auug2006/pf_evolution/mgp00018.txt

A standard PF configuration example including interface skipping, NAT, scrubbing, and traffic filtering rules.

```text
set skip on $LO_IFACE
nat on egress inet from $LAN_IFACE:network to any -> (egress)
scrub in
block log
pass out inet
pass in on (egress) inet proto tcp from any to (self) port { 21, 22, 80, 113 }
pass in on (egress) inet proto icmp from any to (self) icmp-type echo-req
pass in on $LAN_IFACE inet from $LAN_IFACE:network modulate state
```

--------------------------------

### ospfctl show database router - output

Source: https://github.com/openbsd/www/blob/master/papers/eurobsd2005/claudio/mgp00021.txt

Example output from the ospfctl command showing detailed router link state information.

```text
ospfctl show database router

                Router Link States (Area 0.0.0.0)

LS age: 269
Options: *|*|-|-|-|-|E|*
LS Type: Router
Link State ID: 0.0.0.1
Advertising Router: 0.0.0.1
LS Seq Number: 0x80000002
Checksum: 0x7d25
Length: 48
Flags: *|*|*|*|*|-|-|-
Number of Links: 2

    Link connected to: Stub Network
    Link ID (Network ID): 192.168.5.0
    Link Data (Network Mask): 255.255.255.0
    Metric: 12

    Link connected to: Transit Network
    Link ID (Designated Router address): 62.48.4.5
    Link Data (Router Interface address): 62.48.4.38
    Metric: 20
```

--------------------------------

### List miniroot source directory

Source: https://github.com/openbsd/www/blob/master/papers/opencon08-installscripts/mgp00005.txt

Shows the current directory and lists its contents, revealing the source files for the OpenBSD miniroot installation scripts.

```shell
$ pwd
/usr/src/distrib/miniroot
$ ls
CVS             dot.profile     list            mtree.conf      runlist.sh
Makefile        install.sh      list2sh.awk     obj             services
dhclient.conf   install.sub     makeconf.awk    protocols       upgrade.sh
$ 
```

--------------------------------

### sftp interactive session

Source: https://github.com/openbsd/www/blob/master/papers/cebit2003/mgp00009.txt

Starts an interactive SFTP session with hostB. The 'ls -l' lists remote files and 'get *.txt' downloads all .txt files.

```shell
hostA$ sftp hostB
sftp> ls -l
sftp> get *.txt
```

--------------------------------

### PF Runtime Options Configuration

Source: https://github.com/openbsd/www/blob/master/faq/pf/options.html

Example of setting various PF runtime options in the pf.conf file. Includes timeouts, limits, optimization, block-policy, loginterface, fingerprints, skip, and state-policy directives.

```pf
set timeout interval 10
set timeout frag 30
set limit { frags 5000, states 2500 }
set optimization high-latency
set block-policy return
set loginterface dc0
set fingerprints "/etc/pf.os.test"
set skip on lo0
set state-policy if-bound
```

--------------------------------

### OpenBSD ospfd configuration with MD5 authentication

Source: https://github.com/openbsd/www/blob/master/papers/eurobsd2005/claudio/mgp00022.txt

Example OpenBSD ospfd configuration showing global settings, route redistribution, and area definitions with MD5 authentication on interfaces em0 and vlan202.

```plaintext
 # global configuration
 router-id 10.28.4.65

 # route redistribution
 redistribute connected
 redistribute static

 # areas
 area 0.0.0.0 {
         interface lo1
 
         interface em0 {
                  metric          10
                  auth-type       crypt
                  auth-md-keyid   1
                  auth-md         1        "sdf&*di12"
         }

         interface vlan202 {
                  metric          50
                  auth-type       crypt
                  auth-md-keyid   5
                  auth-md         5        "Flkjds/8id@"
         }
 }
```

--------------------------------

### vetherstart: dequeue and free packets from if_snd

Source: https://github.com/openbsd/www/blob/master/papers/asiabsdcon2010_vether/mgp00010.txt

Implements the vether(4) interface start routine. It dequeues packets from the send queue while holding the network spl level, increments the output packet counter, and frees each mbuf. The loop returns when the queue is empty.

```c
void
vetherstart(struct ifnet *ifp)
{
        struct mbuf                *m;
        int                                 s;

        for (;;) {
                s = splnet();
                IFQ_DEQUEUE(&ifp->if_snd, m);
                splx(s);
                if (m == NULL)
                        return;
                ifp->if_opackets++;
                m_freem(m);
        }
}
```

--------------------------------

### System call trace output for kbind and ioctl

Source: https://github.com/openbsd/www/blob/master/papers/eurobsdcon2014_securelazy/slide017.html

Example output from a system call trace showing kbind() and ioctl() calls with their return values. The kbind call returns 0 and the ioctl call returns 0.

```text
      kbind(0x171d762ebd8,0x8,0x7f7ffffde1f8)
      kbind 0
      ioctl(0,TIOCGETA,0x7f7ffffde2f0)
      ioctl 0
```

--------------------------------

### Build multi-package port with make targets

Source: https://github.com/openbsd/www/blob/master/papers/capbug200712/mgp00007.txt

Use these make targets in sequence to build a multi-package port. make build compiles the port, make fake installs into a fake prefix, make plist generates the package list (may need manual tweaking to separate components correctly), and make package creates the final .tgz files.

```shell
make build
make fake
make plist
make package
```

--------------------------------

### amd64 example: call_bar calling external bar(foo)

Source: https://github.com/openbsd/www/blob/master/papers/eurobsdcon2014_securelazy/slide009a.html

Shows a C function that calls an external function with an external global variable, illustrating the lazy binding scenario on amd64.

```c
      extern int foo;
      extern int bar(int);
      int call_bar(void) {
         return bar(foo);
      }

```

--------------------------------

### Configure hostB IPsec with ipsecctl and isakmpd

Source: https://github.com/openbsd/www/blob/master/papers/asiabsdcon07-ipsec/mgp00062.txt

Configure hostB for the same host-to-host IPsec tunnel, mirroring hostA with reversed addresses. It writes the ipsec.conf rule, copies the local key to hostA's pubkeys directory, starts isakmpd with -K, and applies the configuration with ipsecctl -v.

```shell
hostB# echo "ike esp from 192.168.0.2 to 192.168.0.1" > /etc/ipsec.conf
hostB# scp /etc/isakmpd/local.key hostA:/etc/isakmpd/pubkeys/ipv4/192.168.0.2
hostB# isakmpd -K
hostB# ipsecctl -v /etc/ipsec.conf
```

--------------------------------

### amd64 assembly for accessing GOT and calling PLT

Source: https://github.com/openbsd/www/blob/master/papers/eurobsdcon2014_securelazy/slide009.html

amd64 assembly generated for the C example: loads the address of foo from the GOT, reads its value, and calls bar via its PLT stub.

```assembly
      movq    foo@GOTPCREL(%rip), %rax  # load foo's address from GOT
      movl    (%rax), %edi              # read foo's value
      call    bar@PLT                   # call bar's PLT stub

```

--------------------------------

### port.h: OS detection and feature macros for mini_httpd

Source: https://github.com/openbsd/www/blob/master/papers/auug2005-portability/mgp00016.txt

Portability header for mini_httpd 1.19. The first block maps predefined platform macros to OS_* and ARCH definitions. The second block defines feature macros for FreeBSD, including accept filter names. The third block starts the OpenBSD section, defining HAVE_DAEMON and HAVE_SETSID.

```C
#if defined(__FreeBSD__)
# define OS_FreeBSD
# define ARCH "FreeBSD"
#elif defined(__OpenBSD__)
# define OS_OpenBSD
# define ARCH "OpenBSD"
#elif defined(__NetBSD__)
# define OS_NetBSD
# define ARCH "NetBSD"
#elif defined(linux)
# define OS_Linux
# define ARCH "Linux"
#elif defined(sun)
# define OS_Solaris
# define ARCH "Solaris"
#elif defined(__osf__)
# define OS_DigitalUnix
# define ARCH "DigitalUnix"
#elif defined(__svr4__)
# define OS_SysV
# define ARCH "SysV"
#else
# define OS_UNKNOWN
# define ARCH "UNKNOWN"
#endif
```

```C
#ifdef OS_FreeBSD
# include <osreldate.h>
# define HAVE_DAEMON
# define HAVE_SETSID
# define HAVE_SETLOGIN
# define HAVE_WAITPID
# define HAVE_HSTRERROR
# define HAVE_TM_GMTOFF
# define HAVE_SENDFILE
# define HAVE_SCANDIR
# define HAVE_INT64T
# ifdef SO_ACCEPTFILTER
#  define HAVE_ACCEPT_FILTERS
#  if ( __FreeBSD_version >= 411000 )
#	define ACCEPT_FILTER_NAME "httpready"
#  else
#	define ACCEPT_FILTER_NAME "dataready"
#  endif
# endif /* SO_ACCEPTFILTER */
#endif /* OS_FreeBSD */
```

```C
#ifdef OS_OpenBSD
# define HAVE_DAEMON
# define HAVE_SETSID
```

--------------------------------

### ospfctl sh rib output

Source: https://github.com/openbsd/www/blob/master/papers/bsdcan2016-osr/mgp00010.txt

Example output from the 'ospfctl sh rib' command showing the OSPF routing table. The table lists destinations, next hops, path types, types, costs, and uptime. This output is useful for verifying OSPF routes and their costs.

```text
$ ospfctl sh rib
Destination    Nexthop     Path Type    Type      Cost    Uptime  
192.0.2.22     192.0.2.22  Intra-Area   Router    65535   05w2d05h
192.0.2.26     192.0.2.26  Intra-Area   Router    65535   05w2d05h
192.0.2.32/30  192.0.2.26  Intra-Area   Network   65540   05w2d05h
192.0.2.32/30  192.0.2.22  Intra-Area   Network   65540   05w2d05h
192.0.3.0/24   192.0.2.22  Type 1 ext   Network   65635   05w2d05h
192.0.2.128/26 192.0.2.26  Type 1 ext   Network   65635   05w2d05h
0.0.0.0/0      192.0.2.22  Type 2 ext   Network   65535   05w2d05h
```

--------------------------------

### ospfctl show nei - Display OSPF neighbors

Source: https://github.com/openbsd/www/blob/master/papers/linuxtag06-network/mgp00023.txt

Shows the OSPF neighbor table with columns for ID, priority, state, dead time, address, interface, and uptime. The example output shows two neighbors in FULL/DR state.

```shell
 # ospfctl show nei 
 ID              Pri State        DeadTime Address         Iface     Uptime
 0.0.0.1         1   FULL/DR      00:00:39 192.168.254.5   fxp0      00:00:16
 0.0.0.1         1   FULL/DR      00:00:39 192.168.254.1   fxp1      00:00:06
```

--------------------------------

### Configure hostA IPsec with ipsecctl and isakmpd

Source: https://github.com/openbsd/www/blob/master/papers/asiabsdcon07-ipsec/mgp00062.txt

Configure hostA for a host-to-host IPsec tunnel using ike esp. It writes the ipsec.conf rule, copies the local key to hostB's pubkeys directory, starts isakmpd with -K, and applies the configuration with ipsecctl -v.

```shell
hostA# echo "ike esp from 192.168.0.1 to 192.168.0.2" > /etc/ipsec.conf
hostA# scp /etc/isakmpd/local.key hostB:/etc/isakmpd/pubkeys/ipv4/192.168.0.1
hostA# isakmpd -K
hostA# ipsecctl -v /etc/ipsec.conf
```

--------------------------------

### Vacation .forward file entry

Source: https://github.com/openbsd/www/blob/master/advisories/sni_18_vacation.txt

Shows the .forward file line that installs the vacation program. This line is used by the email recipient to notify senders of their absence.

```plaintext
\user, "|/usr/bin/vacation user"
```

--------------------------------

### amd64 Example: C source and assembly for calling external function

Source: https://github.com/openbsd/www/blob/master/papers/eurobsdcon2014_securelazy/slide009b.html

C source and corresponding amd64 assembly for a function that calls an external function with an external global variable. The assembly loads the address of foo from the GOT, reads its value, and calls bar's PLT stub.

```c
      extern int foo;
      extern int bar(int);
      int call_bar(void) {
         return bar(foo);
      }

```

```assembly
      movq    foo@GOTPCREL(%rip), %rax  # load foo's address from GOT
      movl    (%rax), %edi              # read foo's value
      call    bar@PLT                   # call bar's PLT stub

```

--------------------------------

### ospfctl show rib - Display OSPF routing table

Source: https://github.com/openbsd/www/blob/master/papers/linuxtag06-network/mgp00023.txt

Shows the OSPF routing information base (RIB) with destination, nexthop, path type, type, cost, and uptime. The example output includes intra-area routes and a default route.

```shell
 # ospfctl show rib 
 Destination          Nexthop           Path Type    Type      Cost    Uptime  
 0.0.0.1              192.168.254.1     Intra-Area   Router    10      00:01:14
 192.168.254.0/30     192.168.254.2     Intra-Area   Network   10      00:01:19
 192.168.254.4/30     192.168.254.6     Intra-Area   Network   100     00:01:29
 0.0.0.0/0            192.168.254.1     Type 1 ext   Network   110     00:01:14
```

--------------------------------

### bgpd neighbor with IPsec static keys

Source: https://github.com/openbsd/www/blob/master/papers/bgpd_sucon04/mgp00034.txt

Configures a BGP neighbor with IPsec ESP static keys for inbound and outbound security associations. The example uses SHA1 and AES algorithms with specific SPI values and keys. Note the backslash line continuations in the original source.

```text
neighbor 10.2.1.1 {
        remote-as 65023
        local-address 10.0.0.8
        ipsec esp in  spi 10 \ 
                sha1 0a4f1d1f1a1c4f3c9e2f6f0f2a8e9c8c5a1b0b3b \ 
                aes 0c1b3a6c7d7a8d2e0e7b4f3d5e8e6c1e
        ipsec esp out spi 12 \ 
                sha1 0e9c8f6a8e2c7d3a0b5d0d0f0a3c5c1d2b8e0f8b \ 
                aes 4e0f2f1b5c4e3c0d0e2f2d3b8c5c8f0b
}
```

--------------------------------

### Configure and Build the Kernel

Source: https://github.com/openbsd/www/blob/master/papers/oreilly2000/page78.html

Commands to generate the build environment and compile the kernel.

```shell
config SYSTEMNAME
cd ../compile/SYSTEMNAME
make clean depend bsd
```

--------------------------------

### RETGUARD epilogue starting with xor (%rsp),%r11

Source: https://github.com/openbsd/www/blob/master/papers/asiabsdcon2019-rop-slides.pdf

A variant that omits the initial pop instructions and starts directly with the XOR operation that computes the random cookie. It then compares and traps as before.

```assembly
4c 33 1c 24 xor (%rsp),%r11
4c 3b 1d 03 74 ae 00 cmp 0xae7403(%rip),%r11 # compare to random cookie
74 02 je 2
cc int3
cc int3
c3 retq
```

--------------------------------

### RETGUARD epilogue starting with pop %rbp

Source: https://github.com/openbsd/www/blob/master/papers/asiabsdcon2019-rop-slides.pdf

A shorter variant that starts with popping %rbp. It then computes the cookie using the stack pointer and compares it to the stored value, with the same int3 trap and conditional jump to the return.

```assembly
5d pop %rbp
4c 33 1c 24 xor (%rsp),%r11
4c 3b 1d 03 74 ae 00 cmp 0xae7403(%rip),%r11 # compare to random cookie
74 02 je 2
cc int3
cc int3
c3 retq
```

--------------------------------

### Visitor pattern with OpenBSD::PackingList->visit

Source: https://github.com/openbsd/www/blob/master/papers/ven05-espie/mgp00025.txt

Defines a do_stuff method in the base class and overrides it in FileBase and Manpage subclasses, then uses the visit method to apply do_stuff to all elements of a packing list loaded from file "f". The visit method calls the method on each element, demonstrating the visitor pattern.

```perl
package OpenBSD::PackingElement;
sub do_stuff {}

package OpenBSD::PackingElement::FileBase;
sub do_stuff 
{
       my $self = shift;
       print "Any file: ", $self->fullname(), "\n";
}

package OpenBSD::PackingElement::Manpage;
sub do_stuff 
{
       my $self = shift;
       print "Man page: ", $self->fullname(), "\n";
}

$plist = OpenBSD::PackingList->fromfile("f");
$plist->visit('do_stuff');
```

--------------------------------

### Sample autonetd.conf configuration

Source: https://github.com/openbsd/www/blob/master/papers/eurobsdcon2015-raceless-network/text30.html

Sample configuration for autonetd, the OpenBSD wireless network daemon. Defines association mode, scan period, and multiple network profiles with authentication methods (WPA2, 802.1x, WPA, open), including commands to run on association/deassociation and a default profile. The 'run async shell' command logs a message to /tmp/wifi.log using variables ${NWID} and ${IFNAME}.

```autonetd.conf
assoc mode lazy scan period 15
network myhome auth wpa2 " vERy SEcrEt PaSsWOrD!@#$%^&\*()" inet6="config inet6 autoconf"
network "Best Job Ever, Inc." auth 802.1x $inet6 address 192.168.2.78/24 run on assoc cmd /sbin/route add default 192.168.2.1 run on deassoc cmd /sbin/route delete default
defaults config -inet6 no dhcp
run async shell "echo autonetd connected to open network" \ "\"${NWID}\" on the ${IFNAME} >>/tmp/wifi.log"
network "BestFriend\_home" auth wpa 12345678
network "free wi-fi" on iwm0 open $inet6 dhcp
network "MosMetro\_Free" open inherit defaults captive mosmetro
```

--------------------------------

### RETGUARD epilogue with andb instruction

Source: https://github.com/openbsd/www/blob/master/papers/asiabsdcon2019-rop-slides.pdf

A variant that starts with an 'andb' instruction, performing a bitwise AND on the AL register. The rest of the sequence is the standard cookie check and trap.

```assembly
24 andb $0x4c, %al
4c 3b 1d 03 74 ae 00 cmpl 0xae7403(%rip),%ebx # compare to random cookie
74 02 je 2
cc int3
cc int3
c3 retq
```

--------------------------------

### RETGUARD epilogue with sbbb instruction

Source: https://github.com/openbsd/www/blob/master/papers/asiabsdcon2019-rop-slides.pdf

A variant that starts with an unusual 'sbbb' instruction, which is a byte subtraction with borrow. It then proceeds with the standard cookie comparison and trap sequence.

```assembly
1c 24 sbbb $0x24, %al
4c 3b 1d 03 74 ae 00 cmp 0xae7403(%rip),%r11 # compare to random cookie
74 02 je 2
cc int3
cc int3
c3 retq
```

--------------------------------

### Run port-lib-depends-check to verify dependencies

Source: https://github.com/openbsd/www/blob/master/papers/opencon07-portstutorial/mgp00035.txt

Run this command after adding or updating the WANTLIB line in the Makefile to verify that all library dependencies are correctly recorded. The output shows the port name and a blank line, indicating no missing dependencies.

```shell
$ make port-lib-depends-check 
iodine-0.4.0:
$
```

--------------------------------

### Define Kernel Configuration File

Source: https://github.com/openbsd/www/blob/master/papers/oreilly2000/page78.html

Each system configuration is defined by a file, with GENERIC serving as a template that includes most features.

```text
file SYSTEMNAME

GENERIC includes most everything
```

--------------------------------

### Build port in chroot with ssh and sudo

Source: https://github.com/openbsd/www/blob/master/papers/eurobsd_con_2013_squiggles/mgp00034.txt

Runs a build of the misc/screen port inside a chroot as user espie, setting umask and various make variables. The command uses ssh to connect and sudo to chroot, then executes make build with options like FETCH_PACKAGES=No and NO_CHECKSUM=Yes.

```shell
ssh faulivia sudo chroot -u espie /build sh -c "umask 022 && cd /usr/ports && SUBDIR=misc/screen PHASE=build exec make build FETCH_PACKAGES=No PREPARE_CHECK_ONLY=Yes REPORT_PROLEM='exit 1' BULK=No NO_CHECKSUM=Yes"
```

--------------------------------

### OpenBSD policy routing: add, show, delete routes in table 1

Source: https://github.com/openbsd/www/blob/master/papers/eurobsdcon07/claudio-routing/mgp00027.txt

Basic policy routing commands for OpenBSD: add a route to table 1, show routes in table 1, and delete a route from table 1. The show command displays the routing table with the added route.

```shell
# route -T 1 add 192.168.1/24 192.168.0.1
```

```shell
# route -T 1 -n show
Routing tables

Internet:
Destination     Gateway         Flags  Refs   Use  Mtu  Iface
192.168.1/24    192.168.0.1     UGS       0     0    -  em0
```

```shell
route -T 1 delete 192.168.1/24
```

--------------------------------

### Configure routing domain with ifconfig and route

Source: https://github.com/openbsd/www/blob/master/papers/eurobsd2012/phessler-rdomains/mgp00016.txt

Commands to assign interface re0 to routing domain 1, set its IP address, and add a default route in that routing domain.

```shell
$ ifconfig re0 rdomain 1
$ ifconfig re0 10.0.0.10/8
$ route -T 1 add default 10.0.0.1
```

--------------------------------

### RETGUARD epilogue starting with pop %rbx

Source: https://github.com/openbsd/www/blob/master/papers/asiabsdcon2019-rop-slides.pdf

A variant of the RETGUARD epilogue that begins with popping %rbx instead of %r11. This changes the register used for the cookie computation but follows the same pattern of XORing the stack pointer, comparing to the stored cookie, and trapping with int3 if the comparison fails.

```assembly
5b pop %rbx
5d pop %rbp
4c 33 1c 24 xor (%rsp),%r11
4c 3b 1d 03 74 ae 00 cmp 0xae7403(%rip),%r11 # compare to random cookie
74 02 je 2
cc int3
cc int3
c3 retq
```

--------------------------------

### ospfctl show database command and output

Source: https://github.com/openbsd/www/blob/master/papers/eurobsd2005/claudio/mgp00020.txt

Shows the OSPF link-state database for area 0.0.0.0. The output lists router and net link states with their link ID, advertising router, age, sequence number, and checksum.

```shell
ospfctl show database
```

```text
cjeker@diavolezza:~> ospfctl show database

                Router Link States (Area 0.0.0.0)

Link ID         Adv Router      Age  Seq#       Checksum
0.0.0.1         0.0.0.1         213  0x80000002 0x7d25
62.48.4.3       62.48.4.3       292  0x80000004 0xadc1
62.48.4.4       62.48.4.4       296  0x80000004 0xabc0
62.48.4.5       62.48.4.5       293  0x80000002 0x2f43

                Net Link States (Area 0.0.0.0)

Link ID         Adv Router      Age  Seq#       Checksum
62.48.4.5       62.48.4.5       217  0x80000004 0x8774
```

--------------------------------

### ripctl show interfaces command output

Source: https://github.com/openbsd/www/blob/master/papers/opencon06-ripd/mgp00024.txt

Displays the RIP interfaces, showing each interface's address, state, link state, and uptime. The output shows two interfaces with ACTIVE state and active link state.

```console
$ ripctl show interfaces
Interface Address            State      Linkstate  Uptime  
rl0	    10.0.0.23/24       ACTIVE     active     00:35:54
bge0	    192.168.1.1/24     ACTIVE     active     00:35:54 
```

--------------------------------

### Route priority table for multiple interfaces

Source: https://github.com/openbsd/www/blob/master/papers/asiabsdcon2023-dynamic_host_configuration_please-slides.pdf

Route table showing default routes with different priorities (8 and 12) for em0 and iwm0, indicating preference.

```text
Destination  Gateway         Flags  Refs  Use  Mtu  Prio  Iface
default      192.168.178.1   UGS    4     110   -    8     em0
default      192.168.178.1   UGS    0     0     -    12    iwm0
```

--------------------------------

### Show outbound BGP routes for neighbor 178.255.1.203

Source: https://github.com/openbsd/www/blob/master/papers/bsdcan2016-osr/mgp00015.txt

Use `bgpctl sh rib out neigh 178.255.1.203` to display the routes that will be announced to that neighbor. The output shows a single route to 192.0.2.0/23 with gateway 0.0.0.0, lpref 100, and origin i.

```shell
$ bgpctl sh rib out neigh 178.255.1.203
flags destination  gateway   lpref  med aspath origin
I*>   192.0.2.0/23 0.0.0.0   100    30         i
```

--------------------------------

### Roaming user IPsec configuration with ipsecctl(8)

Source: https://github.com/openbsd/www/blob/master/papers/asiabsdcon07-ipsec/mgp00065.txt

Two ipsecctl(8) configuration lines for a roaming user setup. The laptop initiates an IKE ESP tunnel from its egress interface to the 10.0.1.0/24 network, using peer 1.1.1.1 and specifying source and destination IDs. The gateway (gwA) passively accepts the connection and uses its own source ID.

```ipsecctl
ike esp from egress to 10.0.1.0/24 peer 1.1.1.1 \ 
    srcid msf@openbsd.org dstid gwA.openbsd.org
```

```ipsecctl
ike passive esp from 10.0.1.0/24 to any srcid gwA.openbsd.org
```

--------------------------------

### bpf.c: replace gsignal/psignal with csignal and store credentials

Source: https://github.com/openbsd/www/blob/master/advisories/signals.txt

The bpf_wakeup function now uses csignal() with the stored uid and euid. The TIOCSPGRP handler now records the real uid and effective uid of the calling process.

```diff
@@ -522,14 +522,10 @@
 bpf_wakeup(d)
 	register struct bpf_d *d;
 {
-	struct proc *p;
-
 	wakeup((caddr_t)d);
 	if (d->bd_async && d->bd_sig)
-		if (d->bd_pgid > 0)
-			gsignal (d->bd_pgid, d->bd_sig);
-		else if ((p = pfind (-d->bd_pgid)) != NULL)
-			psignal (p, d->bd_sig);
+		csignal(d->bd_pgid, d->bd_sig,
+		    d->bd_siguid, d->bd_sigeuid);
 
 #if BSD >= 199103
 	selwakeup(&d->bd_sel);
@@ -822,6 +818,8 @@
 	 */
 	case TIOCSPGRP:		/* Process or group to send signals to */
 		d->bd_pgid = *(int *)addr;
+		d->bd_siguid = p->p_cred->p_ruid;
+		d->bd_sigeuid = p->p_ucred->cr_uid;
 		break;
 
 	case TIOCGPGRP:

```

--------------------------------

### bgpctl show summary (bgpctl s s)

Source: https://github.com/openbsd/www/blob/master/papers/ven05-henning/mgp00023.txt

Displays the current BGP neighbor summary from OpenBGPD. The output shows each neighbor's AS number, message counters, outbound queue, uptime, and either the number of received prefixes or the state 'Active' when no prefixes are received.

```shell
$ bgpctl s s
Neighbor             AS    MsgRcvd    MsgSent    OutQ  Up/Down  State/PrefixRcvd
hansenet             13184      70227      70193     0 03w3d08h     22/50
nmmn                 20694     129903     129858     0 06w3d02h      5/20
easynet               4589     131998     129855     0 06w3d02h    229/500
terralink            24905     129895     129855     0 06w3d02h      3/20
pironet-ndh           8469     130561     129851     0 06w1d23h     43/80
netuse                5605     131122     129860     0 06w2d05h     14/40
cix.at               20751     127110     127117     0 3d04h00m      9/25
christiansen         34181     129847     129825     0 01w6d08h      1/50
carrier66            24953     130081     130057     0 02w1d04h     11/50
otto                 16378     128288     128231     0 03w2d05h      1/5
inetbone             25074     132217     129816     0 4d18h44m    198/400
Headlight             6666      20984      20931     0 05w2d19h Active
ISC                   8805     129871     129856     0 06w3d02h      5/20
Artfiles              8893     129875     129857     0 02w1d19h      7/20
TNG                  13101     130140     129856     0 4d20h54m     22/50
wizard.de            12923     129854     129852     0 04w3d14h      2/5
MCS Cityline          5521     129848     129833     0 4d20h52m      6/20
smartnet             12485      28422      28425     0 05w0d05h Active
lynet                12822     129442     129443     0 5d12h46m      2/5
OMCnet               15388     129854     129858     0 06w3d02h      1/5
freenet               5430     129979     129815     0 05w2d00h     37/50
crew-kg              13135     129834     129813     0 4d18h44m      8/20
shlink.de            12518     129860     129858     0 06w3d02h      2/20
ppp.net               8687     130037     129856     0 06w3d02h     12/20
n@work                9211     129977     129693     0 05w3d11h     16/25
cogent                 174    4651737     129758     0 01w0d05h 171482
lambdanet            13237    9813587     129859     0 06w3d02h 173146
br20                 64513     129865     129858     0 06w3d02h      4
cr11                 24640    8172548    8177835     0 06w3d02h 173888
amd64.hack           65009     106526    7941148     0 02w1d08h      0
```

--------------------------------

### ospfctl show interface command and output

Source: https://github.com/openbsd/www/blob/master/papers/eurobsd2005/claudio/mgp00019.txt

Command to display OSPF interface details. The output shows the interface state, IP address, area, router ID, network type, cost, timers, and neighbor counts.

```shell
ospfctl show interface
```

```text
Interface fxp0 is 2, line protocol is UP
  Internet address 62.48.4.4/24, Area 0.0.0.0
  Router ID 62.48.4.4, network type BROADCAST, cost: 10
  Transmit delay is 1 sec(s), state DROTHER, priority 1
  Designated Router (ID) 62.48.4.5, interface address 62.48.4.5
  Backup Designated Router (ID) 62.48.4.3, interface address 62.48.4.3
  Timer intervals configured, hello 10, dead 40, wait 40, retransmit 5
    Hello timer due in 00:00:04
  Neighbor count is 3, adjacent neighbor count is 2
```

--------------------------------

### tame() call in ping.c with F_NUMERIC option

Source: https://github.com/openbsd/www/blob/master/papers/tame-fsec2015/mgp00017.txt

Calls tame() with 'stdio inet' when F_NUMERIC is set, otherwise with 'stdio inet dns'. On failure, exits with err(1, "tame"). The comment indicates inability to open/create in filesystem.

```c
+ if (options & F_NUMERIC) {
+ 	if (tame("stdio inet", NULL) == -1)
+ 		err(1, "tame");
+ } else {
+ 	if (tame("stdio inet dns", NULL) == -1)
+ 		err(1, "tame");
+ }

/* Unable to open/create in filesystem */
```

--------------------------------

### bioctl ami0 output after replacing broken disk

Source: https://github.com/openbsd/www/blob/master/papers/bio.pdf

Shows the output of `bioctl ami0` after replacing the broken disk: the previously Unused disk 1:9.0 is now assigned as ami0 2 Unused, and disk 1:14.0 becomes ami0 3 Unused. Use this to verify the new disk is recognized and the rebuild is progressing.

```shell
# bioctl ami0
Volume Status Size Device
ami0 0 Online 366372454400 sd0 RAID5
0 Online 73403465728 0:0.0 ses0 <MAXTOR ATLAS15K2_73SCA JNZ6>
1 Online 73403465728 0:2.0 ses0 <MAXTOR ATLAS15K2_73SCA JNZ6>
2 Online 73403465728 0:4.0 ses0 <MAXTOR ATLAS15K2_73SCA JNZ6>
3 Online 73403465728 0:8.0 ses0 <MAXTOR ATLAS15K2_73SCA JNZ6>
4 Online 73403465728 1:10.0 ses1 <MAXTOR ATLAS15K2_73SCA JNZ6>
5 Online 73403465728 1:12.0 ses1 <MAXTOR ATLAS15K2_73SCA JNZ6>
ami0 1 Degraded 366372454400 sd1 RAID5
0 Online 73403465728 0:1.0 ses0 <MAXTOR ATLAS15K2_73SCA JNZ6>
1 Online 73403465728 0:3.0 ses0 <MAXTOR ATLAS15K2_73SCA JNZ6>
2 Online 73403465728 0:5.0 ses0 <MAXTOR ATLAS15K2_73SCA JNZ6>
3 Rebuild 73403465728 1:15.0 ses1 <MAXTOR ATLAS15K2_73SCA JNZ6>
4 Online 73403465728 1:11.0 ses1 <MAXTOR ATLAS15K2_73SCA JNZ6>
5 Online 73403465728 1:13.0 ses1 <MAXTOR ATLAS15K2_73SCA JNZ6>
ami0 2 Unused 73403465728 1:9.0 ses1 <MAXTOR ATLAS15K2_73SCA JNZ6>
ami0 3 Unused 73403465728 1:14.0 ses1 <MAXTOR ATLAS15K2_73SCA JNZ6>
```

--------------------------------

### Make targets for dependency management

Source: https://github.com/openbsd/www/blob/master/papers/ven05-espie/mgp00007.txt

These make targets are used to manage dependencies in the OpenBSD www project. 'all-dir-depends' lists dependencies, piping to tsort provides a topological sort. 'clean=depends' cleans dependencies and depends on all-dir-depends. 'show-required-by' displays reverse dependencies.

```make
make all-dir-depends
```

```make
make all-dir-depends | tsort
```

```make
make clean=depends
```

```make
make show-required-by
```

--------------------------------

### Add IPCTL_ACCEPTSOURCEROUTE constant and name entry

Source: https://github.com/openbsd/www/blob/master/advisories/sourceroute.txt

Adds the IPCTL_ACCEPTSOURCEROUTE constant (value 13) and updates IPCTL_MAXID to 13. Also adds the string "accept_sourceroute" to the IPCTL_NAMES array.

```diff
Index: in.h
===================================================================
RCS file: /home/cvsup/freebsd/CVS/src/sys/netinet/in.h,v
retrieving revision 1.22.2.1
diff -u -r1.22.2.1 in.h
--- in.h	1996/11/11 23:40:37	1.22.2.1
+++ in.h	1998/02/24 18:31:44
@@ -301,7 +301,8 @@
 #define	IPCTL_DIRECTEDBROADCAST	9	/* may re-broadcast received packets */
 #define IPCTL_INTRQMAXLEN	10	/* max length of netisr queue */
 #define IPCTL_INTRQDROPS	11	/* number of netisr q drops */
-#define	IPCTL_MAXID		12
+#define	IPCTL_ACCEPTSOURCEROUTE	13	/* may accept source routed packets */
+#define	IPCTL_MAXID		13
 
 #define	IPCTL_NAMES { \
 	{ 0, 0 }, \
@@ -316,6 +317,7 @@
  	{ "directed-broadcast", CTLTYPE_INT }, \
 	{ "intr-queue-maxlen", CTLTYPE_INT }, \
 	{ "intr-queue-drops", CTLTYPE_INT }, \
+	{ "accept_sourceroute", CTLTYPE_INT }, \
 }
 
 

```

--------------------------------

### Replace gsignal/psignal with csignal in sowakeup()

Source: https://github.com/openbsd/www/blob/master/advisories/signals.txt

Updates sowakeup() to use the new csignal() function instead of directly calling gsignal() or psignal(). The uid and euid stored in the socket are passed to csignal() to enforce permission checks.

```c
	if (so->so_state & SS_ASYNC) {
```

--------------------------------

### List security and network ports

Source: https://github.com/openbsd/www/blob/master/papers/oreilly2000/page66.html

Lists the contents of the OpenBSD ports directories for security and networking tools. The output shows the available port names in each directory, useful for identifying available packages.

```shell
$ ls /usr/ports/security /usr/ports/net
/usr/ports/security:
ADMfzap      cgichk       its4         outguess     sftp         stunnel
ADMsmb       cops         john         parse        smurflog     swatch
ADMsnmp      crack        l0phtcrack   pgp          socks5       tempwatch
CVS          cyrus-sasl   libident     pgp5         ssh          uvscan
Makefile     dante        logsurfer    pgplib       ssl26        uvscan_dat
antisniff    dsniff       lxnb         portscanner  sslintl      whisker
bfbtester    fragrouter   nbaudit      radiusniff   sslusa
bounix       gnupg        nessus       rdp          stel
cfs          isic         nfsshell     rsaref       strobe

/usr/ports/net:
CVS             firewalk        mrtd            popa3d          tinyfugue
Makefile        fping           mrtg            proxy-suite     tircproxy
archie          gaim            mtr             publicfile      totd
arpcatch        gated           nam             queso           trafshow
arpwatch        gicq            ncftp           radiusd-cistron ucd-snmp
axyftp          hping           nemesis         rrdtool         ucspi-tcp
bind8           httptunnel      netatalk        rsync           vnc
bing            icb             netpipe         samba           vtun
bitchx          icmpinfo        ngrep           sharity-light   wget
clog            ipfm            nmap            slirp           wide-dhcp
curl            irc             nmapfe          sniffit         xarchie
cvsup-bin       ircII           ns              snort           xchat
cvsup-bin-old   libnet          nsping          tcpflow         ytalk
dnscache        libnids         ntop            tcpreplay       zebra
dxpc            licq            p5-libnet       tcpshow
epic4           micq            pchar           tcptrace
ethereal        mirror          pop3gwd         tintin++
```

--------------------------------

### Handle VSCSI_DIR_WRITE and VSCSI_DIR_READ with ioctl VSCSI_DATA_WRITE

Source: https://github.com/openbsd/www/blob/master/papers/asiabsdcon2010_iscsi/mgp00014.txt

Shows how to handle VSCSI_DIR_WRITE and VSCSI_DIR_READ requests in a vscsi(4) userland process. For writes, allocate a buffer of i2t.datalen bytes, copy the data via ioctl(fd, VSCSI_DATA_WRITE, &data), then process it with data_write() and free the buffer. For reads, obtain the data with data_read(), set the tag, buffer, and length, then issue the same ioctl and free the buffer returned by data_read().

```c
if (i2t.direction == VSCSI_DIR_WRITE) {
    data.tag = i2t.tag;
    if ((data.buf = malloc(i2t.datalen)) == NULL
         err(1, "malloc");
    data.datalen = i2t.datalen;
    if (ioctl(fd, VSCSI_DATA_WRITE, &data) == -1
         err(1, "ioctl VSCSI_DATA_WRITE");
    /* work with provided data */
    data_write(i2t, data.buf, data.datalen);
    free(data.buf);
}
if (i2t.direction == VSCSI_DIR_READ) {
    void *buf;
    size_t len;
    /* get requested data */
    buf = data_read(i2t, &len);
    data.tag = i2t.tag;
    data.buf = buf;
    data.datalen = len;
    if (ioctl(fd, VSCSI_DATA_WRITE, &data) == -1)
         err(1, "ioctl VSCSI_DATA_WRITE");
    free(buf);/* allocated by data_read */
}
```

--------------------------------

### scp copy remote file to local

Source: https://github.com/openbsd/www/blob/master/papers/cebit2003/mgp00009.txt

Copies the file rfc3365.txt from hostB's home directory to the current directory on hostA.

```shell
hostA$ scp hostB:rfc3365.txt .
```
Tokens:
Raw