From owner-freebsd-arch@FreeBSD.ORG Thu Oct 16 14:31:12 2014 Return-Path: Delivered-To: freebsd-arch@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id D09CDB76; Thu, 16 Oct 2014 14:31:12 +0000 (UTC) Received: from mx1.sbone.de (mx1.sbone.de [IPv6:2a01:4f8:130:3ffc::401:25]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client CN "mx1.sbone.de", Issuer "SBone.DE" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 7FD1BD3E; Thu, 16 Oct 2014 14:31:12 +0000 (UTC) Received: from mail.sbone.de (mail.sbone.de [IPv6:fde9:577b:c1a9:31::2013:587]) (using TLSv1 with cipher ADH-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by mx1.sbone.de (Postfix) with ESMTPS id A831E25D3871; Thu, 16 Oct 2014 14:31:09 +0000 (UTC) Received: from content-filter.sbone.de (content-filter.sbone.de [IPv6:fde9:577b:c1a9:31::2013:2742]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.sbone.de (Postfix) with ESMTPS id 94283C770AE; Thu, 16 Oct 2014 14:31:08 +0000 (UTC) X-Virus-Scanned: amavisd-new at sbone.de Received: from mail.sbone.de ([IPv6:fde9:577b:c1a9:31::2013:587]) by content-filter.sbone.de (content-filter.sbone.de [fde9:577b:c1a9:31::2013:2742]) (amavisd-new, port 10024) with ESMTP id dgJ5OerVOLoh; Thu, 16 Oct 2014 14:31:07 +0000 (UTC) Received: from [IPv6:fde9:577b:c1a9:4420:cabc:c8ff:fe8b:4fe6] (orange-tun0-ula.sbone.de [IPv6:fde9:577b:c1a9:4420:cabc:c8ff:fe8b:4fe6]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.sbone.de (Postfix) with ESMTPSA id 3DF70C77071; Thu, 16 Oct 2014 14:31:05 +0000 (UTC) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Subject: Re: Enabling VIMAGE by default for FreeBSD 11? From: "Bjoern A. Zeeb" In-Reply-To: <86d29so0r1.fsf@nine.des.no> Date: Thu, 16 Oct 2014 14:31:02 +0000 Content-Transfer-Encoding: quoted-printable Message-Id: References: <20141012182551.002b3cc0a45a56d3f34e6174@yamagi.org> <3B4471A7-CDF4-440D-BDD8-3D5B2256B8DD@lists.zabbadoz.net> <7EAA2A23-06F9-44C9-A3E1-62AA37EE5CDA@lists.zabbadoz.net> <86d29so0r1.fsf@nine.des.no> To: =?windows-1252?Q?Dag-Erling_Sm=F8rgrav?= X-Mailer: Apple Mail (2.1878.6) Cc: freebsd-net@freebsd.org, freebsd-virtualization@freebsd.org, freebsd-arch X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Oct 2014 14:31:12 -0000 On 16 Oct 2014, at 08:52 , Dag-Erling Sm=F8rgrav wrote: > "Bjoern A. Zeeb" writes: >> Also if people are seriously thinking about virtualising pf we need = to >> import the openbsd/apple pf fix from a few years ago because = otherwise >> people in virtualised stacks with a /dev/pf can do ugly things. I >> think it=92s been this one: >> http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2010-3830 >=20 > There are other serious issues with our current pf (checksum = corruption) > which I think can only be resolved by importing a newer version. Sorry, but you lost context. I was talking about security implications = in VIMAGE context, not about random bugs. =97=20 Bjoern A. Zeeb "Come on. Learn, goddamn it.", WarGames, 1983