Uploaded August 2018 | Updated September 2026, 44 minutes ago
For IPv6 stateless address auto configuration the KAME IPv6 stack, shared by all the BSDs, parses router advertisement messages in the kernel. These messages are fairly complicated, with optional parts and varying lengths. Parsing them is dangerously close to string handling in the kernel. If a mistake is made only a few mitigations stand in the way of a full-system compromise.
Moving this functionality to user land with much more powerful mitigations is prudent.
We present slaacd, the stateless address auto configuration daemon. It was written from scratch following the well established pattern of privilege separated OpenBSD daemons.
We will show how pledge(2) annotations guided the privilege separation, leading to a secure design. Other systems that lack OpenBSD's pledge annotations and kernel enforcement can still benefit from the secure design when slaacd gets ported to them.
bsdcan.org/2018/schedule/events/929.en.html
For IPv6 stateless address auto configuration the KAME IPv6 stack, shared by all the BSDs, parses router advertisement messages in the kernel. These messages are fairly complicated, with optional parts and varying lengths. Parsing them is dangerously close to string handling in the kernel. If a mistake is made only a few mitigations stand in the way of a full-system compromise.
Moving this functionality to user land with much more powerful mitigations is prudent.
We present slaacd, the stateless address auto configuration daemon. It was written from scratch following the well established pattern of privilege separated OpenBSD daemons.
We will show how pledge(2) annotations guided the privilege separation, leading to a secure design. Other systems that lack OpenBSD's pledge annotations and kernel enforcement can still benefit from the secure design when slaacd gets ported to them.
bsdcan.org/2018/schedule/events/929.en.html
