Simon Gerraty: Adding verification to FreeBSD loader -- BSDCan 2018 @BsdcanOrg

Uploaded August 2018 | Updated September 2026, 40 minutes ago

Secure boot is a popular topic these days.

Junos (a FreeBSD based OS) has shipped with Verified Exec (from NetBSD) for over a decade, but there is a big gap between firmware power on and veriexec enforcement.

Adding the equivalent of verified exec to the loader addresses this gap.

Fixing the loader to verify modules and kernel has been on our roadmap for ages, but trying to squeeze enough of OpenSSL into the loader to handle verification of X.509 certificate chains, was simply not feasible.

Thomas Pornin's talk last year on BearSSL, changed the game. With this tiny library in hand I was able to add verification to the FreeBSD loader in a manner compatible with Verified Exec, while adding only about 100K to the size of the loader.

This talk will discuss the background, design decisions and implementation.

bsdcan.org/2018/schedule/events/922.en.html

Simon Gerraty: Adding verification to FreeBSD loader BSDCan 2018

$Thomas Johnson: Plumbing the Internet, BSD style BSDCan 2018 If you have ever delved into the world of BGP routing on the Internet, you know that it can be quite an undertaking. Fortunately, we can utilize BSD and a couple of open source tools to build a solution that will provide high availability and easy management, at a fraction of the cost of commercial solutions. This talk is an introduction to the basics of building a BGP presence on the Internet, and orchestrating it with Ansible. If you have ever delved into the world of routing on the Internet, you probably know that it can be daunting. You learned that BGP is the protocol used to build the global routing table, but likely discover that every answer leads to two more questions. Bureaucracy and expensive, proprietary solutions are everywhere. BSD cant stop the red tape, but it does offer a fantastic solution for your technical dilemma. This talk is a whirlwind tour of building an Internet presence in three parts (and an opportunity to learn from my mistakes). Act one is a brief introduction to the BGP protocol, the process to obtain numbering resources, and connectivity. The basics of rigging a FreeBSD host for routing are covered, and the routing daemon BIRD. Next up is discussion of network design for high-availability, and the FreeBSD/BIRD configuration to make it happen. Setting up one router may be fun, but were going to want automation. Enter Ansible. After a quick introduction, well use it to deploy a live demo of our configuration Finally, now that we have a fault-tolerant solution; so lets introduce some faults, and see what happens! Well induce some failures, and watch how our network responds. Time-permitting, I will wrap up with some discussion of resources for checking the status of your installation. Ill also discuss some more complex tasks, such as multi-site failover, and taking a router out of service. http://www.bsdcan.org/2018/schedule/events/985.en.html$

Emmanuel Vadot: FreeBSD ARM32 ARM64 Porting to a new board BSDCan 2018

Dan Langille: Closing session and Auction BSDCan 2018

Enhancing Unix Education through Chaos Engineering and Gamification using FreeBSD by Andreas Kirchne

So you want to add a system call Brooks Davis

FreeBSD sysctl MIB and to pass the objects info to userland: Alfonso S. Siciliano

Zelta: A Safe and Powerful Approach to ZFS Replication By: Daniel Bell

Bringing Amateur Packet Radio to OpenBSD: Iain R. Learmonth