FreeBSD

Mentors: Student: Costin Carabaș

<p>FreeBSD includes support for the kernel coverage sanitizer and undefined behaviour sanitizer, however support for the other sanitizers is missing. These are useful to find bugs while fuzzing the kernel.</p> <p>Port one or more of KASAN, KMSAN, and KTSAN to work in the FreeBSD kernel. Use the ported sanitizers with fuzzers (syzkaller or triforce) in order to find more memory vulnerabilities.</p>

Mentors: Student: Theron Tarigo

<p>This project aims to provide the capability of the FreeBSD ports infrastructure to safely and cleanly build ports and all their dependencies without superuser privileges, jails, or touching the installed system in any way, in the interest of improving the safety, reliability, and repeatability of ports building without the administrative and resource overhead of a separated build host or jail.</p>

Mentors: Student: Ján Sučan

<p>Ping has been one of the basic most used utilities for network diagnostic. Because of this the major aspect concerning it is ensuring its long term quality. Currently, there are two implementations of ping in FreeBSD: ping is for IPv4 networks and ping6 is for IPv6. They have a lot of duplicate code. To ease maintenance of this tools (adding new features, fixing bugs) the primary goal of my work is to create a single implementation, containing support for both IPv4 and IPv6 networks, where the code duplication will be eliminated and the functionality and output will be equal to the old implementations. The secondary goal is to document my work so that it could be used as a guide for other programmers who would do some similar unifying work.</p>

Mentors: Student: Shivank Garg

<p>With the introduction of <strong>VNET(9)</strong> in FreeBSD, Jails are free to set their IP addresses. However, this privilege may need to be limited by the host as per its need for multiple security reasons.</p> <p>This project uses <strong>mac(9)</strong> for an access control framework to impose restrictions on FreeBSD jails according to rules defined by the root of the host using sysctl(8). It involves the development of a dynamically loadable kernel module(<strong>mac_ipacl</strong>) based on <strong>The TrustedBSD MAC Framework</strong> to implement a security policy for configuring the network stack.</p> <p>This project allows the root of the host to define the policy rules to limit a jail to a set of IP(v4 or v6) addresses and/or subnets for a set of interfaces.</p> <p>The features of the mac_ipacl policy module are-</p> <ul> <li>Host is able to limit the restrict the desired jail to particular IP addresses(or subnets).</li> <li>Host can the restrict the certain jail from setting certain IP address or prefixes.</li> <li>Host can enforce the policy for a particular network interface(or all interfaces) for a jail.</li> <li>sysctl interface for tuning the mac_ipacl module.</li> </ul> <p>Apart from the module, Proper Test Suite (with ATF and Kyua) and a man page for the mac_ipacl is also part of the project.</p>

Mentors: Student: Paavo-Einari Kaipila

<p>Virtual memory compression is a memory management technique implemented by multiple operating systems ranging from Windows to Darwin. Depending on implementation, it can either reduce swapping to a physical storage medium or completely replace it. In vast majority of systems, compression and decompression is generally known to be faster faster than disk IO. The main goal of this project is to implement a compressed in-memory disk that can be utilized as a swap storage, much like zram on Linux.</p>