Skip site navigation (1) Skip section navigation (2)

Introduction

This installment of the Bi-Monthly Status Report is a few days late, but I'm pleased to say that it is chocked full of over 30 articles. May and June were yet again busy months; the Netperf project passed major milestones and can now be run with the debug.mpsafenet tunable turned on from sources in CVS. The ARM, MIPS, and PPC ports saw quite a bit of progress, as did several other SMPng and Netgraph projects. FreeBSD 5.3 is just around the corner, so don't hesitate to grab a snapshot and test the progress!

On a more serious note, it's very important to remember that code freeze for FreeBSD 5.3 will happen on August 15, 2004. This is only a few weeks away and there is still a lot to do. The TODO list for the release can be found at http://www.freebsd.org/releases/5.3R/todo.html. If you are looking for a way to contribute to the release, this TODO list has several items that are in urgent and in need of attention. Testing is also very important. The tree has had some stability stability problems in the past few weeks, but there are work-arounds that should allow everyone to continue testing and using FreeBSD. We absolutely must have FreeBSD 5.3 be a rock-solid release, so every little bit of contributed effort helps!

Thanks,

Scott Long

Bluetooth stack for FreeBSD (Netgraph implementation)

Contact: Maksim Yevmenkin <[email protected]>

Bluetooth code was marked as non-i386 specific. It is now possible to build it on all supported platforms. Please help with testing. Other then this there was not much progress during last few months. I've been very busy with Real Life.

ALTQ import

URL: http://www.csl.sony.co.jp/person/kjc/kjc/software.html#ALTQ
URL: http://www.rofug.ro/projects/freebsd-altq/
URL: http://kerneltrap.org/node.php?id=505
URL: http://people.freebsd.org/~mlaier/ALTQ_driver/

Contact: Max Laier <[email protected]>

The ALTQ framework is part of KAME for more than 4 years and has been adopted by Net- and OpenBSD since more than 3 years. It provides means of managing outgoing packets to do QoS and bandwidth limitations. OpenBSD developed a different way to interact with ALTQ using pf, which was adopted by KAME as the "default for everyday use".

The Romanian FreeBSD Users Group has had a project to work towards integration of ALTQ into FreeBSD, which provided a very good starting point for the final import. The import only provides the "pf mode" configuration and classification API as the older ALTQ3 API does not suit to our SMP approach.

A reworked configuration API (decoupled from pf) is in the making as are additional driver modifications. Both should be done before 5-STABLE is branched, although additional drivers can be imported during the lifetime of 5-STABLE as well.

Buf Junta project

Contact: Poul-Henning Kamp <[email protected]>

The buf-junta project is underway, I am trying to bisect the code such that we get a struct bufobj which is the handle and method carrier for a buffer-cache object. All vnodes contain a bufobj, but as filesystems get migrated to GEOM backing, bufobj's will exist which do not have an associated vnode. The work is ongoing.

CAM Lockdown

Contact: Scott Long <[email protected]>

Not much coding has taken place on this lately, with the recent focus being on refining the design. We are currently investigating per-CPU completion queues and threads in order to reduce locks and increase concurrency. Also reviewing the BSD/OS CAM lockdown to see what ideas can be shared. Work should hopefully puck back up in late July. Development is taking place in the FreeBSD Perforce repository under the //depot/projects/scottl-camlock/... branch for now.

Cronyx Adapters Drivers

URL: http://www.cronyx.ru/hardware/wan.html

Contact: Roman Kurakin <[email protected]>

cp(4) driver for Cronyx Tau-PCI was added. Cronyx Tau-PCI is family of synchronous WAN adapters with various set of interfaces such as V.35, RS-232, RS-530(449), X.21, E1, E3, T3, STS-1. This is a third family of Cronyx adapters that is supported by FreeBSD now. Now all three drivers cx(4), ctau(4) and cp(4) are on both major branches (HEAD and RELENG_4).

Busdma conversion was recently finished. Current work is concentrated on locking both for adapters drivers and for sppp (see my other report for additional information).

EuroBSDCon 2004 registration now open

URL: http://www.eurobsdcon2004.de/

Contact: Patrick M. Hausen <[email protected]>

Registration for EuroBSDCon 2004 taking place in Karlsruhe, Germany, from Oct. 29th to 31st has just opened. An early bird discount will be offered to all registering until Aug. 15th. Please see the conference website for details.

FreeBSD Brazilian Documentation Project

URL: http://doc.fugspbr.org
URL: http://lists.fugspbr.org/listinfo.cgi/doc-fugspbr.org
URL: http://developer.berlios.de/projects/doc-br/

Contact: DOC-BR Discussion List <[email protected]>

The FreeBSD Brazilian Documentation Project is an effort of the Brazilian FreeBSD Users Group (FUG-BR) to translate the available documentation to pt_BR. We are proud to announce that we've finished the Handbook and FDP Primer translation and they are being revised. Both should be integrated to the FreeBSD CVS repository shortly.

There are many other articles being translated and their status can be checked at our website. If you want to help please create an account at BerliOS, since our CVS repository is being hosted there, and contact us through our mailing list. Any help is welcome!

FreeBSD Dutch Documentation Project

URL: http://www.evilcoder.org/freebsd_html
URL: http://www.evilcoder.org/freebsd/handbook.tbz
URL: http://www.evilcoder.org/freebsd/html.tbz

Contact: Remko Lodder <[email protected]>

The FreeBSD Dutch Documentation project is a ongoing project translating the FreeBSD handbook {and others} to the dutch language. We are still on the look for translators and people that are willing to check the current html documentation. If you are interested, contact me at the email address shown above. We currently are reading for some checkups and then insert the first documents into the documentation tree.

FreeBSD Handbook, 3rd Edition, Volume II: Administrator Guide

URL: http://www.freebsd.org/docproj/handbook3.html

Contact: Murray Stokely <[email protected]>

The Third Edition of the FreeBSD Handbook has been split into two volumes. The first volume, the User Guide, has been published. Work is progressing on the second volume. The following chapters are included in the second volume : advanced-networking, network-servers, config, boot, cutting-edge, disks, l10n, mac, mail, ppp-and-slip, security, serialcomms, users, vinum, eresources, bibliography, mirrors. Please see the Task List for information about what work remains to be done. In addition to technical and grammatical review, a number of HTML output assumptions in the document need to be corrected.

FreeBSD ports monitoring system

URL: http://portsmon.firepipe.net/index.html

Contact: Mark Linimon <linimon_at_lonesome_dot_com>

The system continues to function well. The accuracy of the automatic classification algorithm has been improved by assigning a higher priority to port names found in pieces of Makefiles.

Several bugs had to be fixed due to the transition from bento to pointyhat. For about two weeks the URLs to the build errors were wrong. This has now been corrected (but note that some of the pointyhat summary pages themselves still show the broken links.)

A report was added to show only PRs in the 'feedback' state, so that committers can focus on maintainer and/or responsible timeouts. (As a reminder, the policy is 2 weeks). Another report on 'ports that are in ports/MOVED, but still exist' has also been added to the Anomalies page. Sometimes these are actual errors but not always.

Here are my latest observations about the trends in ports PRs:

  • We were (very briefly) down to 650 ports PRs. From looking at the graphs, this appears to be the lowest number since 2001. This is despite the fact that between the two time periods the number of ports had increased 70%.
  • We have made a little bit of progress on the number of PRs which apply to existing ports and have been assigned to a FreeBSD committer, from 400 to around 350. This is partly due to some committers going through the database, putting old PRs into the 'feedback' state, and then later invoking the 'maintainer timeout' rule mentioned above. (In some cases the PRs are now too old to still apply, and those are just closed.)
  • A few maintainers are currently responsible for one-third of those 350. Please, if you feel that you are over committed, consider asking for new volunteers to maintain these ports.
  • In terms of build errors, there is some new breakage from the preliminary testing with gcc3.4, which is even stricter with respect to the code it will accept than was gcc3.3. Many of these errors are shown as 'unknown' by the classification script. I have submitted a patch to fix this.
  • The majority of the build errors are still due to compilation problems, primarily from the gcc upgrades. Since FreeBSD tends to be at the forefront of gcc adaptation, this is to be expected, but IMHO we should really try to fix as many of these as possible before 5.3 is released.
  • The next highest number of build errors are caused by code that does not build on our 64-bit architectures due to the assumption that "all the world's a PC". Here is the entire list; the individual bars are clickable.

FreeBSD profile.sh

URL: https://projects.fsck.ch/profile/

Contact: Tobias Roth <[email protected]>

FreeBSD profile.sh is an enhancement to the FreeBSD 5 rcng boot system, targeted at laptops. One can configure multiple network environments (eg, home, work, university). After this initial configuration, the laptop detects automatically in what environment it is started and configures itself accordingly. Not only network settings, but almost everything from under /etc can be configured per environment. It is also possible to suspend the machine in one environment and wake it up in a different one, and reconfiguration will happen automatically.

FreeBSD/arm

Contact: Olivier Houchard <[email protected]>

Not much to report, Xscale support is in progress, and should boot at least single user really soon on an Intel IQ31244

Evaluation board.

FreeBSD/MIPS Status Report

URL: http://www.FreeBSD.org/projects/mips/
URL: http://www.mdstud.chalmers.se/~md1gavan/mips64emul/

Contact: Juli Mallett <[email protected]>

In the past two months, opportunities to perform a good chunk of work on FreeBSD/MIPS have arisen and significant issues with context switching, clocks, interrupts, and kernel virtual memory have been resolved. A number of issues with caches were fixed, however those are far from complete and at last check, there were issues when running cached which would prevent booting sometimes. Due to toolchain issues in progress, current kernels are no longer bootable on real hardware.

A 64-bit MIPS emulator has arisen giving the ability to test and debug in an emulator, and much testing has taken place in it. It has been added to the FreeBSD ports tree, and the port will be actively tracking the main codebase as possible. In general, FreeBSD/MIPS kernels should run fine in it.

Before toolchain and cache issues, the first kernel threads would run, busses and some devices would attach, and the system would boot to a mountroot prompt.

HP Network Scanjet 5

URL: http://berklix.com/scanjet/

Contact: Julian Stacey <[email protected]>

HP Network Scanjet 5 can unobtrusively run FreeBSD inside the scanner. Those who miss their Unix at work can have a FreeBSD box, un-noticed & un-challenged by blinkered managers who block any non Microsoft PC in the building. http://berklix.com/scanjet/

i386 Interrupt Code & PCI Interrupt Routing

Contact: John Baldwin <[email protected]>

Support for programming the polarity and trigger mode of interrupt sources at runtime was added. This includes a mini-driver for the ELCR register used to control the configuration for ISA and EISA interrupts. The atpic driver reprograms the ELCR as necessary, while the apic driver reprograms the interrupt pin associated with an interrupt source as necessary. The information about which configuration to use mostly comes from ACPI. However, non-ACPI systems also force any ISA interrupts used to route PCI interrupts to use active-low polarity and level trigger.

Support for suspend and resume on i386 was also slightly improved. Suspend and resume support was added to the ELCR, $PIR, and apic drivers.

The ACPI PCI-PCI bridge driver was fixed to fall back to the PCI-PCI bridge swizzle method for routing interrupts when a routing table was not provided by the BIOS.

Mixed mode can now be disabled or enabled at boot time via a loader tunable.

Improved Multibyte/Wide Character Support

Contact: Tim Robbins <[email protected]>

Many more text-processing utilities in the FreeBSD base system have been updated to work with multibyte characters, including comm, cut, expand, fold, join, paste, unexpand, and uniq. New versions of GNU grep and GNU sort (from coreutils) have been imported, together with multibyte support patches from developers at IBM and Red Hat.

Future work will focus on modifying the regular expression functions to work with multibyte characters, improving performance of the C library routines, and updating the remaining utilities (sed and tr are two important ones still remaining).

IPFilter Upgraded to 3.4.35

URL: http://coombs.anu.edu.au/~avalon/ip-filter.html

Contact: Darren Reed <[email protected]>

IPFilter has been upgraded in both FreeBSD-current and 4-STABLE (post 4.10) from version 3.4.31 to 3.4.35.

KDE on FreeBSD

URL: http://freebsd.kde.org

Contact: Michael Nottebrock <[email protected]>

The work on converting the build switches/OPTIONS currently present in the ports of the main KDE modules into separate ports in order to make packages available for the software/features they provide is progressing. Porting of KOffice 1.3.2 are nearly completed. The Swedish FreeBSD snapshot server http://snapshots.se.freebsd.org, operated and maintained by members of the KDE/FreeBSD team, is back up and running at full steam. Additional amd64 hardware has been added and amd64 snapshots will be available soon.

kgi4BSD

URL: http://www.FreeBSD.org/~nsouch/kgi4BSD

Contact: Nicholas Souchu <[email protected]>

KGI is going slowly but surely. The port of the KGI/Linux accel to FreeBSD is in progress. It's no more than a double buffering API for graphic command passing to the HW engine.

Most of the work in the past months was about console management and more especially dual head console. Otherwise a new driver building tree is now ready to compile Linux and FreeBSD drivers in the same tree.

Documentation about KGI design is in progress.

Low-overhead performance monitoring for FreeBSD

URL: http://people.freebsd.org/~jkoshy/projects/perf-measurement/

Contact: Joseph Koshy <[email protected]>

The current design attempts to support both per-process and system-wide statistical profiling and per-process "virtual" performance counters. The userland API libpmc(3) is somewhat stable now, but the kernel module's design is being redone to handle MP better. Initial development is targeting the AMD Athlon CPUs, but the intent is to support all the CPUs that FreeBSD runs on.

An early prototype is available under Perforce [under //depot/user/jkoshy/projects/pmc/].

Network interface naming changes

Contact: Brooks Davis <[email protected]>

An enhanced network interface cloning API has been committed. It allows interfaces to support more complex names then the current name# style. This functionality has been used to enable interesting cloners like auto-configuring vlan interfaces. Other features include locking of cloner structures and the ability of drivers to reject destroy requests.

Work on userland support for this functionality is ongoing.

Network Stack Locking

URL: http://www.watson.org/~robert/freebsd/netperf/

Contact: Robert Watson <[email protected]>

This project is aimed at converting the FreeBSD network stack from running under the single Giant kernel lock to permitting it to run in a fully parallel manner on multiple CPUs (i.e., a fully threaded network stack). This will improve performance/latency through reentrancy and preemption on single-processor machines, and also on multi-processor machines by permitting real parallelism in the processing of network traffic. As of FreeBSD 5.2, it was possible to run low level network functions, as well as the IP filtering and forwarding plane, without the Giant lock, as well as "process to completion" in the interrupt handler. This permitted both inbound and outbound traffic to run in parallel across multiple interfaces and CPUs.

Work continues to improve the maturity and completeness of the locking (and performance) of the network stack for 5.3. The network stack development branch has been updated to the latest CVS HEAD, as well as the following and more. Many but not all of these changes have been merged to the FreeBSD CVS tree as of the writing of this report. Complete details and more minor changes are documented in the README file on the netperf web page.

  • Addition of hard-coded WITNESS lock orders for socket-related locks, route locks, interface locks, file descriptor locks, SLIP, and PCB locks for various protocols (UDP, TCP, UNIX domain sockets). (Merged)
  • Modified MAC Framework to use inpcbs as the source for mbuf labels rather than reaching up to the socket layer, avoiding the additional acquisition of socket locks. Locked access to so_label and so_peerlabel using the socket lock throughout; assert socket lock in the MAC Framework where depended on. MAC Framework now makes a copy of the socket label before externalizing to prevent a copyout while holding the label lock (and potentially seeing an inconsistent label). (Merged)
  • Extensive annotation of locking state throughout the network stack, especially relating to sockets.
  • Several locking fixes for ng_base.c, the basic Netgraph infrastructure. (Merged)
  • Global accept filter list locking, especially during registration. (Partially merged)
  • Revise locking in socket state transition helpers, such as soisconnecting(), soisconnected(), etc, to simplify lock handling. (Merged)
  • Fix bugs in netatalk DDP locking, merge all netatalk locking to CVS. (Merged)
  • soref() socket locking assertions and associated fixes. (Merged)
  • Fifofs now uses its own mutex instead of the vnode interlock to synchronize fifo operations, avoiding lock order issues with socket buffer locking. (Merged)
  • Cleanup of locking related to file descriptor close and Giant requirements. Experimentation with reducing locking here.
  • Review and fix several instances of socket locking in the TCP code. (Merged)
  • NFS server locking merged to FreeBSD CVS. (Merged)
  • Accept locking merged to rwatson_netperf, and to FreeBSD CVS. A new global mutex, accept_mtx, now protects all socket related accept queue and state fields (SS_COMP, SS_INCOMP), and flags relating to accept are moved from the generic so_state field to so_qstate. accept1() rearranged, as with sonewconn() as a result, and a file descriptor leak fixed. Close a variety of races in socket referencing during accept. soabort() and other partially connected socket related functions updated to take locking into account. (Merged)
  • Issue associated with non-atomic setting of SS_NBIO in fifofs resolved by adding MSG_NBIO. (Merged)
  • Several flags from so_state moved to sb_state so they can be locked properly using the socket buffer mutex. (Merged)
  • Socket locks are now not held over calls into the protocol preventing many lock order issues between socket and protocol locks, and avoiding a substantial amount of conditional locking. (Merged)
  • mbuma, the UMA-based mbuf allocator, is merged to CVS. This reduces the kernel to one widely used memory allocator, improves performance, and allows memory from mbufs to be reclaimed and reused for other types of storage when pressure lowers. (Merged)
  • sb_flags now properly locked. (Merged)
  • Global MAC label ifnet lock introduced to protect labels on network interfaces. (Merged)
  • Rewrites of parts of soreceive() and sosend() to improve MP safety merged to CVS, including modifications to make sure socket buffer cache state is consistent when locks are released. sockbuf_pushsync() added to guarantee consistency of cached pointers. (Merged)
  • UNIX domain socket locking revised to use a subsystem lock due to inconsistencies in lock order and inconsistent coverage ofunpcb fields. Cleanup of global variable locking in UNIX domain sockets, Giant handling when entering VFS. All UNIX domain socket locking merged to CVS. (Merged)
  • netisr dispatch introduced in the routing code such that routing socket message delivery is performed asynchronously from routing events to avoid lock order issues. (Merged)
  • IGMP and multicast locking merged to CVS. (Merged)
  • Cleanup of lasting recursive Giant acquisition left over from forwarding/bridging plane only locking. (Merged)
  • ALTQ imported into the FreeBSD in a locked state. (Merged)
  • Conditional locking in sbdrop(), sbdroprecord(), sbrelease(), sbflush(), spappend(), sbappendstream(), sbappendrecord(), sbinsertoob(), sbappendaddr(), sbappendcontrol() eliminated. (Merged)
  • Some cleanup of IP stack management ioctls and lock order issues. (Merged)
  • Cleanup and annotation of sorflush() use of a temporary stack held socket buffer during flush. (Merged)
  • Substantial cleanup of socket wakeup mechanisms to drop locks in advance of wakeup, avoid holding locks over upcalls, and assertions of proper lock state. (Merged)
  • With the integration of revised ifnet cloning, cloning data structures are now better locked. (Merged)
  • Socket locking for portalfs. (Merged)
  • Global so_global_mtx introduced to protect generation numbers and socket counts. (Merged)
  • KAME IPSEC and FAST_IPSEC now use rawcb_mtx to protect raw socket list integration. More work required here. (Merged)
  • Socket locking around SO_SNDLOWAT and SO_RCVLOWAT. (Merged)
  • soreserve() and sbreserve() reformulation to improve locking and consistency. Similar cleanup in the use of reservation functions in tcp_mss(). (Merged)
  • Locking cost reduction in sbappend*(). (Merged)
  • Global locking for a number of Netgraph modules, including ng_iface, ng_ppp, ng_socket, ng_pppoe, ng_frame_relay, ng_tty, ng_eiface. (Merged)
  • IPv6 inpcb locking. Resulting cleanup of inpcb locking assertions, and enabling of inpcb locking assertions by default even with IPv6 compiled in.
  • if_xl now MPSAFE. (Merged)
  • soreceive() non-inline OOB support placed in its own function. (Merged)
  • NFS client socket locking. (Merged)
  • SLIP now uses a asynchronous task queue to prevent Giant-free entrance of the TTY code.
  • E-mail sent to current@ providing Giant-free operation guidelines and details.

Packet Filter - pf

URL: http://www.benzedrine.cx/pf.html

Contact: Max Laier <[email protected]>
Contact: Daniel Hartmeier <[email protected]>

We imported pf as of OpenBSD 3.5 stable on June, 17th which will be the base for 5-STABLE pf (according to the current schedule). The most important improvement in this release is the new interface handling which makes it possible to write pf rule sets for hot-pluggable devices and pseudo cloning devices, before they exist. The import of the ALTQ framework enabled us to finally provide the related pf functions as well.

Before 5-STABLE we will import some bug fixes from OpenBSD-current, which have not been merged to their stable branch, as well as some FreeBSD specific features. The planned ALTQ API make-over will also affect pf.

We are (desperately) looking for non-manpage documentation for FreeBSD pf and somebody to write it. Few things have changed so a port of the excellent "PF FAQ" on the OpenBSD homepage should be fitting. There are, however, a couple of points that need conversion. A simple tutorial how to setup a NAT gateway with pf would also help. The in-kernel NAT engine is very easy to use, we should tell people about this alternative. This is even more true since the pf module now plugs into GENERIC without modifications.

PowerPC Port

Contact: Peter Grehan <[email protected]>

The port has been moving along steadily. There have been reports of buildworld running natively. Works is almost complete on make release so there will be bootable CD images in the near future.

Project Mini-Evil

Contact: Scott Long <[email protected]>

Project Mini-Evil is an attempt to extend Bill Paul's 'Project Evil' Windows NDIS wrapper layer to the SCSI MiniPort and StorePort layers. While drivers exist for most storage controllers that are on the market today, many companies are integrating software RAID into their products but not providing any source code or design specs. Instead of constantly reverse-engineering these raid layers and attempting to shoehorn them into the ata-raid driver, Project Mini-Evil will run the Windows drivers directly. It will hopefully also run most any SCSI/ATA/RAID drivers that conform to the SCSI Miniport or Storeport specification.

Work on this project is split between making the NDIS wrapper code more general and implementing the new APIs. Development is taking place in the FreeBSD Perforce repository under the //depot/projects/sonofevil/... branch.

SMPng Status Report

Contact: John Baldwin <[email protected]>
Contact: <[email protected]>

Not a lot happened on the SMPng front outside of the work on locking the network stack (which is a large amount of work). The priorities of the various software interrupt threads were corrected and locking for taskqueues was improved. The return value of the sema_timedwait() function was adjusted to be more consistent with cv_timedwait(). A small fix was made to the sleepqueue code to shorten the amount of time that a sleepqueue chain lock is held when waking up threads. Some simple debug code for profiling the hash tables used in the sleep queue and turnstile code was added. This will allow developers to measure the impact of any tweaks to the hash table sizes or the hash algorithm.

Sync protocols (Netgraph and SPPP)

URL: http://www.freebsd.org/~rik

Contact: Roman Kurakin <[email protected]>

Currently I work on two directions: if_spppfr.c and sppp locking (on behalf of netperf). At the moment of writing this sppp locking is not ready yet. But it would be ready in couple of days. Also you may find as a part of this work some user space fixes for rwatson netperf code (Only that I was able to catch while world compilation. If you know some others let me know and I'll try to fix them too).

Since sppp code is quite big and state machine is very complicated, it would be difficult to test all code paths. I will glad to get any help in testing all this stuff. More tester more probability to test all possible cases.

Work on FRF.12 (ng_frf12) is frozen since of low interest and lack of time. Current state of stable code: support of FRF.12 End-to-End fragmentation. Support of FRF.12 Interface (UNI and NNI) fragmentation is not tested.

TTY subsystem realignment

Contact: Poul-Henning Kamp <[email protected]>

An effort to get the tty subsystem out from under Giant has morphed into an more general effort to eliminate a lot of code which have been improperly copy & pasted into device drivers. In an ideal world, tty drivers would never get near a cdevsw, but since some drivers are more than just tty drivers (for instance sync) a more sensible compromise must be reached. The work is ongoing.

Various GEOM classes and geom(8) utility

Contact: Pawel Jakub Dawidek <[email protected]>

I'm working on various GEOM classes. Some of them are already committed and ready for use (GATE, CONCAT, STRIPE, LABEL, NOP). The MIRROR class is finished in 90% and will be committed in very near future. Next I want to work on RAID3 and RAID5 implementations. Userland utility to control GEOM classes (geom(8)) is already in the tree.

VuXML and portaudit

URL: http://www.vuxml.org
URL: http://vuxml.FreeBSD.org
URL: http://www.freebsd.org/ports/portaudit/

Contact: Tom Rhodes <[email protected]>

The portaudit utility is currently an add-on to FreeBSD designed to give administrators and users a heads up with regards to security vulnerabilities in third party software. The VuXML database keeps a record of these security vulnerabilities along with internal security holes. When installed, the portaudit utility periodically downloads a database with known issues and checks all installed ports or packages against it; should it find vulnerable software installed the administrator or user is notified during the daily run output of the periodic scripts.

These utilities are considered to be of production quality and discussion is taking place over whether or not they should be included as part of the base system. All ports committers are urged to add entries when when a vulnerability is discovered; any questions may be sent to eik@ or myself.

News Home | Status Home