EuroBSDCon 2024

See FreeBSD wiki - you know where

Dr. Marshall Kirk McKusick

Author and Consultant

Who Should Take this Course

This course provides a broad overview of how the FreeBSD kernel implements its basic services. It will be most useful to those who need to learn how these services are provided. Individuals involved in technical and sales support can learn the capabilities and limitations of the system; applications developers can learn how to effectively and efficiently interface to the system; systems programmers without direct experience with the FreeBSD kernel can learn how to maintain, tune, and interface to such systems. This course is directed to users who have had at least a year of experience using a UNIX-like system. They should have an understanding of fundamental algorithms (searching, sorting, and hashing) and data structures (lists, queues, and arrays).

Description

This course will provide a firm background in the kernel services and I/O structure of the FreeBSD kernel. The course will cover basic kernel services, locking, process structure, scheduling, signal handling, jails, capsicum sandboxing, and virtual and physical memory management. The kernel I/O structure will be described showing how I/O is multiplexed, disks are managed, special devices are configured, and system virtualization is done. The presentations will emphasize code organization, data structure navigation, and algorithms. It will not cover the machine specific parts of the system such as the implementation of device drivers.

Morning - Kernel Overview

• Process structure
• Locking
• Communications
• Process Groups and Sessions
• Jails
• Scheduling
• Signals and timers
• Virtual memory management

Afternoon - Kernel I/O structure

• I/O data structures
• Disk Management
• Multiplexing I/O
• Autoconfiguration strategy
• Configuration of a device driver

Course Text

Prior to taking the course, students are recommended to obtain a copy of the course text: Marshall Kirk McKusick, George Neville-Neil, and Robert N. M. Watson, ``The Design and Implementation of the FreeBSD Operating System'', Second Edition, Pearson Education, Boston, MA September 2014, ISBN-13: 978-0-321-96897-5, ISBN-10: 0-321-96897-2.

One of FreeBSD's unique features is the close alignment of containers,
filesystems, and networking, within the base Operating System. There
are many jail manager tools, but they all use the same functionality
under the hood.

This 2024 version will cover an updated version of the core material
as in 2022 & 2023 in the morning, and in the afternoon, dig into using the
new OCI standard jails, using the podman
tools ported to FreeBSD by Doug Rabson.

Join the Elite. Attain Jail Enlightenment.

Along the way, you'll learn how jails are actually built in practice,
from scratch, and deepen your understanding of the relevant bits of
FreeBSD that allow you to do so.

This tutorial is suitable for beginners & intermediates, and will
go at an appropriate pace depending on attendees.

What You'll Learn

• learn the underlying truth about all jail tools
• wield & jail ZFS datasets like a ninja
• how to share data between hosts and jails
• time & interest permitting, delve into jail networking
  • VNET jails and wireguard
  • route packets with abandon
  • learn about overlay networking to make multiple jail hosts appear as one
• acquaint yourself with jail security
• summon customised jails like an arcane sorcerer

Pre-requisites

• basic knowledge of FreeBSD & sh(1)
• a vague understanding of ZFS
• a UNIX laptop capable of SSH and wifi
• the desire to ascend to a higher realm of reality

What You'll Accomplish

Why yes, you too can write your own Jail Management tool from scratch.
Alternatively, you'll know how existing jail management tools actually
work, and be able to get the most out of them.

You should be generally comfortable with the terminal, and have used
some pf.conf, and zfs already. It doesn't matter if you're not ok with all
of these, but it will be much harder if you've not got some hands-on
experience at all to relate to.

This tutorial digs into using FreeBSD's bhyve hypervisor and using virtualization for running FreeBSD or other operating systems on top of a FreeBSD host system.

During this tutorial we
- set up a FreeBSD guest VM
- connecting to your vm via serial console and VNC
- connect this VM to the network: routed or bridged?
- use ZFS for snapshotting and restoring VM states
- check out different vm management tools for simplifying bhyve use
- review necessary steps and caveats for virtualizing Windows or Linux

Prerequisites

This tutorial is tailored for an audience that is reasonably well-versed with using FreeBSD or Unix-like operating systems. You need to feel comfortable navigating a command line console and should be aware of networking basics.

You don't need to be familiar with bhyve or any other hypervisor, though it may help. Depending on the audience, we'll take a quick peek at the basics first if necessary.

This course is best enjoyed as a hands-on experience. Hence, there are a handful of requirements that need to be fulfilled so you can participate and follow along - aside from the aforementioned knowledge level, you will need

• console access to a FreeBSD system, with root level privileges
• it should be a current 14.0 RELEASE FreeBSD system, with up-to-date patches installed because we will rely on a couple of features that were only introduced recently
• preferably, said system should be a bare metal system because performance may be impacted otherwise or in the worst case, bhyve will not work
• you don't necessarily need direct hands-on access to said system, an ssh session will suffice
• your system should have Internet access to be able to download relevant FreeBSD related files; if you have a current FreeBSD ISO preloaded, it may be just enough to make it without connectivity.

You will need to execute commands on your system and understand the consequences of mistakes. You may lock yourself out of your system if you don't watch out, so be prepared and have a backup.

Sudo is used by millions to control and log administrator access to systems. However, in most cases, people use the default configuration or add a simple rule to allow a user to run a single command. The sudo workshop is for those who want to go well beyond the basics and want to practice many of the enterprise-focused features of sudo with a special focus on working with sudo log messages.

The sudo workshop starts with some of the basics through some fun examples, such as enabling insults for users, which is not enabled by default anymore. Once we verified that sudo and editing configuration works as expected, we will cover a wide variety of advanced topics, from session recording through JSON-formatted logging to extending sudo in Python. And probably some more, depending on time and the number of questions. Note that I might not be able to answer all questions: even though I helped a bit designing some of the most advanced sudo features, I am not a practicing sysadmin anymore.

This half-day tutorial brings users and sysadmins of BSD systems up to speed editing various files using Neovim, supported by LSPs (language server protocol). We learn how to configure the editor to turn it into a full blown IDE with similar functionality as VSCode. Developers will find support for a number of programming languages available, including debuggers, formatters, and linters. Sysadmins and users benefit from autoformatters, autocompletions, and indentations based on the file at hand. We cover the basic setup, installation, and configuration of LSPs and supporting plugins for BSD based systems.

Want to run virtual machines on your FreeBSD system? bhyve will help you with that, but there's so many ways to do it. We'll start with a few simple setup steps to get your first guest running and then move on to improve performance and security.

Who is this for?

This tutorial is tailored for an audience that is reasonably well-versed with using FreeBSD or Unix-like operating systems. You need to feel comfortable navigating a command line console and should be aware of networking basics.

You should already be familiar with bhyve to the degree of having used it before, or at the least you should have participated in the "Getting started with the bhyve hypervisor" tutorial.

What You'll Learn

This tutorial outlines the steps and various ways on
- how to set up the networking for a bridged or a routed virtual machine
- how to put bhyve in a jail and further improve the security of your host
- how to improve or break your CPU and I/O performance of your host and guest

Technical Prerequisites

This tutorial is best enjoyed as a hands-on experience. Hence, there are a handful of requirements that need to be fulfilled so you can participate and follow along - aside from the aforementioned knowledge level, you will need

• console access to a FreeBSD system, with root level privileges
• it should be a current 14.0 RELEASE (or newer) FreeBSD system, with up-to-date patches installed because we will rely on a couple of features that were only introduced recently
• preferably, said system should be a bare metal system because performance may be impacted otherwise or in the worst case, bhyve will not work
• you don't necessarily need direct hands-on access to said system, an ssh session will suffice
• your system should have Internet access to be able to download relevant FreeBSD related files; if you have a current FreeBSD ISO preloaded, it may be just enough to make it without connectivity.

You will need to execute commands on your system and understand the consequences of mistakes. You may lock yourself out of your system if you don't watch out, so be prepared and have a backup.

See FreeBSD Wiki - you know where

Dr. Marshall Kirk McKusick

Author and Consultant

Who Should Take this Course

This course provides a broad overview of how the FreeBSD kernel implements its basic services. It will be most useful to those who need to learn how these services are provided. Individuals involved in technical and sales support can learn the capabilities and limitations of the system; applications developers can learn how to effectively and efficiently interface to the system; systems programmers without direct experience with the FreeBSD kernel can learn how to maintain, tune, and interface to such systems. This course is directed to users who have had at least a year of experience using a UNIX-like system. They should have an understanding of fundamental algorithms (searching, sorting, and hashing) and data structures (lists, queues, and arrays).

Description

This course will provide a firm background in the filesystems and networking capabilities supported by the FreeBSD kernel. The course describes the VFS filesystem interface that supports multiple filesystem types. The course covers the implementation and capabilities of the UFS filesystem and the techniques for maintaining filesystem consistency. The filesystem section ends with a description of the ZFS filesystem capabilities, implementation, and integration into FreeBSD. The course also covers the socket-based network architecture, layering, and implementation. The socket communications primitives and internal layering will be discussed, with emphasis on the interfaces between the layers; the TCP/IP implementation will be used as an example. A discussion of routing issues and the netmap interface will be included. The presentations will emphasize code organization, data structure navigation, and algorithms. It will not cover the machine specific parts of the system such as the implementation of device drivers.

Morning - Filesystems Overview

• Filesystem organization
• Block I/O system (buffer cache)
• Support for multiple filesystems
• UFS Filesystem implementation
• ZFS Filesystem implementation

Afternoon - Networking Implementation

• System layers and interfaces
• Internet Protocols
• Mbufs and control blocks
• Routing issues
• TCP algorithms

Course Text

Prior to taking the course, students are recommended to obtain a copy of the course text: Marshall Kirk McKusick, George Neville-Neil, and Robert N. M. Watson, ``The Design and Implementation of the FreeBSD Operating System'', Second Edition, Pearson Education, Boston, MA September 2014, ISBN-13: 978-0-321-96897-5, ISBN-10: 0-321-96897-2.

Even in today's day and age of various free email options and commoditization of email services, there's still many good reasons for running your own mail server - privacy and security just being two of them.
In this tutorial, we'll set up a FreeBSD host with
- certbot for acquiring LetsEncrypt certificates
- postfix smtp server with support for virtual users and multiple domains
- spam assassin spam filter
- amavis virus scanner
- cyrus imap server
- nextcloud webmail with 2-factor auth
- setting up dkim and dmarc
- improved security with pf, fail2ban, sshguard and vnet jails
- caveats and pitfalls

The OpenBSD Packet Filter (PF) is at the core of the network management toolset available to professionals working with the BSD family of operating systems.

Understanding the networking toolset is essential to building and maintaining a functional envirionment. The present session will both teach principles and provide opportunity for hands-on operation of the extensive network tools available on OpenBSD and sister operating systems in a lab environment. Basic to intermediate understanding of TCP/IP networking is expected and required for this session.

Topics covered include

• The basics of and network design and taking it a bit further

• Building rulesets

• Keeping your configurations readable and maintainable

• Filtering, diversion, redirection, Network Address Translation

• Handling services that require proxying (ftp-proxy and others)

• Address tables and daemons that interact with your setup through them

• The whys and hows of network segmentation, DMZs and other separation techniques

• Tackling noisy attacks and other pattern recognition and learning tricks

• Annoying spammers with spamd

• Basics of and not-so basic traffic shaping

• Monitoring your traffic

• Resilience, High Availability with CARP and pfsync

• Troubleshooting: Discovering and correcting errors and faults

• Your network and its interactions with the Internet at large

• Common mistakes in internetworking and peering

• Keeping the old IPv4 world in touch with the new of IPv6

Time allowing and to the extent necessary, we will cover recent developments in the networking tools and variations between the implementations in the sister BSD operating systems.

Participants should bring a laptop for the hands on labs part and for note taking. The format of the session will be compact lectures interspersed with hands-on lab excercises based directly on the theory covered in the lecture parts.

This session is an evolutionary successor to previous sessions. Slides for the most recent version of the PF tutorial session are up at https://nxdomain.no/~peter/pf_fullday.pdf, to be updated with the present version when the session opens.

Speakers:

Peter N. M. Hansteen, Senior Technical Specialist at Tietoevry. Author of The Book of PF (https://nostach.com/pf3), occasional blogger (https://bsdly.blogspot.com) and lecturer on IT security with a strong preference for OpenBSD.

Massimiliano Stucchi, Technical Advisor at The Internet Society, IPv6 enthusiast, frequent lecturer on network security and IPv6 matters.

Tom Smyth, CTO wireless Connect Ltd, Maintainer of the NSH network Shell for OpenBSD.

Hashicorp Vagrant is a powerful platform for local automated creation and deployment of virtual machines. I'll show the basics and multiple practical examples of how to use Vagrant to create FreeBSD based development environments on a suitable machine.

Participants need an amd64 laptop and VirtualBox and Vagrant installed on their operating system of choice to follow the practical parts of the tutorial. I'm using NFS for folder sharing, so Windows is probably out. Mac OS, any BSD that supports VirtualBox, or Linux will all do fine.

Full source code is provided on Github.

FreeBSD, bhyve and ZFS make a great framework to build a Type-1 hypervisor with. It provides a well-supported platform that can be used to host all modern operating systems.

The half-day tutorial that is aimed at beginner to intermediate skills, will give participants a hands-on learning experience to build up a FreeBSD host to host various operating systems and perform expected management tasks.

Key areas of focus will include:
* Hardware selection
* Software configuration toolchain from ports/packages
* Priming a system ready for use
* Templates for various operating systems
* Network configurations
* Various guest storage types under ZFS and considerations needed based on workloads
* Guest console management via serial or VNC
* Installation and management of various guest operating systems

Participants that wish to engage in the practical aspects of the tutorial will be expected to attend with a laptop that has WiFi connectivity. Those that wish to follow along using a FreeBSD laptop are welcome with that type of configuration as long as they have the means to download software from the provided WiFi network and FreeBSD repositories.

The EU has been transformative for many of its member states.
The EU has a reputation for lots of documentation, directives rules and regulations. But why are these in place? How are these policies formed, who starts them who edits them who approves them? How do and why should interested parties interact with these initiatives from these authorities?

How is all this relevant to BSD users? be them commercial and non commercial, How is this relevant to BSD developers both professional and vocational? What are the effects on the BSD foundations that co-ordinate the activities of the development community? Finally how all this affects the downstream commercial (beneficiaries) that utilise the genius of BSD code and its associated permissive license in their products / services?

My humble experience is that the EU are open to feedback from even the Smallest of Enterprises. And that constructive engagement with the Folks in Brussels can yield positive results for the citizens and communities such as the BSD Community. As a community we need to have a seat at the table to shape and influence policies that affect the Internet and the Open Source Community so that freedom of thought freedom of expression and freedom of communication can continue to flourish.

Celebrate 10(ish) years of FreeBSD/arm64! I will talk about the history of FreeBSD on AArch64.

This will cover the history of FreeBSD on AArch64, how to learn the architecture before documentation was publicly available, getting support into the repo, architecture extension enablement, side projects along the way, and recent developments.

We've all heard stories of the dreaded cosmic ray angrily flipping bits
in your RAM. But how much does it matter, really? And, more
importantly, how do you tell?

This talk will cover an overview of hardware architecture around
detecting and correcting memory errors, software support for handling
them and other types of hardware errors, and stories of memory errors
in the real world.

And, if the stars align, perhaps we'll have a live demo.

Since OPNsense started in 2015 a lot of work went into open and simple build tooling covering topics such as custom packaging, pkg support, source and ports tree management, signature verification and much more. This talk details some of the problems encountered, solutions implemented, how the build tooling evolved over the years and which importance the resulting fast release engineering responses have nowadays for improving overall distribution quality further.

The presentation delves deep into the rc(8) service scripts. We will begin by analyzing the service script framework in FreeBSD, which is built around rc(8) and rc.subr(8), and take a closer look at some of the most recent additions. Next, we will not only discuss common patterns used to implement different kinds of service scripts (i.e., the scripts residing in rc.d directories) but also examine unusual and complex scripts in detail. Additionally, we will explore all the most relevant parts of the rc(8) subsystem, such as rc.conf(8), rcorder(8), sysrc(8), and service(8). As a result, you should be able to easily design, implement, debug, and maintain FreeBSD service scripts.

We will see how to set up a small ARM computer (RPi3B) to be a remote data logger for wind speed. We will be using gpioctl(8) and gpioirq(4) to collect data. The main objective of the talk is to show how to use gpios to interact with the world that lives outside the computer.

Modern web development is intrinsically tied to javascript and frameworks have been pushing us further and further away from the initial model of the internet as a web of documents. In response to this, libraries like htmx and data-star have arisen to demonstrate ways to use hypermedia to create interactive applications.

Hypermedia as the engine of application state (HATEOS) is a driving principle of these new libraries and by allowing the backend to drive the state of the frontend directly without requiring the user to write javascript code, they make it possible to do hypermedia on whatever you like (Otherwise known as the HOWL stack).

That means that with nothing but the OpenBSD base install and a small javascript shim (12kb at the time of writing), we can write realtime hypermedia applications. We will explore the case of a small web application that monitors the state of it's server and offers real time updates of it's metrics.

Ravenports (http://www.ravenports.com & https://github.com/ravenports), a package building framework, is the latest addition to the family of ports systems. Its portability allows it to be used on multiple BSDs (and beyond). Modern design and tooling make it a reliable and low-maintenance option especially for heterogeneous environments. This talk covers what RP is, why it was created and what makes it stand out. It also includes a quick comparison to Pkgsrc and presents some statistical data on the project. Support for DragonFly BSD and MidnightBSD afford the opportunity to touch on two platforms not widely covered otherwise.

In this talk, we will review FreeBSD’s rtprio(2) and POSIX.1b’s scheduling interfaces and embark on a journey around FreeBSD’s implementation of scheduling priorities. It started with a desire to fix a few apparently simple bugs of rtprio(2) and to add some reasonable features and, one thing leading to another, became an almost complete rewrite of this system call and the POSIX.1b’s interfaces’ implementations, as well as some aspect of the schedulers. We will touch on the most interesting problems that the implementation had, in terms of POSIX compliance, security and consistency, and then explain how we fixed or are fixing them. As of this writing, this project is still a work in progress, with about ~30% of the changes being under review. We will report about its status during the talk.

In OpenBSD 7.4, the native hypervisor, vmd(8) became the only open source type-2 hypervisor to default to using a multi-process, privilege separated model for emulating block and network devices.

This talk provides a look at the inspiration from Oracle's contributions to QEMU as a means of multi-layered defense, a review of the challenges and changes required to OpenBSD across 7.4 and 7.5, and a look at the road ahead.

Packet radio, first popular in the 70s & 80s as a foundation of the modern internet, has seen a modern resurgence in popularity as computers and radio equipment has become cheaper, amateur radio regulations have become more permissive and new experimenters have developed an interest in building and growing radio networks.

I will speak about the social, technical and user experience of building a new packet radio network in UK and Ireland using open software on Linux, FreeBSD and Windows. I will cover interconnecting it with legacy users and learning the old ways, connecting to overseas stations when the sun isn’t angry and facilitating entirely new users with documentation, repositories & packages.

This 45-minute talk will cover some of the recent advocacy efforts by the FreeBSD Foundation, the recent user stories we've worked on, and how we continue to advocate for the FreeBSD community.

However, the greatest resource for FreeBSD is the community itself. The Foundation is dedicated to helping you advocate for FreeBSD and has provided resources to help. The talk will cover some of these resources (installfests, travel grants, educational grants, etc.) and how they can be tools for everyday advocacy.

OpenBSD provides the fw_update(8) utility to handle installing firmware for hardware from manufacturers whose licensing isn't compatible with our base system. We will take a trip into the history of fw_update(8), its structure and why it exists. A recent rewrite provides an illustration of the value OpenBSD places on simplicity and user experience.

This talk goes over using OpenBSD as the basis for a highly available globally distributed public anycast network. Distributed decision systems corosync, consul, and raft (using Elixir) are discussed, as are highly available distributed storage and routing systems, all on OpenBSD, all on a budget.

Since the internet exists, people have been trying to circumvent security. Whereas most people nowadays do so for financial gain, 30+ years ago the world looked different. The internet connected academia. The people hacking were students, almost the only people who had access. Not many system administrators were paying much attention to security and for hackers, breaking into sites such as that of NASA, were ways to gain a reputation. In this presentation, "one of the Dutch hackers" will take a look at the hacking scene in the late 1980s, early 1990s.

We describe how the FreeBSD kernel was extended to facilitate multihoming and network mobility for UDP and TCP without changing the sockets API. Our solution -- the Identifier-Locator Network Protocol (ILNP) -- is an evolution of IPv6 that only requires updates to end systems. We show unmodified applications using the modified kernel to benefiting from network-layer mobility and multihoming over the global IPv6 Internet without requiring the cooperation or knowledge of ISPs, or modifications to existing infrastructure.

We will give an overview of past, present and future work on IPv6 in OpenBSD.

We will show how we replaced KAME stack code in both the kernel as well as userland with modern, privilege separated daemons for stateless address auto configuration. slaacd(8) runs on the host to solicit router advertisements and configures addresses and routes. rad(8) runs on the router to send router advertisements. A newly written daemon for DHCPv6, dhcp6leased(8), requests prefixes from an upstream ISP which then can be used by rad(8) for router advertisements.

Next we will show the new IPv6 source address selection in the kernel, including support for the infamous Rule 5.5 of RFC 6724.

In ongoing and future work we will touch on client-side address translation using pf(4)'s af-to feature to support the 464XLAT transition mechanism for v6-mostly networks.

Now that LinuxBoot support is integrated into FreeBSD, you may be wondering how to effectively use LinuxBoot to build an image to boot FreeBSD. Since this approach is not yet well documented, I will offer some helpful tools and advice for working within this environment.
First, I will introduce LinuxBoot, discuss where it’s used, and cover key pieces of LinuxBoot architecture. I will then present an overview of the Flash File System (FFS) structure used to store firmware; explain some tools to create, extract, and repackage FFS images; and share examples of aarch64 and amd64 running under QEMU created using these tools. In addition, I will discuss physical hardware concerns, issues related to burning images for booting on bare metal hardware, and techniques for minimizing an existing UEFI image to make room for a Linux kernel. Next, I will walk you through creating your own custom configuration for the minimal kernel in this constrained LinuxBoot environment. Finally, I’ll survey tools to create the initrd the Linux kernel needs to then boot FreeBSD.

A few years ago, we decided to migrate many of our servers (and many of those of our clients) from Linux to the BSDs - FreeBSD, OpenBSD, NetBSD - depending on the specific services. In this presentation, I will discuss the reasons behind our decision, the technical and organizational challenges we faced, the tangible benefits we have experienced, and why we believe this migration is successful. I will provide specific examples and real-life case studies. In an increasingly complex world, relying on simple, stable, and secure solutions is becoming more and more important, and the BSDs can make a significant contribution in this direction.

ICT is currently responsible for somewhere around 2-6% of global emissions. As a comparison aviation hovers at around 2%. In this talk we will discuss some ways we might alleviate this somewhat by making more sustainable software.

When debugging network issues, it is important to understand when
certain things happen. Tcpdump provides valuable insight, pf
transforms packets, pseudo devices add features, and netstat counters
show action. The call graph of the functions within the kernel is
the base to comprehend the relation between these sources of
information.

The layering of kernel code in hardware drivers, pseudo devices,
IP processing, forwarding and protocol layer is explained. The
kernel provides the socket interface to userland processes. Packet
forwarding happens within the kernel. Bridge code uses certain
shortcuts. pf is a swiss knife that can manipulate traffic in
multiple layers. IPsec has an independent interface that overrides
routing. Routing itself and neighbor discovery is a necessary step
that has its tentacles everywhere. Checksum calculation can be
performed by hardware offloading.

By using examples with a single packets, their way through the
kernel is shown. The possible branches, configuration options, and
measurement output are put in correlation.

In an ever-evolving landscape of home automation, FreeBSD stands out as a reliable platform for integrating advanced technologies. This presentation showcases a FreeBSD-based smart home system that combines Home Assistant for data normalization, Apache Kafka for real-time event handling, and OpenSearch for long-term data storage and machine learning predictions.

The system efficiently manages essential household functions like lighting, shutters, and energy management, leveraging KNX for robust in-house communication and ReST-APIs for flexible external integrations. Its architecture supports various data sources, facilitating real-time analytics and enabling automated, responsive environments.

Prioritizing energy optimization and user comfort, the system not only highlights the potential of open-source solutions in everyday life but also discusses practical implementations and the challenges addressed in creating a self-learning, energy-efficient smart home environment.

System Control and Management Interface (SCMI), is a protocol comprising a set of operating system independent software interfaces that are used for control and management on ARM platforms: it aims to abstract and unify such operations, while delegating policies-enforcement to a central entity which lives out of the main RichOS codebase, aiding virtualization and security.

Increasingly adopted in the Linux/ARM world, it has already a minimal, but working, implementation also in freeBSD.

This talk, after having presented the SCMI protocol and its benefits, will detail its current support-status on freeBSD and any planned and ongoing work.

Pointers have provenance which is the notion that pointers to separate objects of different origins are distinct regardless of the pointer’s address value. This is true in systems programing languages include C, C++, and Rust and deterministically enforced by hardware and software on CHERI systems (systems such a Arm’s PAC and MTE also provide probabilistic enforcement).

We developed address space reservations (hereafter reservations) to support CHERI’s strict provenance model and other aspects of CHERI capabilities. Reservations are implemented in the vm system and exposed by the mmap() family of system calls. They are driven by collision of the constrains of mmap() with the constraints imposted by CHERI capabilities. Somewhat surprisingly, we have been able to design a system requiring few changes to existing code despite these constraints and obeying the resulting constraints has correctness and understandability benefits for existing software.

Latrobe Community Health Service (LCHS) - AS139466 - is a Not for Profit (NFP)/Non-Government Organisation (NGO) headquartered in Victoria, Australia. The organisation consists of 40 offices and 2 data centres across the States of Victoria and New South Wales with over 1,500 employees. All LCHS infrastructure is designed and managed in-house without the use of large-scale cloud infrastructure. Since 2015, BSD Unix has been used for various workloads within the organisation.

This talk focuses on our next generation SD-WAN appliance built on OpenBSD technology using commodity hardware. Topics will include the network topology, design choices, various OpenBSD VPN and routing technologies and orchestrating build, deployment and management across the fleet using Ansible.

In 2023 the FreeBSD Project celebrated its thirtieth year of providing a complete system distribution. This talk tries to understand what it is that has made FreeBSD one of the few long-term viable open source projects. Most of the projects with long-term successes are sponsored by companies that base their products around the open-source software that they actively nurture. While FreeBSD has companies actively using and supporting it, they have come and gone over the years; none has been the primary long-term proponent of it. Thus the FreeBSD community has been the biggest factor in sustaining the project. Often open-source communities depend on long-term leadership of key individuals, for example Linus Torvolds with Linux. FreeBSD has managed to successfully bring in several new leaders over its lifetime which has been key to its ability to continue to adapt to the new challenges that it faces. This talk is based on the article of the same title that I wrote in the May/June FreeBSD Journal that had a 30-year retrospective of FreeBSD.

Confidential computing is a family of techniques to enhance security
and confidentiality for data in use. One technical approach is strong
isolation for virtual machines.

AMDs Secure Encrypted Virtualization (SEV) offers several feature sets
for isolation of guest virtual machines from an non-trusted host hypervisor
and operating system. These feature sets include memory encryption,
encryption of guest state including CPU registers and an attestation
framework.

In this talk we will explore some of the AMD SEV feature sets. We will
describe how to use them to run OpenBSD as both

• a confidential guest VM and
• a host hypervisor providing a confidential execution environment.

Topics covered are CPU feature detection, low level kernel initialization,
memory management, virtio(4) device drivers and the virtual machine
daemon vmd(8).

When we speak about supporting wireless cards and standards, the distance between Linux and FreeBSD is increasing, and that is an important factor when one chooses an OS for one's computer. How about quickly jumping this gap through a creative combination of bhyve, PCI pass-through, and a slim Linux guest? How does it compare to the LinuxKPI-based native solution which has been in the making, is it better or worse, redundant or not, secure enough? Please join me in the search for the answers to these valid questions.

The FreeBSD open source operating system provides a powerful set of features to facilitate the deployment, virtualization, and serving of Microsoft Windows environments ranging from small research labs to enterprise deployments. Its exemplary integration with the OpenZFS file system and volume manager, its bhyve hypervisor, and its overall unity play key roles in FreeBSD’s ability to perform these three roles and combined with ported third party software, it can facilitate:

Deployment
Windows Product Registration
Key Retrieval
Automated Installation
Remote Console and Desktop Access
Virtualization
Server Virtualization
Desktop Virtualization
Serving
Bi-directional, SMB, NFS, and iSCSI Sharing
Active Directory Domain Participation
Active Directory Domain Serving
NTFS Mounting and Management
Data Synchronization and Replication
Native Windows OpenZFS Deployment

Setting up Continuous Integration & Delivery tools always seems to be very painful. And yet with the powerful tools like ZFS, lua in base, pf.conf and jails on FreeBSD, this could be a whole lot easier. Maybe, even, fun?

This talk covers the following areas, with specific implementation details on FreeBSD.

Interfaces both community and technical

• what might an "open" CI look like?
• how could we foster that?
• the agent-server protocol
• the per-job configuration
• server workflow that allows distributing and processing multiple concurrent tasks to many agents

Implementation

• using jails from C for great good
• libUCL for validating incoming data
• Lua and specifically the C-Lua interface, how to use it to build a user-facing plugin system, and how to add a pub-sub system

I hope that, eventually, these tools will be able to be used on more than just FreeBSD, so this should be of interest for all BSD-powered people and organisations.

My wounds from over a decade of Jenkins and many other CI tools have still not healed. They probably never will. Instead, let's talk about building a native CI from scratch, and paper over the scars with something beautiful, and new, and with different bugs and flaws.

FreeBSD jails arrived on the scene with FreeBSD 4.0 (2000) and Dan Langille has been playing with them since at least FreeBSD 4.1 (also 2000). His first documented usage was creating a jail for Open Source Weekend (OSW) in November 2003. Since then, he's been using jails on a near-daily basis for many simple solutions and for things he recommends you do not try at home.

He started using plain vanilla jails, then went to ezjail, then iocage, and is now back on plain vanilla jails. Topics covered will include:

• using Let's Encrypt via acme.sh, a hidden DNS master, public DNS servers, and a public website to distribute new certs via anvil
• how FreshPorts uses three jails for ingesting commits and displaying them on the website
• a database testing jail which loads each daily database backup to test it works
• building the packages he needs using poudriere in a jail
• multiple jails running PostgreSQL
• running a jail within a jail
• modifying pkg-audit to ignore certain jails
• why I had to create a website proxy for all the in-house websites
• having a portal jail on a hosting provider as a front end for jails running in his basement
• Time Machines for Apple hardware
• Using SamDrucker to keep track of what packages are installed where
• Applications in their own jails include PostgreSQL, gitea, MSQL, LibreNMS, named, Unifi, Mosquitto
• Why you should use pushover.net

There will be a lot of items covered, it will be fast-paced, and you'll get at least one idea for doing something in your own projects (worst case: you'll know what to avoid doing).

FreeBSD's device driver subsystem supports a hierarchy of device objects. Devices for interior nodes in the tree are buses. Drivers for bus devices have unique requirements beyond those of leaf nodes. One of these requirements is managing shared resources such as MMIO regions and interrupt pins required by child devices.

The kernel provides several APIs bus drivers can use to manage shared resources. This talk will cover these including the rman(9) resource manager, resource lists, and various sets of generic helper routines that can be used to implement device methods.

Examining the building blocks provided by FreeBSD to build physical or virtual/cloud appliances.

• Installation and image generation
• Secure Boot and Veriexec
• Upgrade mechanism (fail-safe upgrades, offline upgrades, seemless rollback)
• Custom security policies with Mandatory Access Controls
• PKI and signing
• Package management
• Immutability and "factory reset"
• Deployment and automation
• Best practices for maintain a fork of FreeBSD (and/or OpenZFS)

FreeBSD provides a very powerful base for building appliances, and can allow a vendor to bring a product to market very quickly. However there are many lessons that can be shared from those that have come before to avoid common pitfalls, and ensure the long term sustainability of a product.

We use FreeBSD as a base OS for our routers, firewalls and VPN gateways in our enterprise network. Ipfw is used to filter traffic between our employees' devices and servers located in our DCs as well as on the Internet. Having more than 65 thousand unique usernames, different filtering policies for wired/wireless/vpn environments, we pack 500 millions of elementary rules (e.g. allow tcp from user@entry_media to myserver 443) into a single router running FreeBSD and ipfw. One single box handles up to 10Gbit/s of traffic.
In my talk I give you a bird's eye view of our approach and share some hints to unleash the full potential of ipfw.

Last year, the FreeBSD Foundation sponsored work to reimplement the libc string functions with SIMD techniques for amd64. As a result, performance was improved by a factor of 5 on average. In this talk, we'll have a look into the basics of SIMD programming, techniques used in this project and how the various constraints and challenges posed by string processing were negotiated.