The focus of this project was to review past vulnerabilities, create vulnerability testing tools and to discover new vulnerabilities in the FreeBSD IPv6 stack which is derived from the KAME project code. During the summer Clement took two libraries, the popular libnet, and his mentor's Packet Construction Set (PCS) and created tools to find security problems in the IPv6 code. Several issues were found, bugs filed, and patches created. At the moment Clement and George are editing a 50 page paper that describes the project which will be submitted for conference publication.

All of the code from the project, including the tools, is on line and is described in the paper.

By all measures, this was a successful project. Both student and mentor gained valuable insight into a previously externally maintained set of code. In addition to the new tools development in this effort, the FreeBSD Project now also has a new engineer to help work on the code.

Chris added support for limiting CPU and memory use by jails. This allows fairer sharing of systems' resources between divergent uses by preventing one jail from monopolizing the available memory and CPU time, if other users and jails have processes to run.

The code is currently available as patches against RELENG_6, and Chris is in the process of applying it to -CURRENT. More details can be found at JailResourceLimits.

The goal of this project was to create a virtual storage class for the GEOM framework in FreeBSD that would allow creating "overcommited" storage devices, with a size larger than that of available physical storage (e.g. hard drives). The project was completed successfully, and the result is available on the project's home page. It's expected the project will be included in FreeBSD CVS after it gets more testing or after FreeBSD 6.2 is released, whichever comes first.

Working on the project was very pleasant, there was enough documentation and the mentor was very helpful and responsive. Google's team was apt and provided ample support to the participants of the project. The project will help both OEMs of embedded devices (such as NAS devices) and big users to make use of FreeBSD for large storage projects.

This project consisted in the improvement of the interrupt handling system in FreeBSD: while retaining backward compatibility with the previous models (FAST and ITHREAD), a new method called 'Interrupt filtering' was added. With interrupt filtering, the interrupt handler is divided into 2 parts: the filter (that checks if the actual interrupt belong to this device) and the ithread (that is scheduled in case some blocking work has to be done). The main benefits of interrupt filtering are:

• feedback from filters (the system finally knows if any handler has serviced an interrupt or not, and can react consequently).
• lower latency/overhead for shared interrupt line.
• previous experiments with interrupt filtering showed an increase in performance against the plain ithread model

Moreover, during the development of interrupt filtering, some MD dependent code was converted into MI code, PPC was fixed to support multiple FAST handlers per line and an interrupt stray storm detection logic was added. While the framework is done, there are still machine dependent bits to be written (the support for ppc, sparc64, arm and itanium has to be written/reviewed) and a serious analysis of the performance of this model against the previous one is a WIP.

Successfully got a domU kernel usable for installation. domO support still in progress. Kip and Yuan Jue are continuing to work together on this project after the official end of SoC.

This summer was spent adding support for 4Front's OSSV4 API to FreeBSD. A large chunk of audio ioctls were added, with a few pending, and there is still work left to do with mixers/mixer extensions (4Front's specs are still in flux) and MIDI (low priority because, IIRC, MIDI still needs maintainership). I plan to continue work related to the mixer extensions as best I can while attending university full-time.

For me, Google Summer of Code was a new and very exciting experience. I got actively involved in doing Open Source Software and giving something back to the community. Facing to some challenges within the project forced me to look behind the scenery of FreeBSD. The result was a better understanding of the overall system. Getting in touch with a lot of developers directly also gave a very special spirit to the Summer of Code.

I really enjoyed the time and will continue to work on the project also after the deadline. For me, it was a great chance to get involved in active development and not just doing some scripts and hacks at home. Getting paid for the work was just a small part of the overall feeling.

Thanks people at FreeBSD and Google for the really, really great time!

After working on bsnmptools last year, Shteryana concentrated on the server side this year. An implementation for if_vlan(4) monitoring was dropped from the original proposal in favor of extended support for the new if_bridge(4) network bridge device monitoring module. In addition to RFC 4188 single bridge support and extending the kernel to get access to all the information a private MIB was designed. This was needed to be able to monitor multiple bridges supported by FreeBSD and adding an extended bridge management interface and definitely was the greatest technical challenge of the project.

The project was successfully completed - including code review - and the kernel part has already been committed to CURRENT. User space part will follow soon. For STABLE a patch is available too (see wiki). Shteryana is going to continue her work on bsnmpd and is already planning support for if_vlan(4) and jails monitoring modules. We are happy that she will stay with the FreeBSD project and continue to work on bsnmp and FreeBSD after SoC.

See also ShteryanaShopova and SnmpBridgeModule.

The project consisted of 5 parts:

1. Nsswitch modules and libc separation. The idea was to move the source code for different nsswitch sources (such as "files", "dns", "nis") out of the libc into the separate shared libraries. This task was successfully finished (the patch is available).
2. Regression tests for nsswitch. A set of regression tests to test the correctness of all nsswitch-related functions and the invariance of their behavior between system upgrades. I think that task can be considered successfully completed (the patch is available).
3. nss_ldap rewriting. Though, this task was not clearly mentioned in the original proposal, during the SoC we found reasonable not to simply import PADL's nss_ldap, but to rewrite it from scratch (licensing issues were among the basic reasons for this). The resulting nss_ldap nsswitch module, though, behaves mostly similar to the PADL's one, has different (I believe - more flexible) architecture. Though it's basically finished, several useful features from the PADL's nss_ldap still need to be implemented. But, despite the lack of some features, I believe, that this task can be considered to be successfully completed. (Missing features will be implemented ASAP - hopefully during the September).
4. nss_ldap importing into the base. The task was to prepare a patch, that will allow users to use nss_ldap from the base system. The task was successfully completed (the patch is available), but required to import OpenLDAP into the base in order for nss_ldap to work properly, and it had led to a long discussion in the mailing list. This discussion, however, have concluded with mostly positive opinions about nss_ldap and OpenLDAP importing.
5. cached performance optimization. The caching daemon performance needs to be as high as possible in order for cached to be as close (in terms of speed) to "files" nsswitch source as possible. Cached's performance analysis was made and nsswitch database precaching was introduced as the optimization. This task was completed (the patch is available). However there is an area for improvements - more precise and extensive performance analysis should be made and more optimizations need to be introduces. This will be done in the nearest future.

Though none of the code was committed yet into the main, official FreeBSD tree, my experience from the previous year makes me think that this situation is normal. I hope, that the code will be reviewed and committed in the coming months.

More detailed information about the project can be found at LdapCachedDetailedDescription.

Roman was enthusiastic and optimistic, so I compiled a large TODO list which would have been enough for 2 students. The basics of 2.6.16 support have been implemented, and several programs from Fedora Core 4 work now with osrelease=2.6.16. More complex applications do expose some bugs, however. Most of his work is in the tree (the default compatibility is still 2.4.2), and I want to get in most of the rest this week (needs more testing with some critical apps). So far several people showed interest in helping out.