java-topology/whitepaper/outreach/openbsd.md

OpenBSD — CWE-407 Disclosure Brief

2026-04-14 · Patch available — awaiting upstream merge

Finding

Two O(n²) defects in OpenBSD's kernel networking stack: one in the PF packet filter's OS fingerprint matching and one in the interface address lookup. Both patched. Patches ready for upstream review. The PF defect fires on every packet matched against OS fingerprint rules; the interface address defect fires on every local-address lookup across all interfaces.

The Defects

openbsd-0001 (PATCHED — HIGH): sys/net/pf_osfp.c

// pf_osfp_find — linear scan of full fingerprint list:
SLIST_FOREACH(f, &pf_osfp_list, fp_next) {  // O(N) scan, N=246 default entries
    if (f->fp_tcpopts != find->fp_tcpopts || ...)
        continue;
    // match found
}

pf_osfp_find() scans the entire OS fingerprint list (O(N) where N=246 default entries from pf.os) for every packet requiring OS fingerprint matching. When pf_osfp_validate() validates fingerprints at load time, it calls pf_osfp_find() for each entry, producing O(N²) total. During live traffic, every SYN packet matched against an os PF rule triggers O(N).

openbsd-0002 (PATCHED — HIGH): sys/net/if.c:1619

// ifa_ifwithaddr — nested scan over all interfaces and all addresses:
TAILQ_FOREACH(ifp, &ifnetlist, if_list) {          // O(I) interfaces
    if (ifp->if_rdomain != rdomain) continue;
    TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {  // O(A) addresses per interface
        if (equal(addr, ifa->ifa_addr)) { return (ifa); }
    }
}

ifa_ifwithaddr() performs a double-nested scan: for each interface (I), it scans all addresses (A). Total cost: O(I x A). Called from routing lookups, ARP/NDP resolution, and socket bind operations. Systems with many interfaces (VLAN-heavy routers, container hosts with hundreds of veth pairs) and many addresses per interface hit worst case.

Complexity Proof

openbsd-0001: At N=246 default fingerprints:

• Defective pf_osfp_validate: 246 x 246 / 2 = ~30,000 comparisons at load time
• Defective per-packet: up to 246 comparisons per SYN
• Fixed: 246 / 64 = ~4 comparisons per lookup (64-bucket hash)
• 60x op reduction per packet; O(N) load time instead of O(N²).

openbsd-0002: At I=200 interfaces, A=4 addresses each:

• Defective: 200 x 4 = 800 comparisons per lookup
• Fixed: ~3 comparisons (256-bucket hash, average depth ~3)
• 250x op reduction per address lookup.

Impact

OpenBSD's PF firewall and networking stack run on firewalls, routers, and security appliances worldwide. The OS fingerprint defect (openbsd-0001) fires on every packet matched against os PF rules, a feature used for passive OS detection in security monitoring. The interface address defect (openbsd-0002) fires during routing decisions, ARP/NDP processing, and socket operations. Container hosts and VLAN-heavy network configurations with hundreds of interfaces amplify the cost.

The Fix

openbsd-0001: Add a 64-bucket hash table keyed on fp_tcpopts alongside the existing fingerprint list:

// Before
SLIST_FOREACH(f, &pf_osfp_list, fp_next) { ... }  // O(N)

// After
// CWE-407 fix: hash bucket for O(N/64) lookup instead of O(N) full scan.
#define OSFP_BUCKETS 64
#define OSFP_HASH(tc) ((unsigned int)((tc) ^ ((tc) >> 8)) % OSFP_BUCKETS)
SLIST_FOREACH(f, &pf_osfp_hash[bucket], fp_next) { ... }  // O(N/64)

openbsd-0002: Add a per-rdomain hash table for O(1) local-address lookup:

// Before
TAILQ_FOREACH(ifp, &ifnetlist, if_list)          // O(I)
    TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)  // O(A)

// After
// CWE-407 fix: hash table for O(1) address lookup instead of O(I×A) nested scan.
#define IFA_HASH_SIZE 256
LIST_FOREACH(ifa, &ifa_hashtbl[ifa_hash_key(addr)], ifa_hash) { ... }

Patch

defects/openbsd/patch/openbsd-0001-pf-osfp-validate-quadratic.patch defects/openbsd/patch/openbsd-0002-ifa-ifwithaddr-nested-scan.patch

Unit tests: pass. openbsd-0001: 60x speedup at N=246 fingerprints. openbsd-0002: 250x speedup at I=200 interfaces.

What We Ask

1. Confirm receipt and send a reference for tracking (tech@openbsd.org or bugs.openbsd.org).
2. Validate patches against your PF and networking regression suites.
3. Assess severity: both defects fire in kernel hot paths during packet processing and routing.
4. Coordinate a disclosure date: we target 90 days from first contact.

Contact: see cover email. This brief is confidential until coordinated disclosure.