Z k\u00f3dov\u00e9 z\u00e1kladny, na jej\u00edm\u017e z\u00e1klad\u011b byla vytvo\u0159ena verze FreeBSD 13, byl s velk\u00fdm skand\u00e1lem odstran\u011bn k\u00f3d pro implementaci protokolu VPN WireGuard, vyvinut\u00fd na objedn\u00e1vku spole\u010dnosti Netgate bez konzultac\u00ed s v\u00fdvoj\u00e1\u0159i p\u016fvodn\u00edho WireGuard, a ji\u017e zahrnut\u00fd ve stabiln\u00edch verz\u00edch distribuce pfSense. Po kontrole k\u00f3du Jasonem Donenfeldem, autorem p\u016fvodn\u00edho WireGuard, se uk\u00e1zalo, \u017ee navr\u017een\u00e1 implementace WireGuard pro FreeBSD p\u0159edstavovala p\u0159\u00edklad nekvalitn\u00edho k\u00f3du, kter\u00fd byl pln\u00fd p\u0159ete\u010den\u00ed buffer\u016f a poru\u0161oval licenci GPL. <\/p>\n
V realizaci byly nalezeny katastrof\u00e1ln\u00ed chyby v k\u00f3du kryptografie, byla opomenut\u00e1 \u010d\u00e1st protokolu WireGuard, vyskytovaly se chyby vedouc\u00ed k p\u00e1du j\u00e1dra a obch\u00e1zen\u00ed ochrann\u00fdch metod, pro vstupn\u00ed data byly pou\u017eity buffery pevn\u00e9 velikosti. O kvalit\u011b k\u00f3du mnoh\u00e9 napov\u00edd\u00e1 p\u0159\u00edtomnost z\u00e1stupn\u00fdch hodnot m\u00edsto kontrol, kter\u00e9 v\u017edy vracely hodnotu \u201etrue\u201c, a tak\u00e9 zapomenut\u00e9 ladic\u00ed printf s v\u00fdstupem parametr\u016f pou\u017e\u00edvan\u00fdch pro \u0161ifrov\u00e1n\u00ed, a pou\u017eit\u00ed funkce sleep pro prevenci z\u00e1vodn\u00edch podm\u00ednek. <\/p>\n
N\u011bkter\u00e9 \u010d\u00e1sti k\u00f3du, jako nap\u0159\u00edklad funkce crypto_xor, byly v rozporu s licenc\u00ed GPL p\u0159evedeny z implementace WireGuard vyvinut\u00e9 pro Linux. Nakonec se Jason Donenfeld spolu s Kylem Evansem a Mattem Dunwoodiem, autorem portu WireGuard pro OpenBSD, pustili do p\u0159epracov\u00e1n\u00ed problematick\u00e9 implementace a b\u011bhem jednoho t\u00fddne kompletn\u011b nahradili cel\u00fd k\u00f3d v\u00fdvoj\u00e1\u0159e najat\u00e9ho spole\u010dnost\u00ed Netgate. P\u0159epracovan\u00e1 varianta byla vydan\u00e1 jako samostatn\u00fd soubor patch\u016f, um\u00edst\u011bn\u00e1 v repozit\u00e1\u0159i projektu WireGuard a zat\u00edm nebyla zahrnuta do FreeBSD. <\/p>\n
Je zaj\u00edmav\u00e9, \u017ee zpo\u010d\u00e1tku nic nenasv\u011bd\u010dovalo probl\u00e9m\u016fm. Spole\u010dnost Netgate, kter\u00e1 cht\u011bla z\u00edskat mo\u017enost vyu\u017eit\u00ed WireGuard v distribuci pfSense, najala Matthew Macyho, kter\u00fd hluboce rozum\u011bl j\u00e1dru a s\u00ed\u0165ov\u00e9mu stacku FreeBSD, pod\u00edlel se na oprav\u00e1ch chyb a m\u011bl zku\u0161enosti s v\u00fdvojem s\u00ed\u0165ov\u00fdch ovlada\u010d\u016f pro tento opera\u010dn\u00ed syst\u00e9m. Macy m\u011bl voln\u00fd pl\u00e1n bez term\u00edn\u016f a mezilidsk\u00fdch kontrol. V\u00fdvoj\u00e1\u0159i, kte\u0159\u00ed se s Macyem setkali p\u0159i pr\u00e1ci na FreeBSD, ho charakterizovali jako talentovan\u00e9ho a profesion\u00e1ln\u00edho program\u00e1tora, kter\u00fd d\u011bl\u00e1 stejn\u011b m\u00e1lo chyb jako ostatn\u00ed a adekv\u00e1tn\u011b reaguje na kritiku. Tragick\u00e1 kvalita k\u00f3du implementace WireGuard pro FreeBSD byla pro n\u011b p\u0159ekvapen\u00edm. <\/p>\n
Po dev\u00edti m\u011bs\u00edc\u00edch pr\u00e1ce v prosinci lo\u0148sk\u00e9ho roku Macy bez dokon\u010den\u00ed reviz\u00ed a testov\u00e1n\u00ed ze strany extern\u00edch \u00fa\u010dastn\u00edk\u016f p\u0159idal svou implementaci do v\u011btve HEAD, kter\u00e1 byla pou\u017eita k sestaven\u00ed vyd\u00e1n\u00ed FreeBSD 13. V\u00fdvoj prob\u00edhal bez kontaktu s v\u00fdvoj\u00e1\u0159i p\u016fvodn\u00edho WireGuard a port\u016f pro OpenBSD a NetBSD. V \u00fanoru spole\u010dnost Netgate integrovala WireGuard do stabiln\u00ed verze pfSense 2.5.0 a za\u010dala ho dod\u00e1vat do firewall\u016f na jeho z\u00e1klad\u011b. Po odhalen\u00ed probl\u00e9m\u016f byl k\u00f3d WireGuard odstran\u011bn z pfSense. <\/p>\n
V p\u0159idan\u00e9m k\u00f3du byly odhaleny kritick\u00e9 zranitelnosti, kter\u00e9 byly vyu\u017eity v 0-day exploitac\u00edch, av\u0161ak Netgate zpo\u010d\u00e1tku neuzn\u00e1vala existenci t\u011bchto zranitelnost\u00ed a sna\u017eila se obvinit v\u00fdvoj\u00e1\u0159e p\u016fvodn\u00edho WireGuard z \u00fatok\u016f a zaujatosti, co\u017e negativn\u011b ovlivnilo jej\u00ed pov\u011bst. V\u00fdvoj\u00e1\u0159 portu zpo\u010d\u00e1tku odm\u00edtal tvrzen\u00ed o kvalit\u011b k\u00f3du a pova\u017eoval je za p\u0159ehnan\u00e9, ale po demonstraci chyb si uv\u011bdomil, \u017ee skute\u010dn\u011b z\u00e1sadn\u00edm probl\u00e9mem je nedostate\u010dn\u00e9 posouzen\u00ed kvality k\u00f3du ve FreeBSD, nebo\u0165 probl\u00e9my z\u016fst\u00e1valy po mnoho m\u011bs\u00edc\u016f bez pov\u0161imnut\u00ed (z\u00e1stupci Netgate uvedli, \u017ee ve\u0159ejn\u00e9 posuzov\u00e1n\u00ed bylo spu\u0161t\u011bno ji\u017e v srpnu 2020, ale jednotliv\u00ed v\u00fdvoj\u00e1\u0159i FreeBSD poznamenali, \u017ee revize v Phabricatoru byla Macyem uzav\u0159ena bez proveden\u00ed a s ignorov\u00e1n\u00edm koment\u00e1\u0159\u016f). T\u00fdm FreeBSD Core Team reagoval na incident slibem modernizovat procesy kontroly k\u00f3du. <\/p>\n
Matthew Macy, the developer of the problematic port for FreeBSD, commented on the situation by admitting that he made a significant mistake by taking on the work without being ready to implement the project. He attributes the resulting outcome to emotional burnout and issues arising from post-COVID syndrome. At the same time, Macy did not find the resolve to withdraw from the commitments he had already taken on and tried to see the project through to the end. <\/p>\n