sub $500-750 CPE firewall for voip-centric application

Fri May 6 16:24:10 UTC 2016

amuse wrote:
> +1 to a "Can you substantiate that claim please?" sentiment here.  I've
> used it for years and found it to be reliable, flexible, feature-filled.
> And having the BSD CLI fully available has been a godsend.

The code quality is terrible in a 1990s sort of way.  I.e. no separation
of code, html, logic, data structure or anything else.  Everything is
jumbled in together using coding methodologies which don't scale and
which make it almost impossible to audit in a meaningful way.

Specific problems:

1. the installation image ships with static dh params files, e.g.

> https://github.com/pfsense/pfsense/blob/master/src/etc/dh-parameters.1024

This is a really bad idea and someone should issue a CVE for it.  The
reasons are clearly explained at:

> https://weakdh.org/

> https://www.schneier.com/blog/archives/2015/05/the_logjam_and_.html

2. http params validation: a cursory glance at the output of "grep -r
_GET pfsense/src" show that the authors did not use any http parameters
validation.  In addition, the output of $_GET is used unsafely in
multiple locations.

3. the output of "grep -wr exec pfsense/src | grep 'rm -rf'" shows what
looks like exploitable problems due to poor shell escaping.

This isn't an audit or anything, btw.  It's the result of a couple of
minutes glancing over the code.  I'm sure an audit would produce a lot more.

Nick