Open vSwitch

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

The source repository is updated granularly with features and bug fixes.

Repository on GitHub, which uses git. git is distributed.

Open vSwitch uses the common x.y.z versioning format.

Open vSwitch tags each release with its version number. Tags are signed.

Non-trivial release notes file in repository: https://github.com/openvswitch/ovs/blob/master/NEWS.

A bug tracker is available at https://github.com/openvswitch/ovs-issues though most issues in practice are reported on the mailing lists.

A bug tracker is available at https://github.com/openvswitch/ovs-issues.

Most reported issues include some kind of followup on the mailing list.

Most enhancement requests include some kind of followup on the mailing lists.

https://github.com/openvswitch/ovs-issues https://mail.openvswitch.org/pipermail/ovs-discuss/

http://docs.openvswitch.org/en/latest/internals/security/

http://docs.openvswitch.org/en/latest/internals/security/ says that reporters may ask for a GPG key while initiating contact with the security team to deliver more sensitive reports.

http://docs.openvswitch.org/en/latest/internals/security/ says says, "As a basic default policy, we expect report date to disclosure date to be 10 to 15 business days."

Open vSwitch uses Autoconf and Automake with GNU make.

Autoconf, Automake, and GNU make are commonly used.

Autoconf, Automake, and GNU make are GNU GPL licensed.

Open vSwitch includes an extensive automated testsuite.

The Open vSwitch testsuite is invoked with "make check", which is common for Autoconf-based projects.

The Open vSwitch testsuite has good coverage, though it does not approach 100%.

Open vSwitch uses travis-ci.org to run continuous integration tests.

https://docs.openvswitch.org/en/latest/internals/contributing/submitting-patches/ talks about testing and suggests adding tests as part of contributions.

The current development branch has 27 more tests than the most recent release (2.7), which has 30 more tests than the release before it (2.6).

https://docs.openvswitch.org/en/latest/internals/contributing/submitting-patches/ talks about testing and suggests adding tests as part of contributions.

Open vSwitch uses GCC and Clang warning options aggressively.

Open vSwitch compiles warning free with its default set of warnings on common platforms.

Open vSwitch compiles warning free with its default set of warnings on common platforms. Many developers build with "-Werror" to ensure that warnings cause build failures.

My PhD work involved security.

My PhD work involved security.

Open vSwitch uses OpenSSL.

Open vSwitch uses OpenSSL.

Open vSwitch uses OpenSSL.

I believe that OpenSSL as implemented on common platforms meets these requirements.

I believe that OpenSSL as implemented on common platforms meets these requirements.

I believe that OpenSSL as implemented on common platforms meets these requirements.

Open vSwitch enables perfect forward security in OpenSSL.

Open vSwitch does not store passwords.

I believe that OpenSSL as implemented on common platforms meets these requirements.

Open vSwitch source code is most commonly delivered through HTTPS or Git-over-SSH. Open vSwitch does not publish binaries.

Open vSwitch does not use this mechanism.

I am not aware of any unpatched vulnerabilities of this type.

Open vSwitch has had one critical vulnerability, which we fixed quickly: https://mail.openvswitch.org/pipermail/ovs-announce/2016-March/000082.html

The Open vSwitch repository does not contain private credentials.

Developers regularly use "sparse". Open vSwitch also uses the "Clang" thread-safety analysis and Coverity Scan.

Coverity can report these.

We fix bugs as they are reported.

Many developers run "sparse" on every build.

Developers occasionally use "valgrind" on the testsuite, by running "make check-valgrind". Some developers use AddressSanitizer. We also use oss-fuzz.

Developers occasionally use "valgrind" on the testsuite, by running "make check-valgrind". Some developers use AddressSanitizer. We also use oss-fuzz.

Open vSwitch has useful assertions that are always tested.

We fix bugs as they are reported.