* [edk2-devel] [PATCH] NetworkPkg Update Security Patch
@ 2024-02-03 10:11 Santhosh Kumar V via groups.io
2024-02-07 22:57 ` Saloni Kasbekar
2024-02-08 1:59 ` Michael D Kinney
0 siblings, 2 replies; 5+ messages in thread
From: Santhosh Kumar V via groups.io @ 2024-02-03 10:11 UTC (permalink / raw)
To: devel@edk2.groups.io, Santhosh Kumar V
Cc: Sivaraman Nainar, Raj V Akilan, michael.d.kinney@intel.com,
saloni.kasbekar@intel.com, john.mathews@intel.com,
Zachary Clark-williams
Update Security patch for Bug 4541 (Predictable TCP ISNs)
Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
Signed-off-by: SanthoshKumar <santhoshkumarv@ami.com>
---
NetworkPkg/Library/DxeNetLib/DxeNetLib.c | 21 ++++++++++++++-------
NetworkPkg/Library/DxeNetLib/DxeNetLib.inf | 2 +-
NetworkPkg/TcpDxe/TcpDxe.inf | 1 +
NetworkPkg/TcpDxe/TcpMain.h | 1 +
NetworkPkg/TcpDxe/TcpMisc.c | 7 ++++++-
NetworkPkg/TcpDxe/TcpTimer.c | 8 +++++---
6 files changed, 28 insertions(+), 12 deletions(-)
diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
index fd4a9e15a8..d3cc8a59d4 100644
--- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
+++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
@@ -31,6 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include <Library/DevicePathLib.h>
#include <Library/PrintLib.h>
#include <Library/UefiLib.h>
+#include <Library/RngLib.h>
#define NIC_ITEM_CONFIG_SIZE (sizeof (NIC_IP4_CONFIG_INFO) + sizeof (EFI_IP4_ROUTE_TABLE) * MAX_IP4_CONFIG_IN_VARIABLE)
#define DEFAULT_ZERO_START ((UINTN) ~0)
@@ -902,14 +903,20 @@ NetRandomInitSeed (
EFI_TIME Time;
UINT32 Seed;
UINT64 MonotonicCount;
+ UINT32 RandomVal;
+
+ if ( TRUE == GetRandomNumber32(&RandomVal))
+ Seed = RandomVal;
+ else
+ {
+ gRT->GetTime (&Time, NULL);
+ Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 | Time.Second);
+ Seed ^= Time.Nanosecond;
+ Seed ^= Time.Year << 7;
- gRT->GetTime (&Time, NULL);
- Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 | Time.Second);
- Seed ^= Time.Nanosecond;
- Seed ^= Time.Year << 7;
-
- gBS->GetNextMonotonicCount (&MonotonicCount);
- Seed += (UINT32)MonotonicCount;
+ gBS->GetNextMonotonicCount (&MonotonicCount);
+ Seed += (UINT32)MonotonicCount;
+ }
return Seed;
}
diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
index 8145d256ec..2c800b7c00 100644
--- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
+++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
@@ -43,7 +43,7 @@
MemoryAllocationLib
DevicePathLib
PrintLib
-
+ RngLib
[Guids]
gEfiSmbiosTableGuid ## SOMETIMES_CONSUMES ## SystemTable
diff --git a/NetworkPkg/TcpDxe/TcpDxe.inf b/NetworkPkg/TcpDxe/TcpDxe.inf
index c0acbdca57..99c093600f 100644
--- a/NetworkPkg/TcpDxe/TcpDxe.inf
+++ b/NetworkPkg/TcpDxe/TcpDxe.inf
@@ -67,6 +67,7 @@
DpcLib
NetLib
IpIoLib
+ RngLib
[Protocols]
diff --git a/NetworkPkg/TcpDxe/TcpMain.h b/NetworkPkg/TcpDxe/TcpMain.h
index c0c9b7f46e..f94598b6ba 100644
--- a/NetworkPkg/TcpDxe/TcpMain.h
+++ b/NetworkPkg/TcpDxe/TcpMain.h
@@ -16,6 +16,7 @@
#include <Library/IpIoLib.h>
#include <Library/DevicePathLib.h>
#include <Library/PrintLib.h>
+#include <Library/RngLib.h>
#include "Socket.h"
#include "TcpProto.h"
diff --git a/NetworkPkg/TcpDxe/TcpMisc.c b/NetworkPkg/TcpDxe/TcpMisc.c
index c93212d47d..4d33dd6ad6 100644
--- a/NetworkPkg/TcpDxe/TcpMisc.c
+++ b/NetworkPkg/TcpDxe/TcpMisc.c
@@ -516,7 +516,12 @@ TcpGetIss (
VOID
)
{
- mTcpGlobalIss += TCP_ISS_INCREMENT_1;
+ UINT32 RandomVal;
+ if ( TRUE == GetRandomNumber32(&RandomVal))
+ mTcpGlobalIss += RandomVal;
+ else
+ mTcpGlobalIss += TCP_ISS_INCREMENT_1;
+
return mTcpGlobalIss;
}
diff --git a/NetworkPkg/TcpDxe/TcpTimer.c b/NetworkPkg/TcpDxe/TcpTimer.c
index 5d2e124977..3370e6b264 100644
--- a/NetworkPkg/TcpDxe/TcpTimer.c
+++ b/NetworkPkg/TcpDxe/TcpTimer.c
@@ -481,10 +481,12 @@ TcpTickingDpc (
LIST_ENTRY *Next;
TCP_CB *Tcb;
INT16 Index;
-
+ UINT32 RandomVal;
mTcpTick++;
- mTcpGlobalIss += TCP_ISS_INCREMENT_2;
-
+ if ( TRUE == GetRandomNumber32(&RandomVal))
+ mTcpGlobalIss += RandomVal
+ else
+ mTcpGlobalIss += TCP_ISS_INCREMENT_2;
//
// Don't use LIST_FOR_EACH, which isn't delete safe.
//
--
2.42.0.windows.2
-The information contained in this message may be confidential and proprietary to American Megatrends (AMI). This communication is intended to be read only by the individual or entity to whom it is addressed or by their designee. If the reader of this message is not the intended recipient, you are on notice that any distribution of this message, in any form, is strictly prohibited. Please promptly notify the sender by reply e-mail or by telephone at 770-246-8600, and then delete or destroy all copies of the transmission.
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#115092): https://edk2.groups.io/g/devel/message/115092
Mute This Topic: https://groups.io/mt/104167647/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [edk2-devel] [PATCH] NetworkPkg Update Security Patch
2024-02-03 10:11 [edk2-devel] [PATCH] NetworkPkg Update Security Patch Santhosh Kumar V via groups.io
@ 2024-02-07 22:57 ` Saloni Kasbekar
2024-03-08 21:11 ` Michael D Kinney
2024-02-08 1:59 ` Michael D Kinney
1 sibling, 1 reply; 5+ messages in thread
From: Saloni Kasbekar @ 2024-02-07 22:57 UTC (permalink / raw)
To: Santhosh Kumar V, devel@edk2.groups.io
Cc: Sivaraman Nainar, Raj V Akilan, Kinney, Michael D, Mathews, John,
Clark-williams, Zachary
Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
-----Original Message-----
From: Santhosh Kumar V <santhoshkumarv@ami.com>
Sent: Saturday, February 3, 2024 2:11 AM
To: devel@edk2.groups.io; Santhosh Kumar V <santhoshkumarv@ami.com>
Cc: Sivaraman Nainar <sivaramann@ami.com>; Raj V Akilan <rajva@ami.com>; Kinney, Michael D <michael.d.kinney@intel.com>; Kasbekar, Saloni <saloni.kasbekar@intel.com>; Mathews, John <john.mathews@intel.com>; Clark-williams, Zachary <zachary.clark-williams@intel.com>
Subject: [PATCH] NetworkPkg Update Security Patch
Update Security patch for Bug 4541 (Predictable TCP ISNs)
Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
Signed-off-by: SanthoshKumar <santhoshkumarv@ami.com>
---
NetworkPkg/Library/DxeNetLib/DxeNetLib.c | 21 ++++++++++++++-------
NetworkPkg/Library/DxeNetLib/DxeNetLib.inf | 2 +-
NetworkPkg/TcpDxe/TcpDxe.inf | 1 +
NetworkPkg/TcpDxe/TcpMain.h | 1 +
NetworkPkg/TcpDxe/TcpMisc.c | 7 ++++++-
NetworkPkg/TcpDxe/TcpTimer.c | 8 +++++---
6 files changed, 28 insertions(+), 12 deletions(-)
diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
index fd4a9e15a8..d3cc8a59d4 100644
--- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
+++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
@@ -31,6 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include <Library/DevicePathLib.h>
#include <Library/PrintLib.h>
#include <Library/UefiLib.h>
+#include <Library/RngLib.h>
#define NIC_ITEM_CONFIG_SIZE (sizeof (NIC_IP4_CONFIG_INFO) + sizeof (EFI_IP4_ROUTE_TABLE) * MAX_IP4_CONFIG_IN_VARIABLE)
#define DEFAULT_ZERO_START ((UINTN) ~0)
@@ -902,14 +903,20 @@ NetRandomInitSeed (
EFI_TIME Time;
UINT32 Seed;
UINT64 MonotonicCount;
+ UINT32 RandomVal;
+
+ if ( TRUE == GetRandomNumber32(&RandomVal))
+ Seed = RandomVal;
+ else
+ {
+ gRT->GetTime (&Time, NULL);
+ Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 |
+ Time.Second);
+ Seed ^= Time.Nanosecond;
+ Seed ^= Time.Year << 7;
- gRT->GetTime (&Time, NULL);
- Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 | Time.Second);
- Seed ^= Time.Nanosecond;
- Seed ^= Time.Year << 7;
-
- gBS->GetNextMonotonicCount (&MonotonicCount);
- Seed += (UINT32)MonotonicCount;
+ gBS->GetNextMonotonicCount (&MonotonicCount);
+ Seed += (UINT32)MonotonicCount;
+ }
return Seed;
}
diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
index 8145d256ec..2c800b7c00 100644
--- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
+++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
@@ -43,7 +43,7 @@
MemoryAllocationLib
DevicePathLib
PrintLib
-
+ RngLib
[Guids]
gEfiSmbiosTableGuid ## SOMETIMES_CONSUMES ## SystemTable
diff --git a/NetworkPkg/TcpDxe/TcpDxe.inf b/NetworkPkg/TcpDxe/TcpDxe.inf index c0acbdca57..99c093600f 100644
--- a/NetworkPkg/TcpDxe/TcpDxe.inf
+++ b/NetworkPkg/TcpDxe/TcpDxe.inf
@@ -67,6 +67,7 @@
DpcLib
NetLib
IpIoLib
+ RngLib
[Protocols]
diff --git a/NetworkPkg/TcpDxe/TcpMain.h b/NetworkPkg/TcpDxe/TcpMain.h index c0c9b7f46e..f94598b6ba 100644
--- a/NetworkPkg/TcpDxe/TcpMain.h
+++ b/NetworkPkg/TcpDxe/TcpMain.h
@@ -16,6 +16,7 @@
#include <Library/IpIoLib.h>
#include <Library/DevicePathLib.h>
#include <Library/PrintLib.h>
+#include <Library/RngLib.h>
#include "Socket.h"
#include "TcpProto.h"
diff --git a/NetworkPkg/TcpDxe/TcpMisc.c b/NetworkPkg/TcpDxe/TcpMisc.c index c93212d47d..4d33dd6ad6 100644
--- a/NetworkPkg/TcpDxe/TcpMisc.c
+++ b/NetworkPkg/TcpDxe/TcpMisc.c
@@ -516,7 +516,12 @@ TcpGetIss (
VOID
)
{
- mTcpGlobalIss += TCP_ISS_INCREMENT_1;
+ UINT32 RandomVal;
+ if ( TRUE == GetRandomNumber32(&RandomVal))
+ mTcpGlobalIss += RandomVal;
+ else
+ mTcpGlobalIss += TCP_ISS_INCREMENT_1;
+
return mTcpGlobalIss;
}
diff --git a/NetworkPkg/TcpDxe/TcpTimer.c b/NetworkPkg/TcpDxe/TcpTimer.c index 5d2e124977..3370e6b264 100644
--- a/NetworkPkg/TcpDxe/TcpTimer.c
+++ b/NetworkPkg/TcpDxe/TcpTimer.c
@@ -481,10 +481,12 @@ TcpTickingDpc (
LIST_ENTRY *Next;
TCP_CB *Tcb;
INT16 Index;
-
+ UINT32 RandomVal;
mTcpTick++;
- mTcpGlobalIss += TCP_ISS_INCREMENT_2;
-
+ if ( TRUE == GetRandomNumber32(&RandomVal))
+ mTcpGlobalIss += RandomVal
+ else
+ mTcpGlobalIss += TCP_ISS_INCREMENT_2;
//
// Don't use LIST_FOR_EACH, which isn't delete safe.
//
--
2.42.0.windows.2
-The information contained in this message may be confidential and proprietary to American Megatrends (AMI). This communication is intended to be read only by the individual or entity to whom it is addressed or by their designee. If the reader of this message is not the intended recipient, you are on notice that any distribution of this message, in any form, is strictly prohibited. Please promptly notify the sender by reply e-mail or by telephone at 770-246-8600, and then delete or destroy all copies of the transmission.
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#115259): https://edk2.groups.io/g/devel/message/115259
Mute This Topic: https://groups.io/mt/104167647/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [edk2-devel] [PATCH] NetworkPkg Update Security Patch
2024-02-03 10:11 [edk2-devel] [PATCH] NetworkPkg Update Security Patch Santhosh Kumar V via groups.io
2024-02-07 22:57 ` Saloni Kasbekar
@ 2024-02-08 1:59 ` Michael D Kinney
1 sibling, 0 replies; 5+ messages in thread
From: Michael D Kinney @ 2024-02-08 1:59 UTC (permalink / raw)
To: Santhosh Kumar V, devel@edk2.groups.io
Cc: Sivaraman Nainar, Raj V Akilan, Kasbekar, Saloni, Mathews, John,
Clark-williams, Zachary, Kinney, Michael D
Hi Kumar,
Can you provide a link to a branch with this change.
I am having issues apply the patch.
Thanks,
Mike
> -----Original Message-----
> From: Santhosh Kumar V <santhoshkumarv@ami.com>
> Sent: Saturday, February 3, 2024 2:11 AM
> To: devel@edk2.groups.io; Santhosh Kumar V <santhoshkumarv@ami.com>
> Cc: Sivaraman Nainar <sivaramann@ami.com>; Raj V Akilan
> <rajva@ami.com>; Kinney, Michael D <michael.d.kinney@intel.com>;
> Kasbekar, Saloni <saloni.kasbekar@intel.com>; Mathews, John
> <john.mathews@intel.com>; Clark-williams, Zachary <zachary.clark-
> williams@intel.com>
> Subject: [PATCH] NetworkPkg Update Security Patch
>
> Update Security patch for Bug 4541 (Predictable TCP ISNs)
>
> Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
>
> Signed-off-by: SanthoshKumar <santhoshkumarv@ami.com>
> ---
> NetworkPkg/Library/DxeNetLib/DxeNetLib.c | 21 ++++++++++++++-------
> NetworkPkg/Library/DxeNetLib/DxeNetLib.inf | 2 +-
> NetworkPkg/TcpDxe/TcpDxe.inf | 1 +
> NetworkPkg/TcpDxe/TcpMain.h | 1 +
> NetworkPkg/TcpDxe/TcpMisc.c | 7 ++++++-
> NetworkPkg/TcpDxe/TcpTimer.c | 8 +++++---
> 6 files changed, 28 insertions(+), 12 deletions(-)
>
> diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> index fd4a9e15a8..d3cc8a59d4 100644
> --- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> +++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> @@ -31,6 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> #include <Library/DevicePathLib.h>
>
> #include <Library/PrintLib.h>
>
> #include <Library/UefiLib.h>
>
> +#include <Library/RngLib.h>
>
>
>
> #define NIC_ITEM_CONFIG_SIZE (sizeof (NIC_IP4_CONFIG_INFO) + sizeof
> (EFI_IP4_ROUTE_TABLE) * MAX_IP4_CONFIG_IN_VARIABLE)
>
> #define DEFAULT_ZERO_START ((UINTN) ~0)
>
> @@ -902,14 +903,20 @@ NetRandomInitSeed (
> EFI_TIME Time;
>
> UINT32 Seed;
>
> UINT64 MonotonicCount;
>
> + UINT32 RandomVal;
>
> +
>
> + if ( TRUE == GetRandomNumber32(&RandomVal))
>
> + Seed = RandomVal;
>
> + else
>
> + {
>
> + gRT->GetTime (&Time, NULL);
>
> + Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 |
> Time.Second);
>
> + Seed ^= Time.Nanosecond;
>
> + Seed ^= Time.Year << 7;
>
>
>
> - gRT->GetTime (&Time, NULL);
>
> - Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 |
> Time.Second);
>
> - Seed ^= Time.Nanosecond;
>
> - Seed ^= Time.Year << 7;
>
> -
>
> - gBS->GetNextMonotonicCount (&MonotonicCount);
>
> - Seed += (UINT32)MonotonicCount;
>
> + gBS->GetNextMonotonicCount (&MonotonicCount);
>
> + Seed += (UINT32)MonotonicCount;
>
> + }
>
>
>
> return Seed;
>
> }
>
> diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> index 8145d256ec..2c800b7c00 100644
> --- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> +++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> @@ -43,7 +43,7 @@
> MemoryAllocationLib
>
> DevicePathLib
>
> PrintLib
>
> -
>
> + RngLib
>
>
>
> [Guids]
>
> gEfiSmbiosTableGuid ## SOMETIMES_CONSUMES
> ## SystemTable
>
> diff --git a/NetworkPkg/TcpDxe/TcpDxe.inf
> b/NetworkPkg/TcpDxe/TcpDxe.inf
> index c0acbdca57..99c093600f 100644
> --- a/NetworkPkg/TcpDxe/TcpDxe.inf
> +++ b/NetworkPkg/TcpDxe/TcpDxe.inf
> @@ -67,6 +67,7 @@
> DpcLib
>
> NetLib
>
> IpIoLib
>
> + RngLib
>
>
>
>
>
> [Protocols]
>
> diff --git a/NetworkPkg/TcpDxe/TcpMain.h b/NetworkPkg/TcpDxe/TcpMain.h
> index c0c9b7f46e..f94598b6ba 100644
> --- a/NetworkPkg/TcpDxe/TcpMain.h
> +++ b/NetworkPkg/TcpDxe/TcpMain.h
> @@ -16,6 +16,7 @@
> #include <Library/IpIoLib.h>
>
> #include <Library/DevicePathLib.h>
>
> #include <Library/PrintLib.h>
>
> +#include <Library/RngLib.h>
>
>
>
> #include "Socket.h"
>
> #include "TcpProto.h"
>
> diff --git a/NetworkPkg/TcpDxe/TcpMisc.c b/NetworkPkg/TcpDxe/TcpMisc.c
> index c93212d47d..4d33dd6ad6 100644
> --- a/NetworkPkg/TcpDxe/TcpMisc.c
> +++ b/NetworkPkg/TcpDxe/TcpMisc.c
> @@ -516,7 +516,12 @@ TcpGetIss (
> VOID
>
> )
>
> {
>
> - mTcpGlobalIss += TCP_ISS_INCREMENT_1;
>
> + UINT32 RandomVal;
>
> + if ( TRUE == GetRandomNumber32(&RandomVal))
>
> + mTcpGlobalIss += RandomVal;
>
> + else
>
> + mTcpGlobalIss += TCP_ISS_INCREMENT_1;
>
> +
>
> return mTcpGlobalIss;
>
> }
>
>
>
> diff --git a/NetworkPkg/TcpDxe/TcpTimer.c
> b/NetworkPkg/TcpDxe/TcpTimer.c
> index 5d2e124977..3370e6b264 100644
> --- a/NetworkPkg/TcpDxe/TcpTimer.c
> +++ b/NetworkPkg/TcpDxe/TcpTimer.c
> @@ -481,10 +481,12 @@ TcpTickingDpc (
> LIST_ENTRY *Next;
>
> TCP_CB *Tcb;
>
> INT16 Index;
>
> -
>
> + UINT32 RandomVal;
>
> mTcpTick++;
>
> - mTcpGlobalIss += TCP_ISS_INCREMENT_2;
>
> -
>
> + if ( TRUE == GetRandomNumber32(&RandomVal))
>
> + mTcpGlobalIss += RandomVal
>
> + else
>
> + mTcpGlobalIss += TCP_ISS_INCREMENT_2;
>
> //
>
> // Don't use LIST_FOR_EACH, which isn't delete safe.
>
> //
>
> --
> 2.42.0.windows.2
> -The information contained in this message may be confidential and
> proprietary to American Megatrends (AMI). This communication is
> intended to be read only by the individual or entity to whom it is
> addressed or by their designee. If the reader of this message is not
> the intended recipient, you are on notice that any distribution of this
> message, in any form, is strictly prohibited. Please promptly notify
> the sender by reply e-mail or by telephone at 770-246-8600, and then
> delete or destroy all copies of the transmission.
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#115260): https://edk2.groups.io/g/devel/message/115260
Mute This Topic: https://groups.io/mt/104167647/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [edk2-devel] [PATCH] NetworkPkg Update Security Patch
2024-02-07 22:57 ` Saloni Kasbekar
@ 2024-03-08 21:11 ` Michael D Kinney
2024-03-08 21:26 ` Michael D Kinney
0 siblings, 1 reply; 5+ messages in thread
From: Michael D Kinney @ 2024-03-08 21:11 UTC (permalink / raw)
To: Kasbekar, Saloni, Santhosh Kumar V, devel@edk2.groups.io
Cc: Sivaraman Nainar, Raj V Akilan, Mathews, John,
Clark-williams, Zachary, Kinney, Michael D
Acked-by: Michael D Kinney <michael.d.kinney@intel.com>
> -----Original Message-----
> From: Kasbekar, Saloni <saloni.kasbekar@intel.com>
> Sent: Wednesday, February 7, 2024 2:58 PM
> To: Santhosh Kumar V <santhoshkumarv@ami.com>; devel@edk2.groups.io
> Cc: Sivaraman Nainar <sivaramann@ami.com>; Raj V Akilan
> <rajva@ami.com>; Kinney, Michael D <michael.d.kinney@intel.com>;
> Mathews, John <john.mathews@intel.com>; Clark-williams, Zachary
> <zachary.clark-williams@intel.com>
> Subject: RE: [PATCH] NetworkPkg Update Security Patch
>
> Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
>
> -----Original Message-----
> From: Santhosh Kumar V <santhoshkumarv@ami.com>
> Sent: Saturday, February 3, 2024 2:11 AM
> To: devel@edk2.groups.io; Santhosh Kumar V <santhoshkumarv@ami.com>
> Cc: Sivaraman Nainar <sivaramann@ami.com>; Raj V Akilan
> <rajva@ami.com>; Kinney, Michael D <michael.d.kinney@intel.com>;
> Kasbekar, Saloni <saloni.kasbekar@intel.com>; Mathews, John
> <john.mathews@intel.com>; Clark-williams, Zachary <zachary.clark-
> williams@intel.com>
> Subject: [PATCH] NetworkPkg Update Security Patch
>
> Update Security patch for Bug 4541 (Predictable TCP ISNs)
>
> Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
> Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
>
> Signed-off-by: SanthoshKumar <santhoshkumarv@ami.com>
> ---
> NetworkPkg/Library/DxeNetLib/DxeNetLib.c | 21 ++++++++++++++-------
> NetworkPkg/Library/DxeNetLib/DxeNetLib.inf | 2 +-
> NetworkPkg/TcpDxe/TcpDxe.inf | 1 +
> NetworkPkg/TcpDxe/TcpMain.h | 1 +
> NetworkPkg/TcpDxe/TcpMisc.c | 7 ++++++-
> NetworkPkg/TcpDxe/TcpTimer.c | 8 +++++---
> 6 files changed, 28 insertions(+), 12 deletions(-)
>
> diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> index fd4a9e15a8..d3cc8a59d4 100644
> --- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> +++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> @@ -31,6 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> #include <Library/DevicePathLib.h>
>
> #include <Library/PrintLib.h>
>
> #include <Library/UefiLib.h>
>
> +#include <Library/RngLib.h>
>
>
>
> #define NIC_ITEM_CONFIG_SIZE (sizeof (NIC_IP4_CONFIG_INFO) + sizeof
> (EFI_IP4_ROUTE_TABLE) * MAX_IP4_CONFIG_IN_VARIABLE)
>
> #define DEFAULT_ZERO_START ((UINTN) ~0)
>
> @@ -902,14 +903,20 @@ NetRandomInitSeed (
> EFI_TIME Time;
>
> UINT32 Seed;
>
> UINT64 MonotonicCount;
>
> + UINT32 RandomVal;
>
> +
>
> + if ( TRUE == GetRandomNumber32(&RandomVal))
>
> + Seed = RandomVal;
>
> + else
>
> + {
>
> + gRT->GetTime (&Time, NULL);
>
> + Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 |
> + Time.Second);
>
> + Seed ^= Time.Nanosecond;
>
> + Seed ^= Time.Year << 7;
>
>
>
> - gRT->GetTime (&Time, NULL);
>
> - Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 |
> Time.Second);
>
> - Seed ^= Time.Nanosecond;
>
> - Seed ^= Time.Year << 7;
>
> -
>
> - gBS->GetNextMonotonicCount (&MonotonicCount);
>
> - Seed += (UINT32)MonotonicCount;
>
> + gBS->GetNextMonotonicCount (&MonotonicCount);
>
> + Seed += (UINT32)MonotonicCount;
>
> + }
>
>
>
> return Seed;
>
> }
>
> diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> index 8145d256ec..2c800b7c00 100644
> --- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> +++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> @@ -43,7 +43,7 @@
> MemoryAllocationLib
>
> DevicePathLib
>
> PrintLib
>
> -
>
> + RngLib
>
>
>
> [Guids]
>
> gEfiSmbiosTableGuid ## SOMETIMES_CONSUMES
> ## SystemTable
>
> diff --git a/NetworkPkg/TcpDxe/TcpDxe.inf
> b/NetworkPkg/TcpDxe/TcpDxe.inf index c0acbdca57..99c093600f 100644
> --- a/NetworkPkg/TcpDxe/TcpDxe.inf
> +++ b/NetworkPkg/TcpDxe/TcpDxe.inf
> @@ -67,6 +67,7 @@
> DpcLib
>
> NetLib
>
> IpIoLib
>
> + RngLib
>
>
>
>
>
> [Protocols]
>
> diff --git a/NetworkPkg/TcpDxe/TcpMain.h b/NetworkPkg/TcpDxe/TcpMain.h
> index c0c9b7f46e..f94598b6ba 100644
> --- a/NetworkPkg/TcpDxe/TcpMain.h
> +++ b/NetworkPkg/TcpDxe/TcpMain.h
> @@ -16,6 +16,7 @@
> #include <Library/IpIoLib.h>
>
> #include <Library/DevicePathLib.h>
>
> #include <Library/PrintLib.h>
>
> +#include <Library/RngLib.h>
>
>
>
> #include "Socket.h"
>
> #include "TcpProto.h"
>
> diff --git a/NetworkPkg/TcpDxe/TcpMisc.c b/NetworkPkg/TcpDxe/TcpMisc.c
> index c93212d47d..4d33dd6ad6 100644
> --- a/NetworkPkg/TcpDxe/TcpMisc.c
> +++ b/NetworkPkg/TcpDxe/TcpMisc.c
> @@ -516,7 +516,12 @@ TcpGetIss (
> VOID
>
> )
>
> {
>
> - mTcpGlobalIss += TCP_ISS_INCREMENT_1;
>
> + UINT32 RandomVal;
>
> + if ( TRUE == GetRandomNumber32(&RandomVal))
>
> + mTcpGlobalIss += RandomVal;
>
> + else
>
> + mTcpGlobalIss += TCP_ISS_INCREMENT_1;
>
> +
>
> return mTcpGlobalIss;
>
> }
>
>
>
> diff --git a/NetworkPkg/TcpDxe/TcpTimer.c
> b/NetworkPkg/TcpDxe/TcpTimer.c index 5d2e124977..3370e6b264 100644
> --- a/NetworkPkg/TcpDxe/TcpTimer.c
> +++ b/NetworkPkg/TcpDxe/TcpTimer.c
> @@ -481,10 +481,12 @@ TcpTickingDpc (
> LIST_ENTRY *Next;
>
> TCP_CB *Tcb;
>
> INT16 Index;
>
> -
>
> + UINT32 RandomVal;
>
> mTcpTick++;
>
> - mTcpGlobalIss += TCP_ISS_INCREMENT_2;
>
> -
>
> + if ( TRUE == GetRandomNumber32(&RandomVal))
>
> + mTcpGlobalIss += RandomVal
>
> + else
>
> + mTcpGlobalIss += TCP_ISS_INCREMENT_2;
>
> //
>
> // Don't use LIST_FOR_EACH, which isn't delete safe.
>
> //
>
> --
> 2.42.0.windows.2
> -The information contained in this message may be confidential and
> proprietary to American Megatrends (AMI). This communication is
> intended to be read only by the individual or entity to whom it is
> addressed or by their designee. If the reader of this message is not
> the intended recipient, you are on notice that any distribution of this
> message, in any form, is strictly prohibited. Please promptly notify
> the sender by reply e-mail or by telephone at 770-246-8600, and then
> delete or destroy all copies of the transmission.
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#116552): https://edk2.groups.io/g/devel/message/116552
Mute This Topic: https://groups.io/mt/104167647/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [edk2-devel] [PATCH] NetworkPkg Update Security Patch
2024-03-08 21:11 ` Michael D Kinney
@ 2024-03-08 21:26 ` Michael D Kinney
0 siblings, 0 replies; 5+ messages in thread
From: Michael D Kinney @ 2024-03-08 21:26 UTC (permalink / raw)
To: devel@edk2.groups.io, Kinney, Michael D, Kasbekar, Saloni,
Santhosh Kumar V
Cc: Sivaraman Nainar, Raj V Akilan, Mathews, John,
Clark-williams, Zachary, Kinney, Michael D
From this CI run, you can see there are other packages impacted by
this change. Missing RngLib mappings. Is this expected?
https://dev.azure.com/tianocore/edk2-ci/_build/results?buildId=120372&view=logs&jobId=56079008-74ef-5d1a-7db6-78cd637f5fd1&j=56079008-74ef-5d1a-7db6-78cd637f5fd1&t=717a0b6b-5e6c-5b81-aea3-d574ed7b6a91
Please update patches to address all these failures and resend to mailing list.
Thanks,
Mike
> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Michael
> D Kinney
> Sent: Friday, March 8, 2024 1:12 PM
> To: Kasbekar, Saloni <saloni.kasbekar@intel.com>; Santhosh Kumar V
> <santhoshkumarv@ami.com>; devel@edk2.groups.io
> Cc: Sivaraman Nainar <sivaramann@ami.com>; Raj V Akilan
> <rajva@ami.com>; Mathews, John <john.mathews@intel.com>; Clark-
> williams, Zachary <zachary.clark-williams@intel.com>; Kinney, Michael D
> <michael.d.kinney@intel.com>
> Subject: Re: [edk2-devel] [PATCH] NetworkPkg Update Security Patch
>
> Acked-by: Michael D Kinney <michael.d.kinney@intel.com>
>
> > -----Original Message-----
> > From: Kasbekar, Saloni <saloni.kasbekar@intel.com>
> > Sent: Wednesday, February 7, 2024 2:58 PM
> > To: Santhosh Kumar V <santhoshkumarv@ami.com>; devel@edk2.groups.io
> > Cc: Sivaraman Nainar <sivaramann@ami.com>; Raj V Akilan
> > <rajva@ami.com>; Kinney, Michael D <michael.d.kinney@intel.com>;
> > Mathews, John <john.mathews@intel.com>; Clark-williams, Zachary
> > <zachary.clark-williams@intel.com>
> > Subject: RE: [PATCH] NetworkPkg Update Security Patch
> >
> > Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
> >
> > -----Original Message-----
> > From: Santhosh Kumar V <santhoshkumarv@ami.com>
> > Sent: Saturday, February 3, 2024 2:11 AM
> > To: devel@edk2.groups.io; Santhosh Kumar V <santhoshkumarv@ami.com>
> > Cc: Sivaraman Nainar <sivaramann@ami.com>; Raj V Akilan
> > <rajva@ami.com>; Kinney, Michael D <michael.d.kinney@intel.com>;
> > Kasbekar, Saloni <saloni.kasbekar@intel.com>; Mathews, John
> > <john.mathews@intel.com>; Clark-williams, Zachary <zachary.clark-
> > williams@intel.com>
> > Subject: [PATCH] NetworkPkg Update Security Patch
> >
> > Update Security patch for Bug 4541 (Predictable TCP ISNs)
> >
> > Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
> > Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
> >
> > Signed-off-by: SanthoshKumar <santhoshkumarv@ami.com>
> > ---
> > NetworkPkg/Library/DxeNetLib/DxeNetLib.c | 21 ++++++++++++++------
> -
> > NetworkPkg/Library/DxeNetLib/DxeNetLib.inf | 2 +-
> > NetworkPkg/TcpDxe/TcpDxe.inf | 1 +
> > NetworkPkg/TcpDxe/TcpMain.h | 1 +
> > NetworkPkg/TcpDxe/TcpMisc.c | 7 ++++++-
> > NetworkPkg/TcpDxe/TcpTimer.c | 8 +++++---
> > 6 files changed, 28 insertions(+), 12 deletions(-)
> >
> > diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> > b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> > index fd4a9e15a8..d3cc8a59d4 100644
> > --- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> > +++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> > @@ -31,6 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> > #include <Library/DevicePathLib.h>
> >
> > #include <Library/PrintLib.h>
> >
> > #include <Library/UefiLib.h>
> >
> > +#include <Library/RngLib.h>
> >
> >
> >
> > #define NIC_ITEM_CONFIG_SIZE (sizeof (NIC_IP4_CONFIG_INFO) + sizeof
> > (EFI_IP4_ROUTE_TABLE) * MAX_IP4_CONFIG_IN_VARIABLE)
> >
> > #define DEFAULT_ZERO_START ((UINTN) ~0)
> >
> > @@ -902,14 +903,20 @@ NetRandomInitSeed (
> > EFI_TIME Time;
> >
> > UINT32 Seed;
> >
> > UINT64 MonotonicCount;
> >
> > + UINT32 RandomVal;
> >
> > +
> >
> > + if ( TRUE == GetRandomNumber32(&RandomVal))
> >
> > + Seed = RandomVal;
> >
> > + else
> >
> > + {
> >
> > + gRT->GetTime (&Time, NULL);
> >
> > + Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 |
> > + Time.Second);
> >
> > + Seed ^= Time.Nanosecond;
> >
> > + Seed ^= Time.Year << 7;
> >
> >
> >
> > - gRT->GetTime (&Time, NULL);
> >
> > - Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 |
> > Time.Second);
> >
> > - Seed ^= Time.Nanosecond;
> >
> > - Seed ^= Time.Year << 7;
> >
> > -
> >
> > - gBS->GetNextMonotonicCount (&MonotonicCount);
> >
> > - Seed += (UINT32)MonotonicCount;
> >
> > + gBS->GetNextMonotonicCount (&MonotonicCount);
> >
> > + Seed += (UINT32)MonotonicCount;
> >
> > + }
> >
> >
> >
> > return Seed;
> >
> > }
> >
> > diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> > b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> > index 8145d256ec..2c800b7c00 100644
> > --- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> > +++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> > @@ -43,7 +43,7 @@
> > MemoryAllocationLib
> >
> > DevicePathLib
> >
> > PrintLib
> >
> > -
> >
> > + RngLib
> >
> >
> >
> > [Guids]
> >
> > gEfiSmbiosTableGuid ##
> SOMETIMES_CONSUMES
> > ## SystemTable
> >
> > diff --git a/NetworkPkg/TcpDxe/TcpDxe.inf
> > b/NetworkPkg/TcpDxe/TcpDxe.inf index c0acbdca57..99c093600f 100644
> > --- a/NetworkPkg/TcpDxe/TcpDxe.inf
> > +++ b/NetworkPkg/TcpDxe/TcpDxe.inf
> > @@ -67,6 +67,7 @@
> > DpcLib
> >
> > NetLib
> >
> > IpIoLib
> >
> > + RngLib
> >
> >
> >
> >
> >
> > [Protocols]
> >
> > diff --git a/NetworkPkg/TcpDxe/TcpMain.h
> b/NetworkPkg/TcpDxe/TcpMain.h
> > index c0c9b7f46e..f94598b6ba 100644
> > --- a/NetworkPkg/TcpDxe/TcpMain.h
> > +++ b/NetworkPkg/TcpDxe/TcpMain.h
> > @@ -16,6 +16,7 @@
> > #include <Library/IpIoLib.h>
> >
> > #include <Library/DevicePathLib.h>
> >
> > #include <Library/PrintLib.h>
> >
> > +#include <Library/RngLib.h>
> >
> >
> >
> > #include "Socket.h"
> >
> > #include "TcpProto.h"
> >
> > diff --git a/NetworkPkg/TcpDxe/TcpMisc.c
> b/NetworkPkg/TcpDxe/TcpMisc.c
> > index c93212d47d..4d33dd6ad6 100644
> > --- a/NetworkPkg/TcpDxe/TcpMisc.c
> > +++ b/NetworkPkg/TcpDxe/TcpMisc.c
> > @@ -516,7 +516,12 @@ TcpGetIss (
> > VOID
> >
> > )
> >
> > {
> >
> > - mTcpGlobalIss += TCP_ISS_INCREMENT_1;
> >
> > + UINT32 RandomVal;
> >
> > + if ( TRUE == GetRandomNumber32(&RandomVal))
> >
> > + mTcpGlobalIss += RandomVal;
> >
> > + else
> >
> > + mTcpGlobalIss += TCP_ISS_INCREMENT_1;
> >
> > +
> >
> > return mTcpGlobalIss;
> >
> > }
> >
> >
> >
> > diff --git a/NetworkPkg/TcpDxe/TcpTimer.c
> > b/NetworkPkg/TcpDxe/TcpTimer.c index 5d2e124977..3370e6b264 100644
> > --- a/NetworkPkg/TcpDxe/TcpTimer.c
> > +++ b/NetworkPkg/TcpDxe/TcpTimer.c
> > @@ -481,10 +481,12 @@ TcpTickingDpc (
> > LIST_ENTRY *Next;
> >
> > TCP_CB *Tcb;
> >
> > INT16 Index;
> >
> > -
> >
> > + UINT32 RandomVal;
> >
> > mTcpTick++;
> >
> > - mTcpGlobalIss += TCP_ISS_INCREMENT_2;
> >
> > -
> >
> > + if ( TRUE == GetRandomNumber32(&RandomVal))
> >
> > + mTcpGlobalIss += RandomVal
> >
> > + else
> >
> > + mTcpGlobalIss += TCP_ISS_INCREMENT_2;
> >
> > //
> >
> > // Don't use LIST_FOR_EACH, which isn't delete safe.
> >
> > //
> >
> > --
> > 2.42.0.windows.2
> > -The information contained in this message may be confidential and
> > proprietary to American Megatrends (AMI). This communication is
> > intended to be read only by the individual or entity to whom it is
> > addressed or by their designee. If the reader of this message is not
> > the intended recipient, you are on notice that any distribution of
> this
> > message, in any form, is strictly prohibited. Please promptly notify
> > the sender by reply e-mail or by telephone at 770-246-8600, and then
> > delete or destroy all copies of the transmission.
>
>
>
>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#116553): https://edk2.groups.io/g/devel/message/116553
Mute This Topic: https://groups.io/mt/104167647/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-03-08 21:26 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-02-03 10:11 [edk2-devel] [PATCH] NetworkPkg Update Security Patch Santhosh Kumar V via groups.io
2024-02-07 22:57 ` Saloni Kasbekar
2024-03-08 21:11 ` Michael D Kinney
2024-03-08 21:26 ` Michael D Kinney
2024-02-08 1:59 ` Michael D Kinney
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox