Re: [edk2-devel] [PATCH] NetworkPkg Update Security Patch

["Michael D Kinney" <michael.d.kinney@intel.com>]

From this CI run, you can see there are other packages impacted by
this change.  Missing RngLib mappings.  Is this expected?

https://dev.azure.com/tianocore/edk2-ci/_build/results?buildId=120372&view=logs&jobId=56079008-74ef-5d1a-7db6-78cd637f5fd1&j=56079008-74ef-5d1a-7db6-78cd637f5fd1&t=717a0b6b-5e6c-5b81-aea3-d574ed7b6a91

Please update patches to address all these failures and resend to mailing list.

Thanks,

Mike


> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Michael
> D Kinney
> Sent: Friday, March 8, 2024 1:12 PM
> To: Kasbekar, Saloni <saloni.kasbekar@intel.com>; Santhosh Kumar V
> <santhoshkumarv@ami.com>; devel@edk2.groups.io
> Cc: Sivaraman Nainar <sivaramann@ami.com>; Raj V Akilan
> <rajva@ami.com>; Mathews, John <john.mathews@intel.com>; Clark-
> williams, Zachary <zachary.clark-williams@intel.com>; Kinney, Michael D
> <michael.d.kinney@intel.com>
> Subject: Re: [edk2-devel] [PATCH] NetworkPkg Update Security Patch
> 
> Acked-by: Michael D Kinney <michael.d.kinney@intel.com>
> 
> > -----Original Message-----
> > From: Kasbekar, Saloni <saloni.kasbekar@intel.com>
> > Sent: Wednesday, February 7, 2024 2:58 PM
> > To: Santhosh Kumar V <santhoshkumarv@ami.com>; devel@edk2.groups.io
> > Cc: Sivaraman Nainar <sivaramann@ami.com>; Raj V Akilan
> > <rajva@ami.com>; Kinney, Michael D <michael.d.kinney@intel.com>;
> > Mathews, John <john.mathews@intel.com>; Clark-williams, Zachary
> > <zachary.clark-williams@intel.com>
> > Subject: RE: [PATCH] NetworkPkg Update Security Patch
> >
> > Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
> >
> > -----Original Message-----
> > From: Santhosh Kumar V <santhoshkumarv@ami.com>
> > Sent: Saturday, February 3, 2024 2:11 AM
> > To: devel@edk2.groups.io; Santhosh Kumar V <santhoshkumarv@ami.com>
> > Cc: Sivaraman Nainar <sivaramann@ami.com>; Raj V Akilan
> > <rajva@ami.com>; Kinney, Michael D <michael.d.kinney@intel.com>;
> > Kasbekar, Saloni <saloni.kasbekar@intel.com>; Mathews, John
> > <john.mathews@intel.com>; Clark-williams, Zachary <zachary.clark-
> > williams@intel.com>
> > Subject: [PATCH] NetworkPkg Update Security Patch
> >
> > Update Security patch for Bug 4541 (Predictable TCP ISNs)
> >
> > Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
> > Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>
> >
> > Signed-off-by: SanthoshKumar <santhoshkumarv@ami.com>
> > ---
> >  NetworkPkg/Library/DxeNetLib/DxeNetLib.c   | 21 ++++++++++++++------
> -
> >  NetworkPkg/Library/DxeNetLib/DxeNetLib.inf |  2 +-
> >  NetworkPkg/TcpDxe/TcpDxe.inf               |  1 +
> >  NetworkPkg/TcpDxe/TcpMain.h                |  1 +
> >  NetworkPkg/TcpDxe/TcpMisc.c                |  7 ++++++-
> >  NetworkPkg/TcpDxe/TcpTimer.c               |  8 +++++---
> >  6 files changed, 28 insertions(+), 12 deletions(-)
> >
> > diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> > b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> > index fd4a9e15a8..d3cc8a59d4 100644
> > --- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> > +++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> > @@ -31,6 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> > #include <Library/DevicePathLib.h>
> >
> >  #include <Library/PrintLib.h>
> >
> >  #include <Library/UefiLib.h>
> >
> > +#include <Library/RngLib.h>
> >
> >
> >
> >  #define NIC_ITEM_CONFIG_SIZE  (sizeof (NIC_IP4_CONFIG_INFO) + sizeof
> > (EFI_IP4_ROUTE_TABLE) * MAX_IP4_CONFIG_IN_VARIABLE)
> >
> >  #define DEFAULT_ZERO_START    ((UINTN) ~0)
> >
> > @@ -902,14 +903,20 @@ NetRandomInitSeed (
> >    EFI_TIME  Time;
> >
> >    UINT32    Seed;
> >
> >    UINT64    MonotonicCount;
> >
> > +  UINT32    RandomVal;
> >
> > +
> >
> > +  if ( TRUE == GetRandomNumber32(&RandomVal))
> >
> > +    Seed = RandomVal;
> >
> > +  else
> >
> > +  {
> >
> > +    gRT->GetTime (&Time, NULL);
> >
> > +    Seed  = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 |
> > + Time.Second);
> >
> > +    Seed ^= Time.Nanosecond;
> >
> > +    Seed ^= Time.Year << 7;
> >
> >
> >
> > -  gRT->GetTime (&Time, NULL);
> >
> > -  Seed  = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 |
> > Time.Second);
> >
> > -  Seed ^= Time.Nanosecond;
> >
> > -  Seed ^= Time.Year << 7;
> >
> > -
> >
> > -  gBS->GetNextMonotonicCount (&MonotonicCount);
> >
> > -  Seed += (UINT32)MonotonicCount;
> >
> > +    gBS->GetNextMonotonicCount (&MonotonicCount);
> >
> > +    Seed += (UINT32)MonotonicCount;
> >
> > +  }
> >
> >
> >
> >    return Seed;
> >
> >  }
> >
> > diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> > b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> > index 8145d256ec..2c800b7c00 100644
> > --- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> > +++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> > @@ -43,7 +43,7 @@
> >    MemoryAllocationLib
> >
> >    DevicePathLib
> >
> >    PrintLib
> >
> > -
> >
> > +  RngLib
> >
> >
> >
> >  [Guids]
> >
> >    gEfiSmbiosTableGuid                           ##
> SOMETIMES_CONSUMES
> > ## SystemTable
> >
> > diff --git a/NetworkPkg/TcpDxe/TcpDxe.inf
> > b/NetworkPkg/TcpDxe/TcpDxe.inf index c0acbdca57..99c093600f 100644
> > --- a/NetworkPkg/TcpDxe/TcpDxe.inf
> > +++ b/NetworkPkg/TcpDxe/TcpDxe.inf
> > @@ -67,6 +67,7 @@
> >    DpcLib
> >
> >    NetLib
> >
> >    IpIoLib
> >
> > +  RngLib
> >
> >
> >
> >
> >
> >  [Protocols]
> >
> > diff --git a/NetworkPkg/TcpDxe/TcpMain.h
> b/NetworkPkg/TcpDxe/TcpMain.h
> > index c0c9b7f46e..f94598b6ba 100644
> > --- a/NetworkPkg/TcpDxe/TcpMain.h
> > +++ b/NetworkPkg/TcpDxe/TcpMain.h
> > @@ -16,6 +16,7 @@
> >  #include <Library/IpIoLib.h>
> >
> >  #include <Library/DevicePathLib.h>
> >
> >  #include <Library/PrintLib.h>
> >
> > +#include <Library/RngLib.h>
> >
> >
> >
> >  #include "Socket.h"
> >
> >  #include "TcpProto.h"
> >
> > diff --git a/NetworkPkg/TcpDxe/TcpMisc.c
> b/NetworkPkg/TcpDxe/TcpMisc.c
> > index c93212d47d..4d33dd6ad6 100644
> > --- a/NetworkPkg/TcpDxe/TcpMisc.c
> > +++ b/NetworkPkg/TcpDxe/TcpMisc.c
> > @@ -516,7 +516,12 @@ TcpGetIss (
> >    VOID
> >
> >    )
> >
> >  {
> >
> > -  mTcpGlobalIss += TCP_ISS_INCREMENT_1;
> >
> > +  UINT32        RandomVal;
> >
> > +  if ( TRUE == GetRandomNumber32(&RandomVal))
> >
> > +    mTcpGlobalIss += RandomVal;
> >
> > +  else
> >
> > +    mTcpGlobalIss += TCP_ISS_INCREMENT_1;
> >
> > +
> >
> >    return mTcpGlobalIss;
> >
> >  }
> >
> >
> >
> > diff --git a/NetworkPkg/TcpDxe/TcpTimer.c
> > b/NetworkPkg/TcpDxe/TcpTimer.c index 5d2e124977..3370e6b264 100644
> > --- a/NetworkPkg/TcpDxe/TcpTimer.c
> > +++ b/NetworkPkg/TcpDxe/TcpTimer.c
> > @@ -481,10 +481,12 @@ TcpTickingDpc (
> >    LIST_ENTRY  *Next;
> >
> >    TCP_CB      *Tcb;
> >
> >    INT16       Index;
> >
> > -
> >
> > +  UINT32        RandomVal;
> >
> >    mTcpTick++;
> >
> > -  mTcpGlobalIss += TCP_ISS_INCREMENT_2;
> >
> > -
> >
> > +  if ( TRUE == GetRandomNumber32(&RandomVal))
> >
> > +    mTcpGlobalIss += RandomVal
> >
> > +  else
> >
> > +    mTcpGlobalIss += TCP_ISS_INCREMENT_2;
> >
> >    //
> >
> >    // Don't use LIST_FOR_EACH, which isn't delete safe.
> >
> >    //
> >
> > --
> > 2.42.0.windows.2
> > -The information contained in this message may be confidential and
> > proprietary to American Megatrends (AMI). This communication is
> > intended to be read only by the individual or entity to whom it is
> > addressed or by their designee. If the reader of this message is not
> > the intended recipient, you are on notice that any distribution of
> this
> > message, in any form, is strictly prohibited. Please promptly notify
> > the sender by reply e-mail or by telephone at 770-246-8600, and then
> > delete or destroy all copies of the transmission.
> 
> 
> 
> 



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#116553): https://edk2.groups.io/g/devel/message/116553
Mute This Topic: https://groups.io/mt/104167647/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-