From: "Michael D Kinney" <michael.d.kinney@intel.com>
To: "devel@edk2.groups.io" <devel@edk2.groups.io>,
"santhoshkumarv@ami.com" <santhoshkumarv@ami.com>
Cc: Sivaraman Nainar <sivaramann@ami.com>,
Raj V Akilan <rajva@ami.com>,
"Mathews, John" <john.mathews@intel.com>,
"Kinney, Michael D" <michael.d.kinney@intel.com>
Subject: Re: [edk2-devel] [PATCH] NetworkPkg:Update Security Fix
Date: Fri, 2 Feb 2024 19:23:31 +0000 [thread overview]
Message-ID: <CO1PR11MB4929EAA3686FEEE74218A8FFD2422@CO1PR11MB4929.namprd11.prod.outlook.com> (raw)
In-Reply-To: <20240201103301.673-1-santhoshkumarv@ami.com>
Please add Cc: lines to commit message with NetworkPkg
Maintainers/reviewers.
Thanks,
Mike
> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Santhosh
> Kumar V via groups.io
> Sent: Thursday, February 1, 2024 2:33 AM
> To: devel@edk2.groups.io; Santhosh Kumar V <santhoshkumarv@ami.com>
> Cc: Sivaraman Nainar <sivaramann@ami.com>; Raj V Akilan
> <rajva@ami.com>; Mathews, John <john.mathews@intel.com>
> Subject: [edk2-devel] [PATCH] NetworkPkg:Update Security Fix
>
> Update Security patch for Bug 4541 (Predictable TCP ISNs)
>
>
> Signed-off-by: SanthoshKumar <santhoshkumarv@ami.com>
> ---
> NetworkPkg/Library/DxeNetLib/DxeNetLib.c | 21 ++++++++++++++-------
> NetworkPkg/Library/DxeNetLib/DxeNetLib.inf | 2 +-
> NetworkPkg/TcpDxe/TcpDxe.inf | 1 +
> NetworkPkg/TcpDxe/TcpMain.h | 1 +
> NetworkPkg/TcpDxe/TcpMisc.c | 7 ++++++-
> NetworkPkg/TcpDxe/TcpTimer.c | 8 +++++---
> 6 files changed, 28 insertions(+), 12 deletions(-)
>
> diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> index fd4a9e15a8..d3cc8a59d4 100644
> --- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> +++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> @@ -31,6 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> #include <Library/DevicePathLib.h>
>
> #include <Library/PrintLib.h>
>
> #include <Library/UefiLib.h>
>
> +#include <Library/RngLib.h>
>
>
>
> #define NIC_ITEM_CONFIG_SIZE (sizeof (NIC_IP4_CONFIG_INFO) + sizeof
> (EFI_IP4_ROUTE_TABLE) * MAX_IP4_CONFIG_IN_VARIABLE)
>
> #define DEFAULT_ZERO_START ((UINTN) ~0)
>
> @@ -902,14 +903,20 @@ NetRandomInitSeed (
> EFI_TIME Time;
>
> UINT32 Seed;
>
> UINT64 MonotonicCount;
>
> + UINT32 RandomVal;
>
> +
>
> + if ( TRUE == GetRandomNumber32(&RandomVal))
>
> + Seed = RandomVal;
>
> + else
>
> + {
>
> + gRT->GetTime (&Time, NULL);
>
> + Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 |
> Time.Second);
>
> + Seed ^= Time.Nanosecond;
>
> + Seed ^= Time.Year << 7;
>
>
>
> - gRT->GetTime (&Time, NULL);
>
> - Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 |
> Time.Second);
>
> - Seed ^= Time.Nanosecond;
>
> - Seed ^= Time.Year << 7;
>
> -
>
> - gBS->GetNextMonotonicCount (&MonotonicCount);
>
> - Seed += (UINT32)MonotonicCount;
>
> + gBS->GetNextMonotonicCount (&MonotonicCount);
>
> + Seed += (UINT32)MonotonicCount;
>
> + }
>
>
>
> return Seed;
>
> }
>
> diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> index 8145d256ec..2c800b7c00 100644
> --- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> +++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> @@ -43,7 +43,7 @@
> MemoryAllocationLib
>
> DevicePathLib
>
> PrintLib
>
> -
>
> + RngLib
>
>
>
> [Guids]
>
> gEfiSmbiosTableGuid ## SOMETIMES_CONSUMES
> ## SystemTable
>
> diff --git a/NetworkPkg/TcpDxe/TcpDxe.inf
> b/NetworkPkg/TcpDxe/TcpDxe.inf
> index c0acbdca57..99c093600f 100644
> --- a/NetworkPkg/TcpDxe/TcpDxe.inf
> +++ b/NetworkPkg/TcpDxe/TcpDxe.inf
> @@ -67,6 +67,7 @@
> DpcLib
>
> NetLib
>
> IpIoLib
>
> + RngLib
>
>
>
>
>
> [Protocols]
>
> diff --git a/NetworkPkg/TcpDxe/TcpMain.h b/NetworkPkg/TcpDxe/TcpMain.h
> index c0c9b7f46e..f94598b6ba 100644
> --- a/NetworkPkg/TcpDxe/TcpMain.h
> +++ b/NetworkPkg/TcpDxe/TcpMain.h
> @@ -16,6 +16,7 @@
> #include <Library/IpIoLib.h>
>
> #include <Library/DevicePathLib.h>
>
> #include <Library/PrintLib.h>
>
> +#include <Library/RngLib.h>
>
>
>
> #include "Socket.h"
>
> #include "TcpProto.h"
>
> diff --git a/NetworkPkg/TcpDxe/TcpMisc.c b/NetworkPkg/TcpDxe/TcpMisc.c
> index c93212d47d..4d33dd6ad6 100644
> --- a/NetworkPkg/TcpDxe/TcpMisc.c
> +++ b/NetworkPkg/TcpDxe/TcpMisc.c
> @@ -516,7 +516,12 @@ TcpGetIss (
> VOID
>
> )
>
> {
>
> - mTcpGlobalIss += TCP_ISS_INCREMENT_1;
>
> + UINT32 RandomVal;
>
> + if ( TRUE == GetRandomNumber32(&RandomVal))
>
> + mTcpGlobalIss += RandomVal;
>
> + else
>
> + mTcpGlobalIss += TCP_ISS_INCREMENT_1;
>
> +
>
> return mTcpGlobalIss;
>
> }
>
>
>
> diff --git a/NetworkPkg/TcpDxe/TcpTimer.c
> b/NetworkPkg/TcpDxe/TcpTimer.c
> index 5d2e124977..3370e6b264 100644
> --- a/NetworkPkg/TcpDxe/TcpTimer.c
> +++ b/NetworkPkg/TcpDxe/TcpTimer.c
> @@ -481,10 +481,12 @@ TcpTickingDpc (
> LIST_ENTRY *Next;
>
> TCP_CB *Tcb;
>
> INT16 Index;
>
> -
>
> + UINT32 RandomVal;
>
> mTcpTick++;
>
> - mTcpGlobalIss += TCP_ISS_INCREMENT_2;
>
> -
>
> + if ( TRUE == GetRandomNumber32(&RandomVal))
>
> + mTcpGlobalIss += RandomVal
>
> + else
>
> + mTcpGlobalIss += TCP_ISS_INCREMENT_2;
>
> //
>
> // Don't use LIST_FOR_EACH, which isn't delete safe.
>
> //
>
> --
> 2.42.0.windows.2
> -The information contained in this message may be confidential and
> proprietary to American Megatrends (AMI). This communication is
> intended to be read only by the individual or entity to whom it is
> addressed or by their designee. If the reader of this message is not
> the intended recipient, you are on notice that any distribution of this
> message, in any form, is strictly prohibited. Please promptly notify
> the sender by reply e-mail or by telephone at 770-246-8600, and then
> delete or destroy all copies of the transmission.
>
>
>
>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#115068): https://edk2.groups.io/g/devel/message/115068
Mute This Topic: https://groups.io/mt/104108873/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-
prev parent reply other threads:[~2024-02-02 19:23 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-01 10:33 [edk2-devel] [PATCH] NetworkPkg:Update Security Fix Santhosh Kumar V via groups.io
2024-02-02 19:23 ` Michael D Kinney [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CO1PR11MB4929EAA3686FEEE74218A8FFD2422@CO1PR11MB4929.namprd11.prod.outlook.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox