The branch main has been updated by kevans:
URL:
https://cgit.FreeBSD.org/src/commit/?id=b2f02b04948cea9b7f019b267e1fc2d083b1417c
commit b2f02b04948cea9b7f019b267e1fc2d083b1417c
Author: Quentin Thébault <quentin.theba...@defenso.fr>
AuthorDate: 2025-07-02 06:17:29 +0000
Commit: Kyle Evans <kev...@freebsd.org>
CommitDate: 2025-07-02 19:33:19 +0000
if_ethersubr: preserve entropy of MAC addresses
Ethernet MAC addresses are currently generated by concatenating the
first bytes of a SHA1 digest. However the digest buffer is defined as a
signed char buffer, which means that any digest digit greater than 0x80
will be promoted to a negative int before the concatenation.
As a result, any digest digit greater than 0x80 will overwrite the
previous ones throught the application of the bitwise-or with its 0xFF
higher bytes, effectively reducing the entropy of addresses generated
and significantly increasing the risk of conflict.
Defining the digest buffer as unsigned ensures there will be no unwanted
consequences during integer promotion and the concatenation will work as
expected.
Signed-off-by: Quentin Thébault <quentin.theba...@defenso.fr>
Closes: https://github.com/freebsd/freebsd-src/pull/1750
---
sys/net/if_ethersubr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sys/net/if_ethersubr.c b/sys/net/if_ethersubr.c
index 66a4724a786c..cf697089708c 100644
--- a/sys/net/if_ethersubr.c
+++ b/sys/net/if_ethersubr.c
@@ -1486,7 +1486,7 @@ ether_gen_addr_byname(const char *nameunit, struct
ether_addr *hwaddr)
char uuid[HOSTUUIDLEN + 1];
uint64_t addr;
int i, sz;
- char digest[SHA1_RESULTLEN];
+ unsigned char digest[SHA1_RESULTLEN];
char jailname[MAXHOSTNAMELEN];
getcredhostuuid(curthread->td_ucred, uuid, sizeof(uuid));
