Acked-by: Michael D Kinney <michael.d.kin...@intel.com>
> -----Original Message-----
> From: Kasbekar, Saloni <saloni.kasbe...@intel.com>
> Sent: Wednesday, February 7, 2024 2:58 PM
> To: Santhosh Kumar V <santhoshkum...@ami.com>; devel@edk2.groups.io
> Cc: Sivaraman Nainar <sivaram...@ami.com>; Raj V Akilan
> <ra...@ami.com>; Kinney, Michael D <michael.d.kin...@intel.com>;
> Mathews, John <john.math...@intel.com>; Clark-williams, Zachary
> <zachary.clark-willi...@intel.com>
> Subject: RE: [PATCH] NetworkPkg Update Security Patch
>
> Reviewed-by: Saloni Kasbekar <saloni.kasbe...@intel.com>
>
> -----Original Message-----
> From: Santhosh Kumar V <santhoshkum...@ami.com>
> Sent: Saturday, February 3, 2024 2:11 AM
> To: devel@edk2.groups.io; Santhosh Kumar V <santhoshkum...@ami.com>
> Cc: Sivaraman Nainar <sivaram...@ami.com>; Raj V Akilan
> <ra...@ami.com>; Kinney, Michael D <michael.d.kin...@intel.com>;
> Kasbekar, Saloni <saloni.kasbe...@intel.com>; Mathews, John
> <john.math...@intel.com>; Clark-williams, Zachary <zachary.clark-
> willi...@intel.com>
> Subject: [PATCH] NetworkPkg Update Security Patch
>
> Update Security patch for Bug 4541 (Predictable TCP ISNs)
>
> Cc: Saloni Kasbekar <saloni.kasbe...@intel.com>
> Cc: Zachary Clark-williams <zachary.clark-willi...@intel.com>
>
> Signed-off-by: SanthoshKumar <santhoshkum...@ami.com>
> ---
> NetworkPkg/Library/DxeNetLib/DxeNetLib.c | 21 ++++++++++++++-------
> NetworkPkg/Library/DxeNetLib/DxeNetLib.inf | 2 +-
> NetworkPkg/TcpDxe/TcpDxe.inf | 1 +
> NetworkPkg/TcpDxe/TcpMain.h | 1 +
> NetworkPkg/TcpDxe/TcpMisc.c | 7 ++++++-
> NetworkPkg/TcpDxe/TcpTimer.c | 8 +++++---
> 6 files changed, 28 insertions(+), 12 deletions(-)
>
> diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> index fd4a9e15a8..d3cc8a59d4 100644
> --- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> +++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
> @@ -31,6 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
> #include <Library/DevicePathLib.h>
>
> #include <Library/PrintLib.h>
>
> #include <Library/UefiLib.h>
>
> +#include <Library/RngLib.h>
>
>
>
> #define NIC_ITEM_CONFIG_SIZE (sizeof (NIC_IP4_CONFIG_INFO) + sizeof
> (EFI_IP4_ROUTE_TABLE) * MAX_IP4_CONFIG_IN_VARIABLE)
>
> #define DEFAULT_ZERO_START ((UINTN) ~0)
>
> @@ -902,14 +903,20 @@ NetRandomInitSeed (
> EFI_TIME Time;
>
> UINT32 Seed;
>
> UINT64 MonotonicCount;
>
> + UINT32 RandomVal;
>
> +
>
> + if ( TRUE == GetRandomNumber32(&RandomVal))
>
> + Seed = RandomVal;
>
> + else
>
> + {
>
> + gRT->GetTime (&Time, NULL);
>
> + Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 |
> + Time.Second);
>
> + Seed ^= Time.Nanosecond;
>
> + Seed ^= Time.Year << 7;
>
>
>
> - gRT->GetTime (&Time, NULL);
>
> - Seed = (Time.Hour << 24 | Time.Day << 16 | Time.Minute << 8 |
> Time.Second);
>
> - Seed ^= Time.Nanosecond;
>
> - Seed ^= Time.Year << 7;
>
> -
>
> - gBS->GetNextMonotonicCount (&MonotonicCount);
>
> - Seed += (UINT32)MonotonicCount;
>
> + gBS->GetNextMonotonicCount (&MonotonicCount);
>
> + Seed += (UINT32)MonotonicCount;
>
> + }
>
>
>
> return Seed;
>
> }
>
> diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> index 8145d256ec..2c800b7c00 100644
> --- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> +++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.inf
> @@ -43,7 +43,7 @@
> MemoryAllocationLib
>
> DevicePathLib
>
> PrintLib
>
> -
>
> + RngLib
>
>
>
> [Guids]
>
> gEfiSmbiosTableGuid ## SOMETIMES_CONSUMES
> ## SystemTable
>
> diff --git a/NetworkPkg/TcpDxe/TcpDxe.inf
> b/NetworkPkg/TcpDxe/TcpDxe.inf index c0acbdca57..99c093600f 100644
> --- a/NetworkPkg/TcpDxe/TcpDxe.inf
> +++ b/NetworkPkg/TcpDxe/TcpDxe.inf
> @@ -67,6 +67,7 @@
> DpcLib
>
> NetLib
>
> IpIoLib
>
> + RngLib
>
>
>
>
>
> [Protocols]
>
> diff --git a/NetworkPkg/TcpDxe/TcpMain.h b/NetworkPkg/TcpDxe/TcpMain.h
> index c0c9b7f46e..f94598b6ba 100644
> --- a/NetworkPkg/TcpDxe/TcpMain.h
> +++ b/NetworkPkg/TcpDxe/TcpMain.h
> @@ -16,6 +16,7 @@
> #include <Library/IpIoLib.h>
>
> #include <Library/DevicePathLib.h>
>
> #include <Library/PrintLib.h>
>
> +#include <Library/RngLib.h>
>
>
>
> #include "Socket.h"
>
> #include "TcpProto.h"
>
> diff --git a/NetworkPkg/TcpDxe/TcpMisc.c b/NetworkPkg/TcpDxe/TcpMisc.c
> index c93212d47d..4d33dd6ad6 100644
> --- a/NetworkPkg/TcpDxe/TcpMisc.c
> +++ b/NetworkPkg/TcpDxe/TcpMisc.c
> @@ -516,7 +516,12 @@ TcpGetIss (
> VOID
>
> )
>
> {
>
> - mTcpGlobalIss += TCP_ISS_INCREMENT_1;
>
> + UINT32 RandomVal;
>
> + if ( TRUE == GetRandomNumber32(&RandomVal))
>
> + mTcpGlobalIss += RandomVal;
>
> + else
>
> + mTcpGlobalIss += TCP_ISS_INCREMENT_1;
>
> +
>
> return mTcpGlobalIss;
>
> }
>
>
>
> diff --git a/NetworkPkg/TcpDxe/TcpTimer.c
> b/NetworkPkg/TcpDxe/TcpTimer.c index 5d2e124977..3370e6b264 100644
> --- a/NetworkPkg/TcpDxe/TcpTimer.c
> +++ b/NetworkPkg/TcpDxe/TcpTimer.c
> @@ -481,10 +481,12 @@ TcpTickingDpc (
> LIST_ENTRY *Next;
>
> TCP_CB *Tcb;
>
> INT16 Index;
>
> -
>
> + UINT32 RandomVal;
>
> mTcpTick++;
>
> - mTcpGlobalIss += TCP_ISS_INCREMENT_2;
>
> -
>
> + if ( TRUE == GetRandomNumber32(&RandomVal))
>
> + mTcpGlobalIss += RandomVal
>
> + else
>
> + mTcpGlobalIss += TCP_ISS_INCREMENT_2;
>
> //
>
> // Don't use LIST_FOR_EACH, which isn't delete safe.
>
> //
>
> --
> 2.42.0.windows.2
> -The information contained in this message may be confidential and
> proprietary to American Megatrends (AMI). This communication is
> intended to be read only by the individual or entity to whom it is
> addressed or by their designee. If the reader of this message is not
> the intended recipient, you are on notice that any distribution of this
> message, in any form, is strictly prohibited. Please promptly notify
> the sender by reply e-mail or by telephone at 770-246-8600, and then
> delete or destroy all copies of the transmission.
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#116552): https://edk2.groups.io/g/devel/message/116552
Mute This Topic: https://groups.io/mt/104167647/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
