kern/133239: [ae] [jme] if_jme can assign duplicate MAC address

[Gavin Atkinson]

>Number:         133239
>Category:       kern
>Synopsis:       [ae] [jme] if_jme can assign duplicate MAC address
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Mar 31 10:00:00 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Gavin Atkinson
>Release:        FreeBSD 8.0-CURRENT i386
>Organization:
>Environment:
System: FreeBSD rho.york.ac.uk 8.0-CURRENT FreeBSD 8.0-CURRENT #45: Sun Mar 29 17:36:55 BST 2009 root at rho.york.ac.uk:/usr/obj/usr/src/sys/RHO i386 i386

>Description:
	If jme(4) cannot read the MAC address from the eeprom, it will
generate a fake MAC address using arc4random().  However, when doing this
it uses an OUI that is assigned to ASUSTek, and doesn't set the
"locally-assigned" bit, meaning that this has the potential to clash with
other machines, as well as generally not being a nice thing to do.
	Additionally, ae(4) suffers a similar problem, although at least
that driver does set the "locally-assigned" bit.
>How-To-Repeat:
	N/A
>Fix:

	Fix these drivers in the same way as ate(4) was fixed: use a
locally assigned address rather than stealing one.  The best way this
is currently done in FreeBSD seems to be to set the first three bytes
to 'b', 's', 'd' - so do the same here.  This works as 'b' has the
"llocally-assigned" bit set.

--- ae_jme_macaddress.diff begins here ---
Index: src/sys/dev/ae/if_ae.c
===================================================================
RCS file: /home/ncvs/src/sys/dev/ae/if_ae.c,v
retrieving revision 1.3
diff -u -r1.3 if_ae.c
--- src/sys/dev/ae/if_ae.c	4 Feb 2009 20:35:31 -0000	1.3
+++ src/sys/dev/ae/if_ae.c	31 Mar 2009 09:02:38 -0000
@@ -1072,11 +1072,13 @@
 		eaddr[0] = arc4random();
 
 		/*
-		 * Set OUI to ASUSTek COMPUTER INC.
+		 * Set OUI to convenient locally assigned address.  'b'
+		 * is 0x62, which has the locally assigned bit set, and
+		 * the broadcast/multicast bit clear.
 		 */
-		sc->eaddr[0] = 0x02;	/* U/L bit set. */
-		sc->eaddr[1] = 0x1f;
-		sc->eaddr[2] = 0xc6;
+		sc->eaddr[0] = 'b';
+		sc->eaddr[1] = 's';
+		sc->eaddr[2] = 'd';
 		sc->eaddr[3] = (eaddr[0] >> 16) & 0xff;
 		sc->eaddr[4] = (eaddr[0] >> 8) & 0xff;
 		sc->eaddr[5] = (eaddr[0] >> 0) & 0xff;
Index: src/sys/dev/jme/if_jme.c
===================================================================
RCS file: /home/ncvs/src/sys/dev/jme/if_jme.c,v
retrieving revision 1.10
diff -u -r1.10 if_jme.c
--- src/sys/dev/jme/if_jme.c	4 Dec 2008 02:16:53 -0000	1.10
+++ src/sys/dev/jme/if_jme.c	31 Mar 2009 08:59:13 -0000
@@ -460,10 +460,15 @@
 		device_printf(sc->jme_dev,
 		    "generating fake ethernet address.\n");
 		par0 = arc4random();
-		/* Set OUI to JMicron. */
-		sc->jme_eaddr[0] = 0x00;
-		sc->jme_eaddr[1] = 0x1B;
-		sc->jme_eaddr[2] = 0x8C;
+
+		/*
+		 * Set OUI to convenient locally assigned address.  'b'
+		 * is 0x62, which has the locally assigned bit set, and
+		 * the broadcast/multicast bit clear.
+		 */
+		sc->jme_eaddr[0] = 'b';
+		sc->jme_eaddr[1] = 's';
+		sc->jme_eaddr[2] = 'd';
 		sc->jme_eaddr[3] = (par0 >> 16) & 0xff;
 		sc->jme_eaddr[4] = (par0 >> 8) & 0xff;
 		sc->jme_eaddr[5] = par0 & 0xff;
--- ae_jme_macaddress.diff ends here ---


>Release-Note:
>Audit-Trail:
>Unformatted: