git: b2f02b04948c - main - if_ethersubr: preserve entropy of MAC addresses

The branch main has been updated by kevans:

URL: https://cgit.FreeBSD.org/src/commit/?id=b2f02b04948cea9b7f019b267e1fc2d083b1417c

commit b2f02b04948cea9b7f019b267e1fc2d083b1417c
Author:     Quentin Thébault <quentin.thebault@defenso.fr>
AuthorDate: 2025-07-02 06:17:29 +0000
Commit:     Kyle Evans <kevans@FreeBSD.org>
CommitDate: 2025-07-02 19:33:19 +0000

    if_ethersubr: preserve entropy of MAC addresses
    
    Ethernet MAC addresses are currently generated by concatenating the
    first bytes of a SHA1 digest. However the digest buffer is defined as a
    signed char buffer, which means that any digest digit greater than 0x80
    will be promoted to a negative int before the concatenation.
    
    As a result, any digest digit greater than 0x80 will overwrite the
    previous ones throught the application of the bitwise-or with its 0xFF
    higher bytes, effectively reducing the entropy of addresses generated
    and significantly increasing the risk of conflict.
    
    Defining the digest buffer as unsigned ensures there will be no unwanted
    consequences during integer promotion and the concatenation will work as
    expected.
    
    Signed-off-by: Quentin Thébault <quentin.thebault@defenso.fr>
    Closes: https://github.com/freebsd/freebsd-src/pull/1750
---
 sys/net/if_ethersubr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/net/if_ethersubr.c b/sys/net/if_ethersubr.c
index 66a4724a786c..cf697089708c 100644
--- a/sys/net/if_ethersubr.c
+++ b/sys/net/if_ethersubr.c
@@ -1486,7 +1486,7 @@ ether_gen_addr_byname(const char *nameunit, struct ether_addr *hwaddr)
 	char uuid[HOSTUUIDLEN + 1];
 	uint64_t addr;
 	int i, sz;
-	char digest[SHA1_RESULTLEN];
+	unsigned char digest[SHA1_RESULTLEN];
 	char jailname[MAXHOSTNAMELEN];
 
 	getcredhostuuid(curthread->td_ucred, uuid, sizeof(uuid));