1/* $NetBSD: ip_id.c,v 1.15 2011/11/19 22:51:25 tls Exp $ */
2
3/*-
4 * Copyright (c) 2008 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This code is derived from software contributed to The NetBSD Foundation
8 * by the 3am Software Foundry ("3am"). It was developed by Matt Thomas.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 */
31
32#include <sys/cdefs.h>
33__KERNEL_RCSID(0, "$NetBSD: ip_id.c,v 1.15 2011/11/19 22:51:25 tls Exp $");
34
35#include <sys/param.h>
36#include <sys/kmem.h>
37#include <sys/mutex.h>
38#include <sys/cprng.h>
39
40#include <net/if.h>
41#include <netinet/in.h>
42#include <netinet/in_var.h>
43
44#include <lib/libkern/libkern.h>
45
46#define IPID_MAXID 65535
47#define IPID_NUMIDS 32768
48
49struct ipid_state {
50 kmutex_t ids_lock;
51 uint16_t ids_start_slot;
52 uint16_t ids_slots[IPID_MAXID];
53};
54
55static inline uint32_t
56ipid_random(void)
57{
58 return cprng_fast32();
59}
60
61/*
62 * Initalizes the
63 * the msb flag. The msb flag is used to generate two distinct
64 * cycles of random numbers and thus avoiding reuse of ids.
65 *
66 * This function is called from id_randomid() when needed, an
67 * application does not have to worry about it.
68 */
69ipid_state_t *
70ip_id_init(void)
71{
72 ipid_state_t *ids;
73 size_t i;
74
75 ids = kmem_alloc(sizeof(ipid_state_t), KM_SLEEP);
76 mutex_init(&ids->ids_lock, MUTEX_DEFAULT, IPL_SOFTNET);
77
78 ids->ids_start_slot = ipid_random();
79 for (i = 0; i < __arraycount(ids->ids_slots); i++) {
80 ids->ids_slots[i] = i;
81 }
82
83 /*
84 * Shuffle the array.
85 */
86 for (i = __arraycount(ids->ids_slots); --i > 0;) {
87 size_t k = ipid_random() % (i + 1);
88 uint16_t t = ids->ids_slots[i];
89 ids->ids_slots[i] = ids->ids_slots[k];
90 ids->ids_slots[k] = t;
91 }
92 return ids;
93}
94
95void
96ip_id_fini(ipid_state_t *ids)
97{
98
99 mutex_destroy(&ids->ids_lock);
100 kmem_free(ids, sizeof(ipid_state_t));
101}
102
103uint16_t
104ip_randomid(ipid_state_t *ids, uint16_t salt)
105{
106 uint32_t r, k, id;
107
108 /* A random number. */
109 r = ipid_random();
110
111 /*
112 * We do a modified Fisher-Yates shuffle but only one position at a
113 * time. Instead of the last entry, we swap with the first entry and
114 * then advance the start of the window by 1. The next time that
115 * swapped-out entry can be used is at least 32768 iterations in the
116 * future.
117 *
118 * The easiest way to visual this is to imagine a card deck with 52
119 * cards. First thing we do is split that into two sets, each with
120 * half of the cards; call them deck A and deck B. Pick a card
121 * randomly from deck A and remember it, then place it at the
122 * bottom of deck B. Then take the top card from deck B and add it
123 * to deck A. Pick another card randomly from deck A and ...
124 */
125 mutex_enter(&ids->ids_lock);
126 k = (r & (IPID_NUMIDS - 1)) + ids->ids_start_slot;
127 if (k >= IPID_MAXID) {
128 k -= IPID_MAXID;
129 }
130 id = ids->ids_slots[k];
131 if (k != ids->ids_start_slot) {
132 ids->ids_slots[k] = ids->ids_slots[ids->ids_start_slot];
133 ids->ids_slots[ids->ids_start_slot] = id;
134 }
135 if (++ids->ids_start_slot == IPID_MAXID) {
136 ids->ids_start_slot = 0;
137 }
138 mutex_exit(&ids->ids_lock);
139
140 /*
141 * Add an optional salt to the id to further obscure it.
142 */
143 id += salt;
144 if (id >= IPID_MAXID) {
145 id -= IPID_MAXID;
146 }
147 return (uint16_t)htons(id + 1);
148}
149