netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Change IPv4 ID generation algorithm.

Browse Source 
This addresses an issue discovered by Inon Kaplan (PhD candidate in the
Hebrew University School of Computer Science and Engineering), Ron Even (BSc
graduate of Bar Ilan University) and Amit Klein (faculty member in the Hebrew
University School of Computer Science and Engineering). Details will be
provided in their paper, to be presented in a forthcoming academic conference.

The ID generation for IPv4 is changed to return a completely random number.

PiperOrigin-RevId: 587102343
This commit is contained in:
Nayana Bidari
2023-12-01 13:31:24 -08:00
committed by gVisor bot
parent 06b2634041
commit 505e1fd33f
2 changed files with 18 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/rand/rng.go
+9
View File
@@ -33,6 +33,15 @@ func RNGFrom(r io.Reader) RNG {
return RNG{Reader: r}
}
// Uint16 is analogous to the standard library's math/rand.Uint16.
func (rg *RNG) Uint16() uint16 {
var data [2]byte
if _, err := rg.Reader.Read(data[:]); err != nil {
panic(fmt.Sprintf("Read() failed: %v", err))
}
return binary.NativeEndian.Uint16(data[:])
}
// Uint32 is analogous to the standard library's math/rand.Uint32.
func (rg *RNG) Uint32() uint32 {
var data [4]byte
pkg/tcpip/network/ipv4/ipv4.go
+9 -21
View File
@@ -437,26 +437,15 @@ func (e *endpoint) NetworkProtocolNumber() tcpip.NetworkProtocolNumber {
return e.protocol.Number()
}
func (e *endpoint) generateID(srcAddr, dstAddr tcpip.Address, params stack.NetworkHeaderParams) uint32 {
// Get the time difference between the last time 'ids' was accessed and
// now. Update 'idTS' to the current time.
now := e.protocol.stack.Clock().NowMonotonic().Milliseconds()
oldTS := e.protocol.idTS.Load()
diff := now - oldTS
// getID returns a random uint16 number (other than zero) to be used as ID in
// the IPv4 header.
func (e *endpoint) getID() uint16 {
rng := e.protocol.stack.SecureRNG()
e.protocol.idTS.Store(now)
var counter uint32
if diff < 1 {
counter = rng.Uint32()
} else {
// Increment ID with a random number in the range [0, diff).
counter = uint32(rng.Int63n(diff))
id := rng.Uint16()
for id == 0 {
id = rng.Uint16()
}
// Calculate the hash value.
hash := hashRoute(srcAddr, dstAddr, params.Protocol, e.protocol.hashIV) % buckets
return e.protocol.ids[hash].Add(counter)
return id
}
func (e *endpoint) addIPHeader(srcAddr, dstAddr tcpip.Address, pkt stack.PacketBufferPtr, params stack.NetworkHeaderParams, options header.IPv4OptionsSerializer) tcpip.Error {
@@ -477,10 +466,9 @@ func (e *endpoint) addIPHeader(srcAddr, dstAddr tcpip.Address, pkt stack.PacketB
// RFC 6864 section 4.3 mandates uniqueness of ID values for non-atomic
// datagrams. Since the DF bit is never being set here, all datagrams
// are non-atomic and need an ID.
id := e.generateID(srcAddr, dstAddr, params)
ipH.Encode(&header.IPv4Fields{
TotalLength: uint16(length),
ID: uint16(id),
ID: e.getID(),
TTL: params.TTL,
TOS: params.TOS,
Protocol: uint8(params.Protocol),
@@ -650,7 +638,7 @@ func (e *endpoint) WriteHeaderIncludedPacket(r *stack.Route, pkt stack.PacketBuf
// non-atomic datagrams, so assign an ID to all such datagrams
// according to the definition given in RFC 6864 section 4.
if ipH.Flags()&header.IPv4FlagDontFragment == 0 || ipH.Flags()&header.IPv4FlagMoreFragments != 0 || ipH.FragmentOffset() > 0 {
ipH.SetID(uint16(e.generateID(r.LocalAddress(), r.RemoteAddress(), stack.NetworkHeaderParams{})))
ipH.SetID(e.getID())
}
}