Subject: Re: rpc xid randomness
To: None <fvdl@netbsd.org>
From: Jun-ichiro itojun Hagino <itojun@itojun.org>
List: tech-security
Date: 09/09/2003 08:24:42
> Ok, a few points..
>
> Your changes make the *initial* XID random. The initial XID is set when
> an RPC connection is set up. The rest of the XIDs is generated by
> decrementing the initial XID.
>
> If that avoids duplication, it's fine with me, since the additional
> slow code is only used when setting up the connection; it's a one-time
> overhead that you won't really see in a benchmark such as lat_rpc
> or spray(8).
>
> However, if you mean to randomize *every* XID, this algorithm is
> way too expensive.
i changed the __RPC_GETXID(), which seems to be for initialization,
that's all. none of other code is touched.
it seems to me that the library is INCREMENTING rm_xid, rather than
decrementing. am I right?
itojun