RFC 4861 specifies ReachableTime "should be a uniformly distributed
random value between MIN_RANDOM_FACTOR and MAX_RANDOM_FACTOR times
BaseReachableTime milliseconds." I think the author intended to do the
multiplication by (x>>10) outside the mask, but it's still missing a -1.
- Matthew Martin
diff --git nd6.h nd6.h
index 4274cd4dd07..8eea089a40c 100644
--- nd6.h
+++ nd6.h
@@ -162,8 +162,8 @@ struct llinfo_nd6 {
#define MIN_RANDOM_FACTOR 512 /* 1024 * 0.5 */
#define MAX_RANDOM_FACTOR 1536 /* 1024 * 1.5 */
#define ND_COMPUTE_RTIME(x) \
- (((MIN_RANDOM_FACTOR * (x >> 10)) + (arc4random() & \
- ((MAX_RANDOM_FACTOR - MIN_RANDOM_FACTOR) * (x >> 10)))) /1000)
+ (((arc4random() & (MAX_RANDOM_FACTOR - MIN_RANDOM_FACTOR - 1)) \
+ + MIN_RANDOM_FACTOR) * (x >> 10) / 1000)
TAILQ_HEAD(nd_drhead, nd_defrouter);
struct nd_defrouter {
