From 9b8fc824ae3fe7176abf67fecb811dd5bdb89cda Mon Sep 17 00:00:00 2001
From: Adam Chlipala <adam@chlipala.net>
Date: Mon, 12 Jan 2015 12:02:54 -0500
Subject: Switch to using OpenSSL PRNG for the one remaining rand()

---
 src/c/urweb.c | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

(limited to 'src/c/urweb.c')

diff --git a/src/c/urweb.c b/src/c/urweb.c
index e2881b05..4a00755b 100644
--- a/src/c/urweb.c
+++ b/src/c/urweb.c
@@ -167,6 +167,19 @@ void *uw_init_client_data();
 void uw_free_client_data(void *);
 void uw_copy_client_data(void *dst, void *src);
 
+static pthread_mutex_t rand_mutex = PTHREAD_MUTEX_INITIALIZER;
+
+static uw_Basis_int my_rand() {
+  pthread_mutex_lock(&rand_mutex);
+  int r = RAND_bytes((unsigned char *)&ret, sizeof ret);
+  pthread_mutex_unlock(&rand_mutex);
+
+  if (r)
+    return abs(r);
+  else
+    return -1;
+}
+
 static client *new_client() {
   client *c;
 
@@ -192,7 +205,7 @@ static client *new_client() {
 
   pthread_mutex_lock(&c->lock);
   c->mode = USED;
-  c->pass = rand();
+  c->pass = my_rand();
   c->sock = -1;
   c->last_contact = time(NULL);
   uw_buffer_reset(&c->msgs);
@@ -4221,16 +4234,11 @@ uw_Basis_unit uw_Basis_debug(uw_context ctx, uw_Basis_string s) {
   return uw_unit_v;
 }
 
-static pthread_mutex_t rand_mutex = PTHREAD_MUTEX_INITIALIZER;
-
 uw_Basis_int uw_Basis_rand(uw_context ctx) {
-  uw_Basis_int ret;
-  pthread_mutex_lock(&rand_mutex);
-  int r = RAND_bytes((unsigned char *)&ret, sizeof ret);
-  pthread_mutex_unlock(&rand_mutex);
+  int r = my_rand();
 
-  if (r)
-    return abs(ret);
+  if (r >= 0)
+    return r;
   else
     uw_error(ctx, FATAL, "Random number generation failed");
 }
-- 
cgit v1.2.3


From 2207f580efc424d40c81d4dd98fb414e29eaa7f9 Mon Sep 17 00:00:00 2001
From: Adam Chlipala <adam@chlipala.net>
Date: Thu, 22 Jan 2015 09:46:20 -0500
Subject: Fix silly mistake from last commit; also switch away from rand() in
 openssl.c

---
 src/c/openssl.c | 10 ++++++----
 src/c/urweb.c   |  6 ++----
 2 files changed, 8 insertions(+), 8 deletions(-)

(limited to 'src/c/urweb.c')

diff --git a/src/c/openssl.c b/src/c/openssl.c
index 6a998e29..1d820a34 100644
--- a/src/c/openssl.c
+++ b/src/c/openssl.c
@@ -9,6 +9,7 @@
 #include <string.h>
 
 #include <openssl/sha.h>
+#include <openssl/rand.h>
 
 #define PASSSIZE 4
 
@@ -19,10 +20,11 @@ static int password[PASSSIZE];
 char *uw_sig_file = NULL;
 
 static void random_password() {
-  int i;
-
-  for (i = 0; i < PASSSIZE; ++i)
-    password[i] = rand();
+  if (!RAND_bytes((unsigned char *)password, sizeof password)) {
+    fprintf(stderr, "Error generating random password\n");
+    perror("RAND_bytes");
+    exit(1);
+  }
 }
 
 void uw_init_crypto() {
diff --git a/src/c/urweb.c b/src/c/urweb.c
index 4a00755b..7ad58e1d 100644
--- a/src/c/urweb.c
+++ b/src/c/urweb.c
@@ -171,11 +171,11 @@ static pthread_mutex_t rand_mutex = PTHREAD_MUTEX_INITIALIZER;
 
 static uw_Basis_int my_rand() {
   pthread_mutex_lock(&rand_mutex);
-  int r = RAND_bytes((unsigned char *)&ret, sizeof ret);
+  int ret, r = RAND_bytes((unsigned char *)&ret, sizeof ret);
   pthread_mutex_unlock(&rand_mutex);
 
   if (r)
-    return abs(r);
+    return abs(ret);
   else
     return -1;
 }
@@ -362,8 +362,6 @@ extern void uw_global_custom();
 extern void uw_init_crypto();
 
 void uw_global_init() {
-  srand(time(NULL) ^ getpid());
-
   clients = malloc(0);
 
   uw_global_custom();
-- 
cgit v1.2.3