diff -Naur uClibc-20050202.orig/extra/Configs/Config.in uClibc-20050202/extra/Configs/Config.in --- uClibc-20050202.orig/extra/Configs/Config.in 2005-02-06 11:37:22.839917136 +0000 +++ uClibc-20050202/extra/Configs/Config.in 2005-02-08 15:54:54.237781544 +0000 @@ -1109,6 +1109,30 @@ libraries have to be built with -fPIC or -fpic, and all assembler functions must be written as position independent code (PIC). +config UCLIBC_HAS_ARC4RANDOM + bool "Add the arc4random() function to the library" + depends on UCLIBC_SECURITY + default n + help + Answer Y to support the OpenBSD-like arc4random() function. + Arc4random initializes gettimeofday(2) for a seed value and tries to + use /dev/urandom to overwrite that value. Arc4random uses the seed to + produce high quality 32-bit pseudo-random numbers. This function is + supposed to be more dependable than invoking /dev/urandom directly. + OpenSSL and OpenNTPD currently support this function. + Most people will answer N. + +config ARC4RANDOM_USE_ERANDOM + bool "Make arc4random() use sysctl erandom if /dev/urandom fails" + depends on UCLIBC_SECURITY + depends on UCLIBC_HAS_ARC4RANDOM + default n + help + Answer Y to use sysctl erandom only if /dev/urandom fails (chroot). + This requires a modified kernel. + For more info see: http://frandom.sourceforge.net/. + Most people will answer N. + config UCLIBC_HAS_SSP bool "Support for propolice stack protection" depends on UCLIBC_SECURITY diff -Naur uClibc-20050202.orig/include/stdlib.h uClibc-20050202/include/stdlib.h --- uClibc-20050202.orig/include/stdlib.h 2005-02-06 11:37:23.071649872 +0000 +++ uClibc-20050202/include/stdlib.h 2005-02-08 16:27:31.578730192 +0000 @@ -450,7 +450,15 @@ extern int lcong48_r (unsigned short int __param[7], struct drand48_data *__buffer) __THROW; # endif /* Use misc. */ -#endif /* Use SVID or X/Open. */ + +/* Arcfour */ +#if defined __UCLIBC_HAS_ARC4RANDOM__ +u_int32_t arc4random(void); +void arc4random_stir(void); +void arc4random_addrandom(unsigned char *, int); +#endif + +#endif /* Use SVID, X/Open, or __USE_BSD. */ #endif /* don't just need malloc and calloc */ diff -Naur uClibc-20050202.orig/libc/stdlib/Makefile uClibc-20050202/libc/stdlib/Makefile --- uClibc-20050202.orig/libc/stdlib/Makefile 2005-02-06 11:37:23.372303120 +0000 +++ uClibc-20050202/libc/stdlib/Makefile 2005-02-08 15:21:31.822552584 +0000 @@ -90,6 +90,10 @@ ifeq ($(UCLIBC_HAS_FLOATS),y) CSRC += drand48.c drand48_r.c erand48.c erand48_r.c endif +ifeq ($(UCLIBC_HAS_ARC4RANDOM),y) + CSRC += arc4random.c +endif + COBJS=$(patsubst %.c,%.o, $(CSRC)) OBJS=$(MOBJ) $(MOBJx) $(MOBJ1) $(MOBJ1x) $(MOBJ2) $(COBJS) diff -Naur uClibc-20050202.orig/libc/stdlib/arc4random.c uClibc-20050202/libc/stdlib/arc4random.c --- uClibc-20050202.orig/libc/stdlib/arc4random.c 1970-01-01 00:00:00.000000000 +0000 +++ uClibc-20050202/libc/stdlib/arc4random.c 2005-02-08 15:47:29.449438680 +0000 @@ -0,0 +1,209 @@ +/* You_see_lib_see: arc4random.c,v 1.0 2005/02/08 robert */ +/* $NetBSD: arc4random.c,v 1.5.2.1 2004/03/26 22:52:50 jmc Exp $ */ +/* $OpenBSD: arc4random.c,v 1.6 2001/06/05 05:05:38 pvalchev Exp $ */ + +/* + * Arc4 random number generator for OpenBSD. + * Copyright 1996 David Mazieres . + * + * Modification and redistribution in source and binary forms is + * permitted provided that due credit is given to the author and the + * OpenBSD project by leaving this copyright notice intact. + */ + +/* + * This code is derived from section 17.1 of Applied Cryptography, + * second edition, which describes a stream cipher allegedly + * compatible with RSA Labs "RC4" cipher (the actual description of + * which is a trade secret). The same algorithm is used as a stream + * cipher called "arcfour" in Tatu Ylonen's ssh package. + * + * Here the stream cipher has been modified always to include the time + * when initializing the state. That makes it impossible to + * regenerate the same random sequence twice, so this can't be used + * for encryption, but will generate good random numbers. + * + * RC4 is a registered trademark of RSA Laboratories. + */ + +#include +#include +#include +#include +#include +#include +#ifdef __ARC4RANDOM_USE_ERANDOM__ +#include +#endif + +#ifdef __GNUC__ +#define inline __inline +#else /* !__GNUC__ */ +#define inline +#endif /* !__GNUC__ */ + +struct arc4_stream { + u_int8_t i; + u_int8_t j; + u_int8_t s[256]; +}; + +int rs_initialized; +static struct arc4_stream rs; + +static inline void arc4_init(struct arc4_stream *); +static inline void arc4_addrandom(struct arc4_stream *, u_char *, int); +static void arc4_stir(struct arc4_stream *); +static inline u_int8_t arc4_getbyte(struct arc4_stream *); +static inline u_int32_t arc4_getword(struct arc4_stream *); + +static inline void +arc4_init(as) + struct arc4_stream *as; +{ + int n; + + for (n = 0; n < 256; n++) + as->s[n] = n; + as->i = 0; + as->j = 0; +} + +static inline void +arc4_addrandom(as, dat, datlen) + struct arc4_stream *as; + u_char *dat; + int datlen; +{ + int n; + u_int8_t si; + + as->i--; + for (n = 0; n < 256; n++) { + as->i = (as->i + 1); + si = as->s[as->i]; + as->j = (as->j + si + dat[n % datlen]); + as->s[as->i] = as->s[as->j]; + as->s[as->j] = si; + } + as->j = as->i; +} + +static void +arc4_stir(as) + struct arc4_stream *as; +{ + int fd; + struct { + struct timeval tv; + u_int rnd[(128 - sizeof(struct timeval)) / sizeof(u_int)]; + } rdat; + int n; + + gettimeofday(&rdat.tv, NULL); + fd = open("/dev/urandom", O_RDONLY); + if (fd != -1) { + read(fd, rdat.rnd, sizeof(rdat.rnd)); + close(fd); + } +#ifdef __ARC4RANDOM_USE_ERANDOM__ + else { + int mib[3]; + u_int i; + size_t len; + + /* Device could not be opened, we might be chrooted, take + * randomness from sysctl. */ + + mib[0] = CTL_KERN; + mib[1] = KERN_RANDOM; + mib[2] = RANDOM_ERANDOM; + + for (i = 0; i < sizeof(rdat.rnd) / sizeof(u_int); i++) { + len = sizeof(u_int); + if (sysctl(mib, 3, &rdat.rnd[i], &len, NULL, 0) == -1) + break; + } + } +#endif + + arc4_addrandom(as, (void *) &rdat, sizeof(rdat)); + + /* + * Throw away the first N words of output, as suggested in the + * paper "Weaknesses in the Key Scheduling Algorithm of RC4" + * by Fluher, Mantin, and Shamir. + * http://www.wisdom.weizmann.ac.il/~itsik/RC4/Papers/Rc4_ksa.ps + * N = 256 in our case. + */ + for (n = 0; n < 256 * 4; n++) + arc4_getbyte(as); +} + +static inline u_int8_t +arc4_getbyte(as) + struct arc4_stream *as; +{ + u_int8_t si, sj; + + as->i = (as->i + 1); + si = as->s[as->i]; + as->j = (as->j + si); + sj = as->s[as->j]; + as->s[as->i] = sj; + as->s[as->j] = si; + return (as->s[(si + sj) & 0xff]); +} + +static inline u_int32_t +arc4_getword(as) + struct arc4_stream *as; +{ + u_int32_t val; + val = arc4_getbyte(as) << 24; + val |= arc4_getbyte(as) << 16; + val |= arc4_getbyte(as) << 8; + val |= arc4_getbyte(as); + return val; +} + +void +arc4random_stir() +{ + if (!rs_initialized) { + arc4_init(&rs); + rs_initialized = 1; + } + arc4_stir(&rs); +} + +void +arc4random_addrandom(dat, datlen) + u_char *dat; + int datlen; +{ + if (!rs_initialized) + arc4random_stir(); + arc4_addrandom(&rs, dat, datlen); +} + +u_int32_t +arc4random() +{ + if (!rs_initialized) + arc4random_stir(); + return arc4_getword(&rs); +} + +#if 0 +/*-------- Test code --------*/ +#include +#include + +int main(void) { + int random_number; + random_number = arc4random() % 65536; + printf("%d\n", random_number); + return 0; +} +#endif