Use the crypto random functions instead of rand().
#1039
Conversation
There was a problem hiding this comment.
Reviewed 8 of 8 files at r1.
Reviewable status: 0 of 1 LGTMs obtained (waiting on @zugz)
There was a problem hiding this comment.
Reviewed 8 of 8 files at r1.
Reviewable status: 0 of 1 LGTMs obtained (waiting on @zugz)
There was a problem hiding this comment.
Reviewable status: 0 of 1 LGTMs obtained (waiting on @zugz)
toxcore/onion_client.c, line 270 at r2 (raw file):
} uint32_t num_nodes = (onion_c->path_nodes_index < MAX_PATH_NODES) ? onion_c->path_nodes_index : MAX_PATH_NODES;
Might as well make it const?
toxcore/onion_client.c, line 1624 at r2 (raw file):
for (j = 0; j < n; ++j) { uint32_t num = random_u32() % num_nodes;
const?
toxcore/onion_client.c, line 1744 at r2 (raw file):
if (num_nodes != 0) { for (i = 0; i < (MAX_ONION_CLIENTS_ANNOUNCE / 2); ++i) { uint32_t num = random_u32() % num_nodes;
const?
iphydf
force-pushed
the
avoid-rand
branch
2 times, most recently
from
b3d129e to
3e5d449
Compare
There was a problem hiding this comment.
Reviewable status: 0 of 1 LGTMs obtained (waiting on @zugz)
toxcore/onion_client.c, line 270 at r2 (raw file):
Previously, zugz (zugz) wrote…
Might as well make it const?
Done.
toxcore/onion_client.c, line 1624 at r2 (raw file):
Previously, zugz (zugz) wrote…
const?
Done.
toxcore/onion_client.c, line 1744 at r2 (raw file):
Previously, zugz (zugz) wrote…
const?
Done.
Presumably the uses of `rand()` were fine because they were not used in security-sensitive places, but having to think about whether a crappy RNG is acceptable in each situation requires effort that could better be spent elsewhere. Also, this means that once we have a custom deterministic RNG for testing, that RNG is used everywhere, so all the code is deterministic. It also allowed us to delete a system-specific function that wasn't used anywhere except in a call to `srand()`.
Presumably the uses of
rand()were fine because they were not used insecurity-sensitive places, but having to think about whether a crappy RNG
is acceptable in each situation requires effort that could better be
spent elsewhere.
Also, this means that once we have a custom deterministic RNG for
testing, that RNG is used everywhere, so all the code is deterministic.
It also allowed us to delete a system-specific function that wasn't used
anywhere except in a call to
srand().This change is