rofl0r / rofl0r/proxychains-ng

Lack of randomness in rand()

Open
#541 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
10.7k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

rand() has a dozen issues even when you seed it with a RNG, most of which are not relevant here, but there's still at least one issue with it that is still relevant to proxychains.

If different instances of proxychains get the same result from time() or clock_gettime() and call srand(current_time) at the same time, then as long as their rand()s use the same algorithm, they will get the same result. This could be on the same machine or across different machines.

The easiest solution is to use a proper RNG.
arc4random_uniform() is present on all the BSDs, macOS, Illumos, musl, dietlibc, recent glibc, Android, recent Haiku, but not Windows. On Windows, there's the equivalent BCryptGenRandom(). On Haiku, it's tucked inside a BSD compat library that is part of the system (you still have to link to it manually because it's not libc): https://review.haiku-os.org/c/haiku/+/32/3

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the rand() and srand(current_time) call sites and reviewing how proxychains handles platform-specific builds. Check the available RNG APIs and linking requirements for each supported platform, then verify that simultaneous instances no longer produce identical results.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.