rofl0r / rofl0r/proxychains-ng
Lack of randomness in rand()
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 10.7k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
rand() has a dozen issues even when you seed it with a RNG, most of which are not relevant here, but there's still at least one issue with it that is still relevant to proxychains.
If different instances of proxychains get the same result from time() or clock_gettime() and call srand(current_time) at the same time, then as long as their rand()s use the same algorithm, they will get the same result. This could be on the same machine or across different machines.
The easiest solution is to use a proper RNG.
arc4random_uniform() is present on all the BSDs, macOS, Illumos, musl, dietlibc, recent glibc, Android, recent Haiku, but not Windows. On Windows, there's the equivalent BCryptGenRandom(). On Haiku, it's tucked inside a BSD compat library that is part of the system (you still have to link to it manually because it's not libc): https://review.haiku-os.org/c/haiku/+/32/3
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the rand() and srand(current_time) call sites and reviewing how proxychains handles platform-specific builds. Check the available RNG APIs and linking requirements for each supported platform, then verify that simultaneous instances no longer produce identical results.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100