Move from libc random() to osmo_get_rand_id (2nd attempt)

When starting multiple mobile in the same second, the libc random number
generator will be seeded to exactly the same value.

The random bits inside the RACH request(s) will be exactly the same
across multiple mobile and when the channel fails they all pick the same
randomized back-off timing.

Use stronger random numbers and replace all calls to random(2) with
osmo_get_rand_id. Add a fallback to try random().

[v2: Add helper to make sure the result is int and between 0 and
RAND_MAX]

Change-Id: Icdd4be88c62bba1e9d954568e48f0c12a67ac182

8 files changed, 61 insertions, 8 deletions

diff --git a/src/host/layer23/include/osmocom/bb/common/Makefile.am b/src/host/layer23/include/osmocom/bb/common/Makefile.am
index 945c73db..cd3437e3 100644
--- a/src/host/layer23/include/osmocom/bb/common/Makefile.am
+++ b/src/host/layer23/include/osmocom/bb/common/Makefile.am
@@ -1,2 +1,2 @@
 noinst_HEADERS = l1ctl.h l1l2_interface.h l23_app.h logging.h \
-		 networks.h gps.h sysinfo.h osmocom_data.h
+		 networks.h gps.h sysinfo.h osmocom_data.h utils.h
diff --git a/src/host/layer23/include/osmocom/bb/common/utils.h b/src/host/layer23/include/osmocom/bb/common/utils.h
new file mode 100644
index 00000000..8ca61f82
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/common/utils.h
@@ -0,0 +1,3 @@
+#pragma once
+
+int layer23_random(void);
diff --git a/src/host/layer23/src/common/Makefile.am b/src/host/layer23/src/common/Makefile.am
index 71081c03..b76094c6 100644
--- a/src/host/layer23/src/common/Makefile.am
+++ b/src/host/layer23/src/common/Makefile.am
@@ -3,4 +3,4 @@ AM_CFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS) $(LIBGPS_CFLAGS)
 
 noinst_LIBRARIES = liblayer23.a
 liblayer23_a_SOURCES = l1ctl.c l1l2_interface.c sap_interface.c \
-	logging.c networks.c sim.c sysinfo.c gps.c l1ctl_lapdm_glue.c
+	logging.c networks.c sim.c sysinfo.c gps.c l1ctl_lapdm_glue.c utils.c
diff --git a/src/host/layer23/src/common/utils.c b/src/host/layer23/src/common/utils.c
new file mode 100644
index 00000000..4ecb134b
--- /dev/null
+++ b/src/host/layer23/src/common/utils.c
@@ -0,0 +1,47 @@
+/* Utilities used by mobile */
+
+/* (C) 2018 by Holger Hans Peter Freyther
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <osmocom/bb/common/utils.h>
+
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <stdlib.h>
+#include <stdint.h>
+
+
+/**
+ * A secure replacement for random(3).
+ *
+ * \return a secure random number using osmo_get_rand_id between
+ * 0 and RAND_MAX.
+ */
+int layer23_random(void)
+{
+	unsigned int r;
+
+	if (osmo_get_rand_id((uint8_t *) &r, sizeof(r)) != 0)
+		return random();
+
+	r &= ~(1U << 31);
+	r %= RAND_MAX;
+	return (int) r;
+}
diff --git a/src/host/layer23/src/mobile/gsm322.c b/src/host/layer23/src/mobile/gsm322.c
index c3485b6a..3bc8b5c8 100644
--- a/src/host/layer23/src/mobile/gsm322.c
+++ b/src/host/layer23/src/mobile/gsm322.c
@@ -31,7 +31,6 @@
 #include <osmocom/core/talloc.h>
 #include <osmocom/core/utils.h>
 #include <osmocom/gsm/gsm48.h>
-#include <osmocom/gsm/gsm_utils.h>
 #include <osmocom/core/signal.h>
 
 #include <osmocom/bb/common/logging.h>
@@ -40,6 +39,7 @@
 #include <osmocom/bb/common/networks.h>
 #include <osmocom/bb/mobile/vty.h>
 #include <osmocom/bb/mobile/app_mobile.h>
+#include <osmocom/bb/common/utils.h>
 
 #include <l1ctl_proto.h>
 
@@ -959,7 +959,7 @@ static int gsm322_sort_list(struct osmocom_ms *ms)
 			entries++;
 	}
 	while(entries) {
-		move = random() % entries;
+		move = layer23_random() % entries;
 		i = 0;
 		llist_for_each_entry(temp, &temp_list, entry) {
 			if (rxlev2dbm(temp->rxlev) > -85) {
diff --git a/src/host/layer23/src/mobile/gsm48_mm.c b/src/host/layer23/src/mobile/gsm48_mm.c
index a7af1f5c..02d861e8 100644
--- a/src/host/layer23/src/mobile/gsm48_mm.c
+++ b/src/host/layer23/src/mobile/gsm48_mm.c
@@ -41,6 +41,7 @@
 #include <osmocom/bb/mobile/app_mobile.h>
 #include <osmocom/bb/mobile/primitives.h>
 #include <osmocom/bb/mobile/vty.h>
+#include <osmocom/bb/common/utils.h>
 
 extern void *l23_ctx;
 
@@ -2099,7 +2100,7 @@ static int gsm48_mm_sysinfo(struct osmocom_ms *ms, struct msgb *msg)
 			mm->t3212.timeout.tv_sec = current_time.tv_sec
 				+ (t % s->t3212);
 		} else {
-			uint32_t rand = random();
+			uint32_t rand = layer23_random();
 
 			LOGP(DMM, LOGL_INFO, "New T3212 while timer is not "
 				"running (value %d)\n", s->t3212);
diff --git a/src/host/layer23/src/mobile/gsm48_rr.c b/src/host/layer23/src/mobile/gsm48_rr.c
index dd3fe933..c074323f 100644
--- a/src/host/layer23/src/mobile/gsm48_rr.c
+++ b/src/host/layer23/src/mobile/gsm48_rr.c
@@ -79,6 +79,7 @@
 #include <osmocom/bb/common/networks.h>
 #include <osmocom/bb/common/l1ctl.h>
 #include <osmocom/bb/mobile/vty.h>
+#include <osmocom/bb/common/utils.h>
 
 #include <l1ctl_proto.h>
 
@@ -1628,7 +1629,7 @@ fail:
 		}
 	}
 
-	chan_req = random();
+	chan_req = layer23_random();
 	chan_req &= rr->chan_req_mask;
 	chan_req |= rr->chan_req_val;
 
diff --git a/src/host/layer23/src/mobile/settings.c b/src/host/layer23/src/mobile/settings.c
index 7370b0ab..6a7cd81d 100644
--- a/src/host/layer23/src/mobile/settings.c
+++ b/src/host/layer23/src/mobile/settings.c
@@ -25,6 +25,7 @@
 #include <osmocom/core/talloc.h>
 
 #include <osmocom/bb/mobile/app_mobile.h>
+#include <osmocom/bb/common/utils.h>
 #include <osmocom/bb/common/logging.h>
 #include <osmocom/bb/common/osmocom_data.h>
 #include <osmocom/bb/common/networks.h>
@@ -184,8 +185,8 @@ int gsm_random_imei(struct gsm_settings *set)
 	if (digits > 15)
 		digits = 15;
 
-	sprintf(rand, "%08ld", random() % 100000000);
-	sprintf(rand + 8, "%07ld", random() % 10000000);
+	sprintf(rand, "%08d", layer23_random() % 100000000);
+	sprintf(rand + 8, "%07d", layer23_random() % 10000000);
 
 	strcpy(set->imei + 15 - digits, rand + 15 - digits);
 	strncpy(set->imeisv, set->imei, 15);