Change rand(), random(), drand48(), lrand48(), mrand48(), and srand48()

to returning strong random by default, source from arc4random(3).
Parameters to the seeding functions are ignored, and the subsystems remain
in strong random mode.  If you wish the standardized deterministic mode,
call srand_deterministic(), srandom_determistic(), srand48_deterministic(),
seed48_deterministic() or lcong48_deterministic() instead.
The re-entrant functions rand_r(), erand48(), nrand48(), jrand48() are
unaffected by this change and remain in deterministic mode (for now).

Verified as a good roadmap forward by auditing 8800 pieces of software.
Roughly 60 pieces of software will need adaptation to request the
deterministic mode.

Violates POSIX and C89, which violate best practice in this century.
ok guenther tedu millert

1 files changed, 49 insertions, 27 deletions

diff --git a/src/lib/libc/stdlib/rand.3 b/src/lib/libc/stdlib/rand.3
index 5d4bfe7ab6..c760161ba7 100644
--- a/src/lib/libc/stdlib/rand.3
+++ b/src/lib/libc/stdlib/rand.3
@@ -29,52 +29,65 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"     $OpenBSD: rand.3,v 1.17 2014/11/25 17:41:12 millert Exp $
+.\"     $OpenBSD: rand.3,v 1.18 2014/12/08 21:45:20 deraadt Exp $
 .\"
-.Dd $Mdocdate: November 25 2014 $
+.Dd $Mdocdate: December 8 2014 $
 .Dt RAND 3
 .Os
 .Sh NAME
 .Nm rand ,
 .Nm rand_r ,
-.Nm srand
+.Nm srand ,
+.Nm srand_deterministic
 .Nd bad pseudo-random number generator
 .Sh SYNOPSIS
 .In stdlib.h
 .Ft void
 .Fn srand "unsigned int seed"
+.Ft void
+.Fn srand_deterministic "unsigned int seed"
 .Ft int
 .Fn rand void
 .Ft int
 .Fn rand_r "unsigned int *seed"
 .Sh DESCRIPTION
 .Bf -symbolic
-These interfaces are obsoleted by
-.Xr random 3 ,
-which is also unsafe.
-Consider using
-.Xr arc4random 3 .
+Standards insist that this interface return deterministic results.
+Unsafe usage is very common, so
+.Ox
+changed the subsystem to return non-deterministic results by default.
 .Ef
 .Pp
-The
+To satisfy portable code,
+.Fn srand
+may be called to initialize the subsystem.
+In
+.Ox
+the
+.Ar seed
+variable is ignored, and strong random number results will be provided from
+.Xr arc4random 3.
+In other systems, the
+.Ar seed
+variable primes a simplistic deterministic algorithm.
+.Pp
+If the standardized behavior is required
+.Fn srand_deterministic
+can be substituted for
+.Fn srand ,
+then subsequent
 .Fn rand
-function computes a sequence of pseudo-random integers in the range
-of 0 to
-.Dv RAND_MAX
-(as defined by the header file
-.In stdlib.h ) .
+calls will return results using the deterministic algorithm.
 .Pp
 The
-.Fn srand
-function sets its argument as the seed for a new sequence of
-pseudo-random numbers to be returned by
-.Fn rand .
-These sequences are repeatable by calling
-.Fn srand
-with the same seed value.
-.Pp
-If no seed value is provided, the functions are automatically
-seeded with a value of 1.
+.Fn rand
+function returns a result in the range of 0 to
+.Dv RAND_MAX .
+By default, this result comes from
+.Xr arc4random 3 .
+If
+.Fn srand_deterministic
+was called, the result will be computed using the deterministic algorithm.
 .Pp
 The
 .Fn rand_r
@@ -83,6 +96,7 @@ is a thread-safe version of
 Storage for the seed must be provided through the
 .Fa seed
 argument, and needs to have been initialized by the caller.
+It always operates using the deterministic algorithm.
 .Sh SEE ALSO
 .Xr arc4random 3 ,
 .Xr rand48 3 ,
@@ -90,15 +104,23 @@ argument, and needs to have been initialized by the caller.
 .Sh STANDARDS
 The
 .Fn rand
-and
-.Fn srand
-functions conform to
+function conforms to
 .St -ansiC .
 .Pp
 The
 .Fn rand_r
 function conforms to
 .St -p1003.1-2008 .
+.Pp
+The
+.Fn srand
+function does not conform to
+.St -ansiC ,
+intentionally.
+.Pp
+The
+.Fn srand_deterministic
+function is an OpenBSD extension.
 .Sh HISTORY
 The functions
 .Fn rand