Update cupsGetRand and cupsOAuthMakeBase64Random to use OpenSSL/GNUTLS random functions.

Author: michaelrsweet

CHANGES.md

@@ -23,6 +23,8 @@ v3.0.4 - YYYY-MM-DD
 - Updated `ippeveprinter` to add a date/time stamp when logging to a file.
 - Updated dateTime parsing in IPP files.
 - Updated the HTTP implementation to reduce stack usage.
+- Updated `cupsGetRand` and `cupsOAuthMakeBase64Random` to use better random
+  data, when available.
 - Now explicitly validate IPP attribute names as keyword strings.
 - Fixed `httpGetDateString` with bad date/time values (Issue #167)
 - Fixed a potential buffer overflow in `cupsDNSSDAssembleFullName` on Windows

cups/oauth.c

@@ -1726,9 +1726,18 @@ cupsOAuthMakeBase64Random(size_t len)	// I - Number of bytes
     len = sizeof(bytes);
 
   // Fill out random bytes and convert it to Base64URL...
-  for (i = 0; i < len; i ++)
-    bytes[i] = (char)cupsGetRand();
+#ifdef HAVE_OPENSSL
+  if (RAND_bytes((unsigned char *)bytes, (int)len) < 0)
+#  else
+  if (gnutls_rnd(GNUTLS_RND_NONCE, bytes, len) != 0)
+#  endif // HAVE_OPENSSL
+  {
+    // TLS library random number generator failed, use the backup generator...
+    for (i = 0; i < len; i ++)
+      bytes[i] = (char)cupsGetRand();
+  }
 
+  // Base64URL-encode the bytes...
   httpEncode64(base64url, sizeof(base64url), bytes, len, /*url*/true);
 
   // Copy and return the random string...

cups/rand.c

@@ -40,7 +40,6 @@ cupsGetRand(void)
   return (arc4random());
 
 #else
-  // Use a Mersenne twister random number generator seeded from /dev/urandom...
   unsigned	i,			// Looping var
 		temp;			// Temporary value
   static bool	first_time = true;	// First time we ran?
@@ -50,6 +49,17 @@ cupsGetRand(void)
 					// Mutex to control access to state
 
 
+  // Try getting random data from the TLS library...
+#  ifdef HAVE_OPENSSL
+  if (RAND_bytes(&i, (int)sizeof(i)) > 0)
+    return (i);
+
+#  else
+  if (gnutls_rnd(GNUTLS_RND_NONCE, &i, sizeof(i)) == 0)
+    return (i);
+#  endif // HAVE_OPENSSL
+
+  // Fall back to a Mersenne twister random number generator seeded from /dev/urandom...
   pthread_mutex_lock(&mt_mutex);
 
   if (first_time)