use a random number from /dev/urandom (nbase.get_random_uint wrapper)

nse_main.lua

@@ -95,12 +95,7 @@ local open = io.open;
 
 local math = require "math";
 local max = math.max;
-
--- Due to heap randomization (on most Operating Systems), we can use a
--- Lua function address as a good seed for the C srand function. If there
--- is no heap randomization, it's still a decently random integer; that is,
--- it's no better or worse than os.time().
-math.randomseed(tonumber(tostring(function() end):match("function: (0x%x+)")));
+local randomseed = math.randomseed;
 
 local package = require "package";
 
@@ -129,6 +124,11 @@ do -- Append the nselib directory to the Lua search path
   package.path = path.."?.lua;"..package.path;
 end
 
+-- Set the math.randomseed value in nse_main.lua on behalf of scripts.
+-- Since Lua uses the C rand and srand functions, which have a static
+-- seed for the entire program, we don't want scripts doing this themselves.
+math.randomseed(nmap.get_random_uint());
+
 local script_database_type, script_database_path =
     cnse.fetchfile_absolute(cnse.script_dbpath);
 local script_database_update = cnse.scriptupdatedb;

nse_nmaplib.cc

@@ -8,6 +8,7 @@ extern "C" {
 #include <math.h>
 
 #include "nmap.h"
+#include "nbase.h"
 #include "nmap_error.h"
 #include "NmapOps.h"
 #include "Target.h"
@@ -753,6 +754,12 @@ static int l_get_interface (lua_State *L)
   return 1;
 }
 
+static int l_get_random_uint (lua_State *L)
+{
+  lua_pushnumber(L, (lua_Number) get_random_uint());
+  return 1;
+}
+
 int luaopen_nmap (lua_State *L)
 {
   static const luaL_reg nmaplib [] = {
@@ -780,6 +787,7 @@ int luaopen_nmap (lua_State *L)
     {"address_family", l_address_family},
     {"get_interface", l_get_interface},
     {"get_interface_info", l_dnet_get_interface_info},
+    {"get_random_uint", l_get_random_uint},
     {NULL, NULL}
   };