@@ -220,6 +220,8 @@
 
 AM_CONDITIONAL(NEED_VSNPRINTF, [test x$HAVE_VSNPRINTF = xno])
 
+AC_CHECK_LIB([bsd], [arc4random_buf])
+
 dnl Check for mmap support for Xvfb
 AC_CHECK_FUNC([mmap], AC_DEFINE(HAS_MMAP, 1, [Have the 'mmap' function.]))
 

@@ -133,6 +133,9 @@
 /* Build a standalone xpbproxy */
 #undef STANDALONE_XPBPROXY
 
+/* Define to 1 if you have the `bsd' library (-lbsd). */
+#undef HAVE_LIBBSD
+
 /* Define to 1 if you have the `m' library (-lm). */
 #undef HAVE_LIBM
 
@@ -160,6 +163,9 @@
 /* Define to 1 if you have the <rpcsvc/dbm.h> header file. */
 #undef HAVE_RPCSVC_DBM_H
 
+/* Define to 1 if you have the `arc4random_buf' function. */
+#undef HAVE_ARC4RANDOM_BUF
+
 /* Define to use libc SHA1 functions */
 #undef HAVE_SHA1_IN_LIBC
 
@@ -227,6 +233,9 @@
 
 /* Define to 1 if you have the <sys/vm86.h> header file. */
 #undef HAVE_SYS_VM86_H
+
+/* Define to 1 if you have the `timingsafe_memcmp' function. */
+#undef HAVE_TIMINGSAFE_MEMCMP
 
 /* Define to 1 if you have the <tslib.h> header file. */
 #undef HAVE_TSLIB_H

@@ -495,6 +495,11 @@
 extern _X_EXPORT size_t strlcat(char *dst, const char *src, size_t siz);
 #endif
 
+#ifndef HAVE_TIMINGSAFE_MEMCMP
+extern _X_EXPORT int
+timingsafe_memcmp(const void *b1, const void *b2, size_t len);
+#endif
+
 /* Logging. */
 typedef enum _LogParameter {
     XLOG_FLUSH,

@@ -45,6 +45,9 @@
 #ifdef WIN32
 #include    <X11/Xw32defs.h>
 #endif
+#ifdef HAVE_LIBBSD
+#include   <bsd/stdlib.h>       /* for arc4random_buf() */
+#endif
 
 struct protocol {
     unsigned short   name_length;
@@ -52,7 +55,6 @@
     AuthAddCFunc	Add;	/* new authorization data */
     AuthCheckFunc	Check;	/* verify client authorization data */
     AuthRstCFunc	Reset;	/* delete all authorization data entries */
-    AuthToIDFunc	ToID;	/* convert cookie to ID */
     AuthFromIDFunc	FromID;	/* convert ID to cookie */
     AuthRemCFunc	Remove;	/* remove a specific cookie */
 #ifdef XCSECURITY
@@ -63,7 +65,7 @@
 static struct protocol   protocols[] = {
 {   (unsigned short) 18,    "MIT-MAGIC-COOKIE-1",
 		MitAddCookie,	MitCheckCookie,	MitResetCookie,
-		MitToID,	MitFromID,	MitRemoveCookie,
+		MitFromID,	MitRemoveCookie,
 #ifdef XCSECURITY
 		MitGenerateCookie
 #endif
@@ -71,7 +73,7 @@
 #ifdef HASXDMAUTH
 {   (unsigned short) 19,    "XDM-AUTHORIZATION-1",
 		XdmAddCookie,	XdmCheckCookie,	XdmResetCookie,
-		XdmToID,	XdmFromID,	XdmRemoveCookie,
+		XdmFromID,	XdmRemoveCookie,
 #ifdef XCSECURITY
 		NULL
 #endif
@@ -80,7 +82,7 @@
 #ifdef SECURE_RPC
 {   (unsigned short) 9,    "SUN-DES-1",
 		SecureRPCAdd,	SecureRPCCheck,	SecureRPCReset,
-		SecureRPCToID,	SecureRPCFromID,SecureRPCRemove,
+		SecureRPCFromID,SecureRPCRemove,
 #ifdef XCSECURITY
 		NULL
 #endif
@@ -318,11 +320,15 @@
 void
 GenerateRandomData (int len, char *buf)
 {
+#ifdef HAVE_ARC4RANDOMBUF
+    arc4random_buf(buf, len);
+#else
     int fd;
 
     fd = open("/dev/urandom", O_RDONLY);
     read(fd, buf, len);
     close(fd);
+#endif
 }
 
 #endif /* XCSECURITY */

@@ -423,31 +423,6 @@
     return 1;
 }
 
-XID
-XdmToID (unsigned short cookie_length, char *cookie)
-{
-    XdmAuthorizationPtr	auth;
-    XdmClientAuthPtr	client;
-    unsigned char	*plain;
-
-    plain = malloc(cookie_length);
-    if (!plain)
-	return (XID) -1;
-    for (auth = xdmAuth; auth; auth=auth->next) {
-	XdmcpUnwrap ((unsigned char *)cookie, (unsigned char *)&auth->key, plain, cookie_length);
-	if ((client = XdmAuthorizationValidate (plain, cookie_length, &auth->rho, NULL, NULL)) != NULL)
-	{
-	    free(client);
-	    free(cookie);
-	    free(plain);
-	    return auth->id;
-	}
-    }
-    free(cookie);
-    free(plain);
-    return (XID) -1;
-}
-
 int
 XdmFromID (XID id, unsigned short *data_lenp, char **datap)
 {

@@ -82,7 +82,7 @@
 
     for (auth = mit_auth; auth; auth=auth->next) {
         if (data_length == auth->len &&
-	   memcmp (data, auth->data, (int) data_length) == 0)
+	   timingsafe_memcmp(data, auth->data, (int) data_length) == 0)
 	    return auth->id;
     }
     *reason = "Invalid MIT-MAGIC-COOKIE-1 key";
@@ -101,21 +101,6 @@
     }
     mit_auth = 0;
     return 0;
-}
-
-XID
-MitToID (
-	unsigned short	data_length,
-	char		*data)
-{
-    struct auth	*auth;
-
-    for (auth = mit_auth; auth; auth=auth->next) {
-	if (data_length == auth->len &&
-	    memcmp (data, auth->data, data_length) == 0)
-	    return auth->id;
-    }
-    return (XID) -1;
 }
 
 int

@@ -158,9 +158,6 @@
 #define AuthRstCArgs void
 typedef int (*AuthRstCFunc) (AuthRstCArgs);
 
-#define AuthToIDArgs unsigned short data_length, char *data
-typedef XID (*AuthToIDFunc) (AuthToIDArgs);
-
 typedef void (*OsCloseFunc)(ClientPtr);
 
 typedef int (*OsFlushFunc)(ClientPtr who, struct _osComm * oc, char* extraBuf, int extraCount);
@@ -227,7 +224,6 @@
 /* in mitauth.c */
 extern XID  MitCheckCookie    (AuthCheckArgs);
 extern XID  MitGenerateCookie (AuthGenCArgs);
-extern XID  MitToID           (AuthToIDArgs);
 extern int  MitAddCookie      (AuthAddCArgs);
 extern int  MitFromID         (AuthFromIDArgs);
 extern int  MitRemoveCookie   (AuthRemCArgs);
@@ -236,7 +232,6 @@
 /* in xdmauth.c */
 #ifdef HASXDMAUTH
 extern XID  XdmCheckCookie    (AuthCheckArgs);
-extern XID  XdmToID           (AuthToIDArgs);
 extern int  XdmAddCookie      (AuthAddCArgs);
 extern int  XdmFromID         (AuthFromIDArgs);
 extern int  XdmRemoveCookie   (AuthRemCArgs);
@@ -247,7 +242,6 @@
 #ifdef SECURE_RPC
 extern void SecureRPCInit     (AuthInitArgs);
 extern XID  SecureRPCCheck    (AuthCheckArgs);
-extern XID  SecureRPCToID     (AuthToIDArgs);
 extern int  SecureRPCAdd      (AuthAddCArgs);
 extern int  SecureRPCFromID   (AuthFromIDArgs);
 extern int  SecureRPCRemove   (AuthRemCArgs);

@@ -177,12 +177,6 @@
     return 1;
 }
 
-_X_HIDDEN XID
-SecureRPCToID (unsigned short data_length, char *data)
-{
-    return rpc_id;
-}
-
 _X_HIDDEN int
 SecureRPCFromID (XID id, unsigned short *data_lenp, char **datap)
 {

@@ -134,6 +134,9 @@
 /* Build a standalone xpbproxy */
 /* #undef STANDALONE_XPBPROXY */
 
+/* Define to 1 if you have the `bsd' library (-lbsd). */
+/* #undef HAVE_LIBBSD */
+
 /* Define to 1 if you have the `m' library (-lm). */
 #define HAVE_LIBM 1
 
@@ -161,6 +164,9 @@
 /* Define to 1 if you have the <rpcsvc/dbm.h> header file. */
 /* #undef HAVE_RPCSVC_DBM_H */
 
+/* Define to 1 if you have the `arc4random_buf' function. */
+#define HAVE_ARC4RANDOM_BUF 1
+
 /* Define to use libc SHA1 functions */
 #define HAVE_SHA1_IN_LIBC 1
 
@@ -228,6 +234,9 @@
 
 /* Define to 1 if you have the <sys/vm86.h> header file. */
 /* #undef HAVE_SYS_VM86_H */
+
+/* Define to 1 if you have the `timingsafe_memcmp' function. */
+/* #undef HAVE_TIMINGSAFE_MEMCMP */
 
 /* Define to 1 if you have the <tslib.h> header file. */
 /* #undef HAVE_TSLIB_H */

@@ -532,6 +532,11 @@
 extern void ddxGiveUp(void);
 extern int TimeSinceLastInputEvent(void);
 
+#ifndef HAVE_TIMINGSAFE_MEMCMP
+extern int
+timingsafe_memcmp(const void *b1, const void *b2, size_t len);
+#endif
+
 /* Logging. */
 typedef enum _LogParameter {
     XLOG_FLUSH,

@@ -50,6 +50,9 @@
 #ifdef WIN32
 #include "Xw32defs.h"
 #endif
+#ifdef HAVE_LIBBSD
+#include   <bsd/stdlib.h>       /* for arc4random_buf() */
+#endif
 
 struct protocol {
     unsigned short   name_length;
@@ -57,7 +60,6 @@
     AuthAddCFunc	Add;	/* new authorization data */
     AuthCheckFunc	Check;	/* verify client authorization data */
     AuthRstCFunc	Reset;	/* delete all authorization data entries */
-    AuthToIDFunc	ToID;	/* convert cookie to ID */
     AuthFromIDFunc	FromID;	/* convert ID to cookie */
     AuthRemCFunc	Remove;	/* remove a specific cookie */
 #ifdef XCSECURITY
@@ -68,7 +70,7 @@
 static struct protocol   protocols[] = {
 {   (unsigned short) 18,    "MIT-MAGIC-COOKIE-1",
 		MitAddCookie,	MitCheckCookie,	MitResetCookie,
-		MitToID,	MitFromID,	MitRemoveCookie,
+		MitFromID,	MitRemoveCookie,
 #ifdef XCSECURITY
 		MitGenerateCookie
 #endif
@@ -76,7 +78,7 @@
 #ifdef HASXDMAUTH
 {   (unsigned short) 19,    "XDM-AUTHORIZATION-1",
 		XdmAddCookie,	XdmCheckCookie,	XdmResetCookie,
-		XdmToID,	XdmFromID,	XdmRemoveCookie,
+		XdmFromID,	XdmRemoveCookie,
 #ifdef XCSECURITY
 		NULL
 #endif
@@ -85,7 +87,7 @@
 #ifdef SECURE_RPC
 {   (unsigned short) 9,    "SUN-DES-1",
 		SecureRPCAdd,	SecureRPCCheck,	SecureRPCReset,
-		SecureRPCToID,	SecureRPCFromID,SecureRPCRemove,
+		SecureRPCFromID,SecureRPCRemove,
 #ifdef XCSECURITY
 		NULL
 #endif
@@ -94,7 +96,7 @@
 #ifdef K5AUTH
 {   (unsigned short) 14, "MIT-KERBEROS-5",
 		K5Add, K5Check, K5Reset,
-		K5ToID, K5FromID, K5Remove,
+		K5FromID, K5Remove,
 #ifdef XCSECURITY
 		NULL
 #endif
@@ -104,7 +106,7 @@
 {   (unsigned short) XSecurityAuthorizationNameLen,
 	XSecurityAuthorizationName,
 		NULL, AuthSecurityCheck, NULL,
-		NULL, NULL, NULL,
+		NULL, NULL,
 		NULL
 },
 #endif
@@ -252,26 +254,6 @@
 	if (protocols[i].Reset)
 	    (*protocols[i].Reset)();
     ShouldLoadAuth = TRUE;
-}
-
-XID
-AuthorizationToID (
-	unsigned short	name_length,
-	char		*name,
-	unsigned short	data_length,
-	char		*data)
-{
-    int	i;
-
-    for (i = 0; i < NUM_AUTHORIZATION; i++) {
-    	if (protocols[i].name_length == name_length &&
-	    memcmp (protocols[i].name, name, (int) name_length) == 0 &&
-	    protocols[i].ToID)
-    	{
-	    return (*protocols[i].ToID) (data_length, data);
-    	}
-    }
-    return (XID) ~0L;
 }
 
 int

@@ -80,7 +80,7 @@
 
     for (auth = mit_auth; auth; auth=auth->next) {
         if (data_length == auth->len &&
-	   memcmp (data, auth->data, (int) data_length) == 0)
+	   timingsafe_memcmp(data, auth->data, (int) data_length) == 0)
 	    return auth->id;
     }
     *reason = "Invalid MIT-MAGIC-COOKIE-1 key";
@@ -99,21 +99,6 @@
     }
     mit_auth = 0;
     return 0;
-}
-
-XID
-MitToID (
-	unsigned short	data_length,
-	char		*data)
-{
-    struct auth	*auth;
-
-    for (auth = mit_auth; auth; auth=auth->next) {
-	if (data_length == auth->len &&
-	    memcmp (data, auth->data, data_length) == 0)
-	    return auth->id;
-    }
-    return (XID) -1;
 }
 
 int

@@ -181,9 +181,6 @@
 #define AuthRstCArgs void
 typedef int (*AuthRstCFunc) (AuthRstCArgs);
 
-#define AuthToIDArgs unsigned short data_length, char *data
-typedef XID (*AuthToIDFunc) (AuthToIDArgs);
-
 typedef void (*OsCloseFunc)(ClientPtr);
 
 typedef int (*OsFlushFunc)(ClientPtr who, struct _osComm * oc, char* extraBuf, int extraCount);
@@ -269,7 +266,6 @@
 /* in mitauth.c */
 extern XID  MitCheckCookie    (AuthCheckArgs);
 extern XID  MitGenerateCookie (AuthGenCArgs);
-extern XID  MitToID           (AuthToIDArgs);
 extern int  MitAddCookie      (AuthAddCArgs);
 extern int  MitFromID         (AuthFromIDArgs);
 extern int  MitRemoveCookie   (AuthRemCArgs);
@@ -278,7 +274,6 @@
 /* in xdmauth.c */
 #ifdef HASXDMAUTH
 extern XID  XdmCheckCookie    (AuthCheckArgs);
-extern XID  XdmToID           (AuthToIDArgs);
 extern int  XdmAddCookie      (AuthAddCArgs);
 extern int  XdmFromID         (AuthFromIDArgs);
 extern int  XdmRemoveCookie   (AuthRemCArgs);
@@ -289,7 +284,6 @@
 #ifdef SECURE_RPC
 extern void SecureRPCInit     (AuthInitArgs);
 extern XID  SecureRPCCheck    (AuthCheckArgs);
-extern XID  SecureRPCToID     (AuthToIDArgs);
 extern int  SecureRPCAdd      (AuthAddCArgs);
 extern int  SecureRPCFromID   (AuthFromIDArgs);
 extern int  SecureRPCRemove   (AuthRemCArgs);

@@ -184,12 +184,6 @@
     return 1;
 }
 
-XID
-SecureRPCToID (unsigned short data_length, char *data)
-{
-    return rpc_id;
-}
-
 int
 SecureRPCFromID (XID id, unsigned short *data_lenp, char **datap)
 {

@@ -422,32 +422,6 @@
     return 1;
 }
 
-XID
-XdmToID (unsigned short cookie_length, char *cookie)
-{
-    XdmAuthorizationPtr	auth;
-    XdmClientAuthPtr	client;
-    unsigned char	*plain;
-
-    plain = (unsigned char *) xalloc (cookie_length);
-    if (!plain)
-	return (XID) -1;
-    for (auth = xdmAuth; auth; auth=auth->next) {
-	XdmcpUnwrap ((unsigned char *)cookie, (unsigned char *)&auth->key,
-		     plain, cookie_length);
-	client = XdmAuthorizationValidate (plain, cookie_length, &auth->rho,
-					   NULL, NULL);
-	if (client != NULL)
-	{
-	    xfree (client);
-	    xfree (cookie);
-	    return auth->id;
-	}
-    }
-    xfree (cookie);
-    return (XID) -1;
-}
-
 int
 XdmFromID (XID id, unsigned short *data_lenp, char **datap)
 {