added API for random number generators, served through credential factory

ported randomizer_t to a rng_t on top of /dev/(u)random (plugin random)

src/charon/sa/ike_sa.h

@@ -38,7 +38,6 @@ typedef struct ike_sa_t ike_sa_t;
 #include <sa/ike_sa_id.h>
 #include <sa/child_sa.h>
 #include <sa/tasks/task.h>
-#include <utils/randomizer.h>
 #include <crypto/prfs/prf.h>
 #include <crypto/crypters/crypter.h>
 #include <crypto/signers/signer.h>

src/charon/sa/ike_sa_manager.c

@@ -142,9 +142,9 @@ struct private_ike_sa_manager_t {
 	 linked_list_t *ike_sa_list;
 	 
 	 /**
-	  * A randomizer, to get random SPIs for our side
+	  * RNG to get random SPIs for our side
 	  */
-	 randomizer_t *randomizer;
+	 rng_t *rng;
 	 
 	 /**
 	  * SHA1 hasher for IKE_SA_INIT retransmit detection
@@ -304,8 +304,7 @@ static u_int64_t get_next_spi(private_ike_sa_manager_t *this)
 {
 	u_int64_t spi;
 	
-	this->randomizer->get_pseudo_random_bytes(this->randomizer, sizeof(spi),
-											  (u_int8_t*)&spi);
+	this->rng->get_bytes(this->rng, sizeof(spi), (u_int8_t*)&spi);
 	return spi;
 }
 
@@ -933,7 +932,7 @@ static void destroy(private_ike_sa_manager_t *this)
 	this->ike_sa_list->destroy_function(this->ike_sa_list, (void*)entry_destroy);
 	pthread_mutex_unlock(&(this->mutex));
 	
-	this->randomizer->destroy(this->randomizer);
+	this->rng->destroy(this->rng);
 	this->hasher->destroy(this->hasher);
 	
 	free(this);
@@ -968,9 +967,16 @@ ike_sa_manager_t *ike_sa_manager_create()
 		free(this);
 		return NULL;
 	}
+	this->rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
+	if (this->rng == NULL)
+	{
+		DBG1(DBG_MGR, "manager initialization failed, no RNG supported");
+		this->hasher->destroy(this->hasher);
+		free(this);
+		return NULL;
+	}
 	this->ike_sa_list = linked_list_create();
 	pthread_mutex_init(&this->mutex, NULL);
-	this->randomizer = randomizer_create();
 	return &this->public;
 }
 

src/charon/sa/tasks/child_create.c

@@ -136,17 +136,16 @@ static status_t get_nonce(message_t *message, chunk_t *nonce)
  */
 static status_t generate_nonce(chunk_t *nonce)
 {
-	status_t status;
-	randomizer_t *randomizer = randomizer_create();
+	rng_t *rng;
 	
-	status = randomizer->allocate_pseudo_random_bytes(randomizer, NONCE_SIZE,
-													  nonce);
-	randomizer->destroy(randomizer);
-	if (status != SUCCESS)
+	rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
+	if (!rng)
 	{
-		DBG1(DBG_IKE, "error generating random nonce value");
+		DBG1(DBG_IKE, "error generating nonce value, no RNG found");
 		return FAILED;
 	}
+	rng->allocate_bytes(rng, NONCE_SIZE, nonce);
+	rng->destroy(rng);
 	return SUCCESS;
 }
 

src/charon/sa/tasks/ike_init.c

@@ -218,8 +218,7 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
  */
 static status_t build_i(private_ike_init_t *this, message_t *message)
 {
-	randomizer_t *randomizer;
-	status_t status;
+	rng_t *rng;
 	
 	this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 	SIG(IKE_UP_START, "initiating IKE_SA '%s' to %H",
@@ -249,15 +248,14 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
 	/* generate nonce only when we are trying the first time */
 	if (this->my_nonce.ptr == NULL)
 	{
-		randomizer = randomizer_create();
-		status = randomizer->allocate_pseudo_random_bytes(randomizer, NONCE_SIZE,
-														  &this->my_nonce);
-		randomizer->destroy(randomizer);
-		if (status != SUCCESS)
+		rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
+		if (!rng)
 		{
-			SIG(IKE_UP_FAILED, "error generating random nonce value");
+			SIG(IKE_UP_FAILED, "error generating nonce");
 			return FAILED;
 		}
+		rng->allocate_bytes(rng, NONCE_SIZE, &this->my_nonce);
+		rng->destroy(rng);
 	}
 	
 	if (this->cookie.ptr)
@@ -285,20 +283,21 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
  */
 static status_t process_r(private_ike_init_t *this, message_t *message)
 {	
-	randomizer_t *randomizer;
+	rng_t *rng;
 	
 	this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 	SIG(IKE_UP_START, "%H is initiating an IKE_SA",
 		message->get_source(message));
 	this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
 
-	randomizer = randomizer_create();
-	if (randomizer->allocate_pseudo_random_bytes(randomizer, NONCE_SIZE,
-												 &this->my_nonce) != SUCCESS)
+	rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
+	if (!rng)
 	{
-		DBG1(DBG_IKE, "error generating random nonce value");
+		DBG1(DBG_IKE, "error generating nonce");
+		return FAILED;
 	}
-	randomizer->destroy(randomizer);
+	rng->allocate_bytes(rng, NONCE_SIZE, &this->my_nonce);
+	rng->destroy(rng);
 	
 #ifdef ME
 	{

src/charon/sa/tasks/ike_me.c

@@ -274,33 +274,25 @@ static status_t build_i(private_ike_me_t *this, message_t *message)
 		case ME_CONNECT:
 		{
 			id_payload_t *id_payload;
-			randomizer_t *rand = randomizer_create();
+			rng_t *rng;
 			
 			id_payload = id_payload_create_from_identification(ID_PEER, this->peer_id);
 			message->add_payload(message, (payload_t*)id_payload);
 			
+			rng = lib->crypto->create_rng(lib->crypto, RNG_STRONG);
+			if (!rng)
+			{
+				DBG1(DBG_IKE, "unable to generate connect ID for ME_CONNECT");	
+				return FAILED;
+			}
 			if (!this->response)
 			{
 				/* only the initiator creates a connect ID. the responder returns
 				 * the connect ID that it received from the initiator */
-				if (rand->allocate_pseudo_random_bytes(rand,
-						ME_CONNECTID_LEN, &this->connect_id) != SUCCESS)
-				{
-					DBG1(DBG_IKE, "unable to generate connect ID for ME_CONNECT");		
-					rand->destroy(rand);
-					return FAILED;
-				}
+				rng->allocate_bytes(rng, ME_CONNECTID_LEN, &this->connect_id);
 			}
-			
-			if (rand->allocate_pseudo_random_bytes(rand,
-					ME_CONNECTKEY_LEN, &this->connect_key) != SUCCESS)
-			{
-				DBG1(DBG_IKE, "unable to generate connect key for ME_CONNECT");
-				rand->destroy(rand);
-				return FAILED;
-			}
-			
-			rand->destroy(rand);
+			rng->allocate_bytes(rng, ME_CONNECTKEY_LEN, &this->connect_key);
+			rng->destroy(rng);
 			
 			message->add_notify(message, FALSE, ME_CONNECTID, this->connect_id);
 			message->add_notify(message, FALSE, ME_CONNECTKEY, this->connect_key);

src/charon/sa/tasks/ike_natd.c

@@ -113,17 +113,17 @@ static chunk_t generate_natd_hash(private_ike_natd_t *this,
  */
 static chunk_t generate_natd_hash_faked(private_ike_natd_t *this)
 {
-	randomizer_t *randomizer;
+	rng_t *rng;
 	chunk_t chunk;
 	
-	randomizer = randomizer_create();
-	if (randomizer->allocate_pseudo_random_bytes(randomizer, HASH_SIZE_SHA1,
-												 &chunk) != SUCCESS)
+	rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
+	if (!rng)
 	{
 		DBG1(DBG_IKE, "unable to get random bytes for NATD fake");
-		chunk = chunk_empty;
+		return chunk_empty;
 	}
-	randomizer->destroy(randomizer);
+	rng->allocate_bytes(rng, HASH_SIZE_SHA1, &chunk);
+	rng->destroy(rng);
 	return chunk;
 }