added API for random number generators, served through credential factory

ported randomizer_t to a rng_t on top of /dev/(u)random (plugin random)

src/charon/sa/tasks/child_create.c

@@ -136,17 +136,16 @@ static status_t get_nonce(message_t *message, chunk_t *nonce)
  */
 static status_t generate_nonce(chunk_t *nonce)
 {
-	status_t status;
-	randomizer_t *randomizer = randomizer_create();
+	rng_t *rng;
 	
-	status = randomizer->allocate_pseudo_random_bytes(randomizer, NONCE_SIZE,
-													  nonce);
-	randomizer->destroy(randomizer);
-	if (status != SUCCESS)
+	rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
+	if (!rng)
 	{
-		DBG1(DBG_IKE, "error generating random nonce value");
+		DBG1(DBG_IKE, "error generating nonce value, no RNG found");
 		return FAILED;
 	}
+	rng->allocate_bytes(rng, NONCE_SIZE, nonce);
+	rng->destroy(rng);
 	return SUCCESS;
 }
 

src/charon/sa/tasks/ike_init.c

@@ -218,8 +218,7 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
  */
 static status_t build_i(private_ike_init_t *this, message_t *message)
 {
-	randomizer_t *randomizer;
-	status_t status;
+	rng_t *rng;
 	
 	this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 	SIG(IKE_UP_START, "initiating IKE_SA '%s' to %H",
@@ -249,15 +248,14 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
 	/* generate nonce only when we are trying the first time */
 	if (this->my_nonce.ptr == NULL)
 	{
-		randomizer = randomizer_create();
-		status = randomizer->allocate_pseudo_random_bytes(randomizer, NONCE_SIZE,
-														  &this->my_nonce);
-		randomizer->destroy(randomizer);
-		if (status != SUCCESS)
+		rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
+		if (!rng)
 		{
-			SIG(IKE_UP_FAILED, "error generating random nonce value");
+			SIG(IKE_UP_FAILED, "error generating nonce");
 			return FAILED;
 		}
+		rng->allocate_bytes(rng, NONCE_SIZE, &this->my_nonce);
+		rng->destroy(rng);
 	}
 	
 	if (this->cookie.ptr)
@@ -285,20 +283,21 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
  */
 static status_t process_r(private_ike_init_t *this, message_t *message)
 {	
-	randomizer_t *randomizer;
+	rng_t *rng;
 	
 	this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 	SIG(IKE_UP_START, "%H is initiating an IKE_SA",
 		message->get_source(message));
 	this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
 
-	randomizer = randomizer_create();
-	if (randomizer->allocate_pseudo_random_bytes(randomizer, NONCE_SIZE,
-												 &this->my_nonce) != SUCCESS)
+	rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
+	if (!rng)
 	{
-		DBG1(DBG_IKE, "error generating random nonce value");
+		DBG1(DBG_IKE, "error generating nonce");
+		return FAILED;
 	}
-	randomizer->destroy(randomizer);
+	rng->allocate_bytes(rng, NONCE_SIZE, &this->my_nonce);
+	rng->destroy(rng);
 	
 #ifdef ME
 	{

src/charon/sa/tasks/ike_me.c

@@ -274,33 +274,25 @@ static status_t build_i(private_ike_me_t *this, message_t *message)
 		case ME_CONNECT:
 		{
 			id_payload_t *id_payload;
-			randomizer_t *rand = randomizer_create();
+			rng_t *rng;
 			
 			id_payload = id_payload_create_from_identification(ID_PEER, this->peer_id);
 			message->add_payload(message, (payload_t*)id_payload);
 			
+			rng = lib->crypto->create_rng(lib->crypto, RNG_STRONG);
+			if (!rng)
+			{
+				DBG1(DBG_IKE, "unable to generate connect ID for ME_CONNECT");	
+				return FAILED;
+			}
 			if (!this->response)
 			{
 				/* only the initiator creates a connect ID. the responder returns
 				 * the connect ID that it received from the initiator */
-				if (rand->allocate_pseudo_random_bytes(rand,
-						ME_CONNECTID_LEN, &this->connect_id) != SUCCESS)
-				{
-					DBG1(DBG_IKE, "unable to generate connect ID for ME_CONNECT");		
-					rand->destroy(rand);
-					return FAILED;
-				}
+				rng->allocate_bytes(rng, ME_CONNECTID_LEN, &this->connect_id);
 			}
-			
-			if (rand->allocate_pseudo_random_bytes(rand,
-					ME_CONNECTKEY_LEN, &this->connect_key) != SUCCESS)
-			{
-				DBG1(DBG_IKE, "unable to generate connect key for ME_CONNECT");
-				rand->destroy(rand);
-				return FAILED;
-			}
-			
-			rand->destroy(rand);
+			rng->allocate_bytes(rng, ME_CONNECTKEY_LEN, &this->connect_key);
+			rng->destroy(rng);
 			
 			message->add_notify(message, FALSE, ME_CONNECTID, this->connect_id);
 			message->add_notify(message, FALSE, ME_CONNECTKEY, this->connect_key);

src/charon/sa/tasks/ike_natd.c

@@ -113,17 +113,17 @@ static chunk_t generate_natd_hash(private_ike_natd_t *this,
  */
 static chunk_t generate_natd_hash_faked(private_ike_natd_t *this)
 {
-	randomizer_t *randomizer;
+	rng_t *rng;
 	chunk_t chunk;
 	
-	randomizer = randomizer_create();
-	if (randomizer->allocate_pseudo_random_bytes(randomizer, HASH_SIZE_SHA1,
-												 &chunk) != SUCCESS)
+	rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
+	if (!rng)
 	{
 		DBG1(DBG_IKE, "unable to get random bytes for NATD fake");
-		chunk = chunk_empty;
+		return chunk_empty;
 	}
-	randomizer->destroy(randomizer);
+	rng->allocate_bytes(rng, HASH_SIZE_SHA1, &chunk);
+	rng->destroy(rng);
 	return chunk;
 }