denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added API for random number generators, served through credential factory

Browse Source 
ported randomizer_t to a rng_t on top of /dev/(u)random (plugin random)
This commit is contained in:
Martin Willi
2008-04-15 05:56:35 +00:00
parent 0644ebd3de
commit 6a365f0740
33 changed files with 700 additions and 451 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/crypto/crypto_factory.c
+89 -1
View File
@@ -52,6 +52,14 @@ struct prf_entry_t {
prf_constructor_t create;
};
typedef struct rng_entry_t rng_entry_t;
struct rng_entry_t {
/** quality of randomness */
rng_quality_t quality;
/** associated constructor */
rng_constructor_t create;
};
typedef struct dh_entry_t dh_entry_t;
struct dh_entry_t {
/** hash algorithm */
@@ -88,10 +96,15 @@ struct private_crypto_factory_t {
linked_list_t *hashers;
/**
* registered perfs, as prf_entry_t
* registered prfs, as prf_entry_t
*/
linked_list_t *prfs;
/**
* registered rngs, as rng_entry_t
*/
linked_list_t *rngs;
/**
* registered diffie hellman, as dh_entry_t
*/
@@ -216,6 +229,39 @@ static prf_t* create_prf(private_crypto_factory_t *this,
return prf;
}
/**
* Implementation of crypto_factory_t.create_rng.
*/
static rng_t* create_rng(private_crypto_factory_t *this, rng_quality_t quality)
{
enumerator_t *enumerator;
rng_entry_t *entry;
u_int diff = ~0;
rng_constructor_t constr = NULL;
this->mutex->lock(this->mutex);
enumerator = this->rngs->create_enumerator(this->rngs);
while (enumerator->enumerate(enumerator, &entry))
{ /* find the best matching quality, but at least as good as requested */
if (entry->quality >= quality && diff > entry->quality - quality)
{
diff = entry->quality - quality;
constr = entry->create;
if (diff == 0)
{ /* perfect match, won't get better */
break;
}
}
}
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
if (constr)
{
return constr(quality);
}
return NULL;
}
/**
* Implementation of crypto_factory_t.create_dh.
*/
@@ -396,6 +442,43 @@ static void remove_prf(private_crypto_factory_t *this, prf_constructor_t create)
this->mutex->unlock(this->mutex);
}
/**
* Implementation of crypto_factory_t.add_rng.
*/
static void add_rng(private_crypto_factory_t *this, rng_quality_t quality,
rng_constructor_t create)
{
rng_entry_t *entry = malloc_thing(rng_entry_t);
entry->quality = quality;
entry->create = create;
this->mutex->lock(this->mutex);
this->rngs->insert_last(this->rngs, entry);
this->mutex->unlock(this->mutex);
}
/**
* Implementation of crypto_factory_t.remove_rng.
*/
static void remove_rng(private_crypto_factory_t *this, rng_constructor_t create)
{
rng_entry_t *entry;
enumerator_t *enumerator;
this->mutex->lock(this->mutex);
enumerator = this->rngs->create_enumerator(this->rngs);
while (enumerator->enumerate(enumerator, &entry))
{
if (entry->create == create)
{
this->rngs->remove_at(this->rngs, enumerator);
free(entry);
}
}
enumerator->destroy(enumerator);
this->mutex->unlock(this->mutex);
}
/**
* Implementation of crypto_factory_t.add_dh.
*/
@@ -442,6 +525,7 @@ static void destroy(private_crypto_factory_t *this)
this->signers->destroy_function(this->signers, free);
this->hashers->destroy_function(this->hashers, free);
this->prfs->destroy_function(this->prfs, free);
this->rngs->destroy_function(this->rngs, free);
this->dhs->destroy_function(this->dhs, free);
this->mutex->destroy(this->mutex);
free(this);
@@ -458,6 +542,7 @@ crypto_factory_t *crypto_factory_create()
this->public.create_signer = (signer_t*(*)(crypto_factory_t*, integrity_algorithm_t))create_signer;
this->public.create_hasher = (hasher_t*(*)(crypto_factory_t*, hash_algorithm_t))create_hasher;
this->public.create_prf = (prf_t*(*)(crypto_factory_t*, pseudo_random_function_t))create_prf;
this->public.create_rng = (rng_t*(*)(crypto_factory_t*, rng_quality_t quality))create_rng;
this->public.create_dh = (diffie_hellman_t*(*)(crypto_factory_t*, diffie_hellman_group_t group))create_dh;
this->public.add_crypter = (void(*)(crypto_factory_t*, encryption_algorithm_t algo, crypter_constructor_t create))add_crypter;
this->public.remove_crypter = (void(*)(crypto_factory_t*, crypter_constructor_t create))remove_crypter;
@@ -467,6 +552,8 @@ crypto_factory_t *crypto_factory_create()
this->public.remove_hasher = (void(*)(crypto_factory_t*, hasher_constructor_t create))remove_hasher;
this->public.add_prf = (void(*)(crypto_factory_t*, pseudo_random_function_t algo, prf_constructor_t create))add_prf;
this->public.remove_prf = (void(*)(crypto_factory_t*, prf_constructor_t create))remove_prf;
this->public.add_rng = (void(*)(crypto_factory_t*, rng_quality_t quality, rng_constructor_t create))add_rng;
this->public.remove_rng = (void(*)(crypto_factory_t*, rng_constructor_t create))remove_rng;
this->public.add_dh = (void(*)(crypto_factory_t*, diffie_hellman_group_t algo, dh_constructor_t create))add_dh;
this->public.remove_dh = (void(*)(crypto_factory_t*, dh_constructor_t create))remove_dh;
this->public.destroy = (void(*)(crypto_factory_t*))destroy;
@@ -475,6 +562,7 @@ crypto_factory_t *crypto_factory_create()
this->signers = linked_list_create();
this->hashers = linked_list_create();
this->prfs = linked_list_create();
this->rngs = linked_list_create();
this->dhs = linked_list_create();
this->mutex = mutex_create(MUTEX_RECURSIVE);
src/libstrongswan/crypto/crypto_factory.h
+30 -1
View File
@@ -28,6 +28,7 @@ typedef struct crypto_factory_t crypto_factory_t;
#include <crypto/signers/signer.h>
#include <crypto/hashers/hasher.h>
#include <crypto/prfs/prf.h>
#include <crypto/rngs/rng.h>
#include <crypto/diffie_hellman.h>
/**
@@ -46,10 +47,15 @@ typedef signer_t* (*signer_constructor_t)(integrity_algorithm_t algo);
typedef hasher_t* (*hasher_constructor_t)(hash_algorithm_t algo);
/**
* Constructor function for pseudo random fucntions
* Constructor function for pseudo random functions
*/
typedef prf_t* (*prf_constructor_t)(pseudo_random_function_t algo);
/**
* Constructor function for source of randomness
*/
typedef rng_t* (*rng_constructor_t)(rng_quality_t quality);
/**
* Constructor function for diffie hellman
*/
@@ -95,6 +101,14 @@ struct crypto_factory_t {
*/
prf_t* (*create_prf)(crypto_factory_t *this, pseudo_random_function_t algo);
/**
* Create a source of randomness.
*
* @param quality required randomness quality
* @return rng_t instance, NULL if no RNG with such a quality
*/
rng_t* (*create_rng)(crypto_factory_t *this, rng_quality_t quality);
/**
* Create a diffie hellman instance.
*
@@ -175,6 +189,21 @@ struct crypto_factory_t {
*/
void (*remove_prf)(crypto_factory_t *this, prf_constructor_t create);
/**
* Register a source of randomness.
*
* @param quality quality of randomness this RNG serves
* @param create constructor function for such a quality
*/
void (*add_rng)(crypto_factory_t *this, rng_quality_t quality, rng_constructor_t create);
/**
* Unregister a source of randomness.
*
* @param create constructor function to unregister
*/
void (*remove_rng)(crypto_factory_t *this, rng_constructor_t create);
/**
* Register a diffie hellman constructor.
*
src/libstrongswan/crypto/pkcs7.c
+11 -12
View File
@@ -14,7 +14,7 @@
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
* $Id: pkcs7.c 3488 2008-02-21 15:10:02Z martin $
*/
#include <stdlib.h>
@@ -30,7 +30,6 @@
#include <crypto/hashers/hasher.h>
#include <crypto/crypters/crypter.h>
#include <crypto/rsa/rsa_public_key.h>
#include <utils/randomizer.h>
#include <utils/linked_list.h>
#include "pkcs7.h"
@@ -779,17 +778,17 @@ bool build_envelopedData(private_pkcs7_t *this, x509_t *cert,
* and a pseudo-random iv
*/
{
randomizer_t *randomizer = randomizer_create();
randomizer->allocate_random_bytes(randomizer,
crypter->get_key_size(crypter), &symmetricKey);
rng_t *rng;
rng = lib->crypto->create_rng(lib->crypto, RNG_REAL);
rng->allocate_bytes(rng, crypter->get_key_size(crypter), &symmetricKey);
DBG4(" symmetric encryption key: %B", &symmetricKey);
rng->destroy(rng);
randomizer->allocate_pseudo_random_bytes(randomizer,
crypter->get_block_size(crypter), &iv);
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
rng->allocate_bytes(rng, crypter->get_block_size(crypter), &iv);
DBG4(" initialization vector: %B", &iv);
randomizer->destroy(randomizer);
rng->destroy(rng);
}
/* pad the data so that the total length becomes
@@ -816,7 +815,7 @@ bool build_envelopedData(private_pkcs7_t *this, x509_t *cert,
crypter->set_key(crypter, symmetricKey);
crypter->encrypt(crypter, in, iv, &out);
crypter->destroy(crypter);
chunk_free_randomized(&in);
chunk_clear(&in);
DBG3(" encrypted data: %B", &out);
/* build pkcs7 enveloped data object */
@@ -835,7 +834,7 @@ bool build_envelopedData(private_pkcs7_t *this, x509_t *cert,
rsa_public_key_t *public_key = cert->get_public_key(cert);
public_key->pkcs1_encrypt(public_key, symmetricKey, &wrappedKey);
chunk_free_randomized(&symmetricKey);
chunk_clear(&symmetricKey);
encryptedKey = asn1_wrap(ASN1_OCTET_STRING, "m", wrappedKey);
src/libstrongswan/crypto/rngs/rng.c
+24
View File
@@ -0,0 +1,24 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id$
*/
#include "rng.h"
ENUM(rng_quality_names, RNG_WEAK, RNG_REAL,
"RNG_WEAK",
"RNG_STRONG",
"RNG_REAL",
);
src/libstrongswan/crypto/rngs/rng.h
+75
View File
@@ -0,0 +1,75 @@
/*
* Copyright (C) 2008 Martin Willi
* Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*
* $Id: rng.h 3619 2008-03-19 14:02:52Z martin $
*/
/**
* @defgroup rng rng
* @{ @ingroup crypto
*/
#ifndef RNG_H_
#define RNG_H_
typedef enum rng_quality_t rng_quality_t;
typedef struct rng_t rng_t;
#include <library.h>
/**
* Quality of generated random bytes.
*/
enum rng_quality_t {
/** weak randomness, usable for nonces, IVs */
RNG_WEAK,
/** stronger randomness, usable for session keys */
RNG_STRONG,
/** real random, key material */
RNG_REAL,
};
/**
* enum name for rng_quality_t.
*/
extern enum_name_t *rng_quality_names;
/**
* Generic interface for random number generators.
*/
struct rng_t {
/**
* Generates random bytes and writes them in the buffer.
*
* @param len number of bytes to get
* @param buffer pointer where the generated bytes will be written
*/
void (*get_bytes) (rng_t *this, u_int len, u_int8_t *buffer);
/**
* Generates random bytes and allocate space for them.
*
* @param len number of bytes to get
* @param chunk chunk which will hold generated bytes
*/
void (*allocate_bytes) (rng_t *this, u_int len, chunk_t *chunk);
/**
* Destroys a rng object.
*/
void (*destroy) (rng_t *this);
};
#endif /*RNG_H_ @} */