botan: Use strongSwan's RNG interface in Botan plugin

This allows using rng_t implementations provided by other plugins to
serve as RNG for Botan.

Closes strongswan/strongswan#192.

diff --git a/conf/Makefile.am b/conf/Makefile.am
index 1c2b41236321f10e6993507e649d55342f553103..74fb63680cc28f7dc5f8e15bb99c89054570e228 100644 (file)
--- a/conf/Makefile.am
+++ b/conf/Makefile.am
@@ -33,6 +33,7 @@ plugins = \
        plugins/attr.opt \
        plugins/attr-sql.opt \
        plugins/bliss.opt \
+       plugins/botan.opt \
        plugins/bypass-lan.opt \
        plugins/certexpire.opt \
        plugins/coupling.opt \

diff --git a/conf/plugins/botan.opt b/conf/plugins/botan.opt
new file mode 100644 (file)
index 0000000..dfda14e
--- /dev/null
+++ b/conf/plugins/botan.opt
@@ -0,0 +1,6 @@
+charon.plugins.botan.internal_rng_only = no
+       Force the use of Botan's internal RNG.
+
+       If enabled, only Botan's internal RNG will be used throughout the plugin.
+       Otherwise, and if supported by Botan, rng_t implementations provided by
+       other loaded plugins will be used as RNG.

diff --git a/configure.ac b/configure.ac
index 520775c1c4061f93d9d913d690aaa56295507084..f9c643851bf4d56b58e119538fd5f2ce1b44d877 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -1177,6 +1177,10 @@ if test x$botan = xtrue; then
                [PKG_CHECK_MODULES(botan, [botan-2])])
        AC_SUBST(botan_CFLAGS)
        AC_SUBST(botan_LIBS)
+       saved_LIBS=$LIBS
+       LIBS="$botan_LIBS"
+       AC_CHECK_FUNCS(botan_rng_init_custom)
+       LIBS=$saved_LIBS
 fi
 
 if test x$uci = xtrue; then

diff --git a/src/libstrongswan/plugins/botan/botan_ec_diffie_hellman.c b/src/libstrongswan/plugins/botan/botan_ec_diffie_hellman.c
index 50234b2e02e32e8e8373e8239635ab77fd686d19..18e9cb1c1ba81d3288f3a76b6108f317b2e347a1 100644 (file)
--- a/src/libstrongswan/plugins/botan/botan_ec_diffie_hellman.c
+++ b/src/libstrongswan/plugins/botan/botan_ec_diffie_hellman.c
@@ -205,7 +205,7 @@ botan_ec_diffie_hellman_t *botan_ec_diffie_hellman_create(
                        return NULL;
        }
 
-       if (botan_rng_init(&rng, "user"))
+       if (!botan_get_rng(&rng, RNG_STRONG))
        {
                free(this);
                return NULL;

diff --git a/src/libstrongswan/plugins/botan/botan_ec_private_key.c b/src/libstrongswan/plugins/botan/botan_ec_private_key.c
index d9469e916bac054978edbf5c25c13e34d8512491..b6940907f802252c2e98919f4d9506437ae8be4b 100644 (file)
--- a/src/libstrongswan/plugins/botan/botan_ec_private_key.c
+++ b/src/libstrongswan/plugins/botan/botan_ec_private_key.c
@@ -329,7 +329,7 @@ botan_ec_private_key_t *botan_ec_private_key_gen(key_type_t type, va_list args)
                        return NULL;
        }
 
-       if (botan_rng_init(&rng, "system"))
+       if (!botan_get_rng(&rng, RNG_TRUE))
        {
                return NULL;
        }
@@ -429,7 +429,7 @@ botan_ec_private_key_t *botan_ec_private_key_load(key_type_t type, va_list args)
 
        this = create_empty(oid);
 
-       if (botan_rng_init(&rng, "user"))
+       if (!botan_get_rng(&rng, RNG_STRONG))
        {
                chunk_clear(&pkcs8);
                free(this);

diff --git a/src/libstrongswan/plugins/botan/botan_ed_private_key.c b/src/libstrongswan/plugins/botan/botan_ed_private_key.c
index 3f0f542224a53586277e9d188bf1b38cf1d0dee5..5d901ac743649f88eca201b63442327eeb8a2d98 100644 (file)
--- a/src/libstrongswan/plugins/botan/botan_ed_private_key.c
+++ b/src/libstrongswan/plugins/botan/botan_ed_private_key.c
@@ -216,7 +216,7 @@ private_key_t *botan_ed_private_key_gen(key_type_t type, va_list args)
                break;
        }
 
-       if (botan_rng_init(&rng, "system"))
+       if (!botan_get_rng(&rng, RNG_TRUE))
        {
                return NULL;
        }

diff --git a/src/libstrongswan/plugins/botan/botan_rsa_private_key.c b/src/libstrongswan/plugins/botan/botan_rsa_private_key.c
index 06a9345624a6ad6fde86bfc55abc037e85bf008a..b8bfa6484b77c1691a914265830deed20ced6752 100644 (file)
--- a/src/libstrongswan/plugins/botan/botan_rsa_private_key.c
+++ b/src/libstrongswan/plugins/botan/botan_rsa_private_key.c
@@ -369,7 +369,7 @@ botan_rsa_private_key_t *botan_rsa_private_key_gen(key_type_t type,
                return NULL;
        }
 
-       if (botan_rng_init(&rng, "system"))
+       if (!botan_get_rng(&rng, RNG_TRUE))
        {
                return NULL;
        }
@@ -448,7 +448,7 @@ static bool calculate_pq(botan_mp_t *n, botan_mp_t *e, botan_mp_t *d,
                goto error;
        }
 
-       if (botan_rng_init(&rng, "user"))
+       if (!botan_get_rng(&rng, RNG_STRONG))
        {
                goto error;
        }

diff --git a/src/libstrongswan/plugins/botan/botan_rsa_public_key.c b/src/libstrongswan/plugins/botan/botan_rsa_public_key.c
index af573b7c036f648c35dde367a77ede79472f3371..06560c393a685a50c7521170f1c8c0c2838f2999 100644 (file)
--- a/src/libstrongswan/plugins/botan/botan_rsa_public_key.c
+++ b/src/libstrongswan/plugins/botan/botan_rsa_public_key.c
@@ -171,7 +171,7 @@ METHOD(public_key_t, encrypt, bool,
                        return FALSE;
        }
 
-       if (botan_rng_init(&rng, "user"))
+       if (!botan_get_rng(&rng, RNG_STRONG))
        {
                return FALSE;
        }

diff --git a/src/libstrongswan/plugins/botan/botan_util.c b/src/libstrongswan/plugins/botan/botan_util.c
index 9414a2cc8895a1b1926e627da5e96f07feb54c01..641384f025a854267104fb9e1714a5f342c53fde 100644 (file)
--- a/src/libstrongswan/plugins/botan/botan_util.c
+++ b/src/libstrongswan/plugins/botan/botan_util.c
@@ -238,7 +238,7 @@ bool botan_get_signature(botan_privkey_t key, const char *scheme,
                return FALSE;
        }
 
-       if (botan_rng_init(&rng, "user"))
+       if (!botan_get_rng(&rng, RNG_STRONG))
        {
                botan_pk_op_sign_destroy(sign_op);
                return FALSE;
@@ -345,3 +345,63 @@ const char *botan_map_rng_quality(rng_quality_t quality)
        }
        return rng_name;
 }
+
+#ifdef HAVE_BOTAN_RNG_INIT_CUSTOM
+
+CALLBACK(get_random, int,
+       rng_t *rng, uint8_t *out, size_t out_len)
+{
+       if (!rng->get_bytes(rng, out_len, out))
+       {
+               return -1;
+       }
+       return 0;
+}
+
+CALLBACK(destroy_rng, void,
+       rng_t *rng)
+{
+       if (rng)
+       {
+               rng->destroy(rng);
+       }
+}
+
+#endif /* HAVE_BOTAN_RNG_INIT_CUSTOM */
+
+/*
+ * Described in header
+ */
+bool botan_get_rng(botan_rng_t *botan_rng, rng_quality_t quality)
+{
+#ifdef HAVE_BOTAN_RNG_INIT_CUSTOM
+       if (!lib->settings->get_bool(lib->settings,
+                                               "%s.plugins.botan.internal_rng_only", FALSE, lib->ns))
+       {
+               rng_t *rng = lib->crypto->create_rng(lib->crypto, quality);
+
+               if (!rng)
+               {
+                       DBG1(DBG_LIB, "no RNG found for quality %N", rng_quality_names,
+                                quality);
+                       return FALSE;
+               }
+               if (botan_rng_init_custom(botan_rng, "strongswan", rng,
+                                                                 get_random, NULL, destroy_rng))
+               {
+                       DBG1(DBG_LIB, "Botan RNG creation failed");
+                       return FALSE;
+               }
+       }
+       else
+#endif /* HAVE_BOTAN_RNG_INIT_CUSTOM */
+       {
+               const char *rng_name = botan_map_rng_quality(quality);
+
+               if (!rng_name || botan_rng_init(botan_rng, rng_name))
+               {
+                       return FALSE;
+               }
+       }
+       return TRUE;
+}

diff --git a/src/libstrongswan/plugins/botan/botan_util.h b/src/libstrongswan/plugins/botan/botan_util.h
index fe8a9a8ee061551dbc8a9da45abbb861b5d841ea..26502923846fc785f7fbdc1161b49c0cb25db717 100644 (file)
--- a/src/libstrongswan/plugins/botan/botan_util.h
+++ b/src/libstrongswan/plugins/botan/botan_util.h
@@ -133,4 +133,13 @@ bool botan_dh_key_derivation(botan_privkey_t key, chunk_t pub, chunk_t *secret);
  */
 const char *botan_map_rng_quality(rng_quality_t quality);
 
+/**
+ * Get RNG for Botan API calls.
+ *
+ * @param botan_rng Botan RNG
+ * @param quality   RNG quality requested
+ * @return          TRUE if Botan RNG creation was successful
+ */
+bool botan_get_rng(botan_rng_t *botan_rng, rng_quality_t quality);
+
 #endif /** BOTAN_UTIL_H_ @}*/

diff --git a/src/libstrongswan/plugins/botan/botan_util_keys.c b/src/libstrongswan/plugins/botan/botan_util_keys.c
index dc40314911e07da2172b835ac46522fcd08d61ad..400809855978db57b4f039bf2253b99ad739f3fc 100644 (file)
--- a/src/libstrongswan/plugins/botan/botan_util_keys.c
+++ b/src/libstrongswan/plugins/botan/botan_util_keys.c
@@ -21,6 +21,7 @@
  * THE SOFTWARE.
  */
 
+#include "botan_util.h"
 #include "botan_util_keys.h"
 #include "botan_ec_public_key.h"
 #include "botan_ec_private_key.h"
@@ -81,7 +82,7 @@ public_key_t *botan_public_key_load(key_type_t type, va_list args)
                break;
        }
 
-       if (botan_rng_init(&rng, "user"))
+       if (!botan_get_rng(&rng, RNG_STRONG))
        {
                return NULL;
        }
@@ -183,7 +184,7 @@ private_key_t *botan_private_key_load(key_type_t type, va_list args)
                break;
        }
 
-       if (botan_rng_init(&rng, "user"))
+       if (!botan_get_rng(&rng, RNG_STRONG))
        {
                return NULL;
        }

diff --git a/src/libstrongswan/plugins/botan/botan_x25519.c b/src/libstrongswan/plugins/botan/botan_x25519.c
index 8863f3fa63d9b94ecce347f122795859b2381e2a..e0cfd692f421bfe889662489ba0636dd29948dd0 100644 (file)
--- a/src/libstrongswan/plugins/botan/botan_x25519.c
+++ b/src/libstrongswan/plugins/botan/botan_x25519.c
@@ -155,7 +155,7 @@ diffie_hellman_t *botan_x25519_create(diffie_hellman_group_t group)
                },
        );
 
-       if (botan_rng_init(&rng, "user"))
+       if (!botan_get_rng(&rng, RNG_STRONG))
        {
                free(this);
                return NULL;