nonce: Allow overriding the RNG quality used to generate nonces

Usually, changing this won't be necessary (actually, some plugins
specifically use different DRGBs for RNG_WEAK in order to separate
the public nonces from random data used for e.g. DH).
But for experts with special plugin configurations this might be
more flexible and avoids code changes.

diff --git a/src/libstrongswan/plugins/nonce/nonce_nonceg.c b/src/libstrongswan/plugins/nonce/nonce_nonceg.c
index 5f4162ed9fb60a3906f766b3c2215996e365f66b..ab85626371114f603eb224462baa4a6963d723f3 100644 (file)
--- a/src/libstrongswan/plugins/nonce/nonce_nonceg.c
+++ b/src/libstrongswan/plugins/nonce/nonce_nonceg.c
@@ -71,7 +71,7 @@ nonce_nonceg_t *nonce_nonceg_create()
                },
        );
 
-       this->rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
+       this->rng = lib->crypto->create_rng(lib->crypto, NONCE_RNG_QUALITY);
        if (!this->rng)
        {
                DBG1(DBG_LIB, "no RNG found for quality %N", rng_quality_names,

diff --git a/src/libstrongswan/plugins/nonce/nonce_nonceg.h b/src/libstrongswan/plugins/nonce/nonce_nonceg.h
index a4953c54ebb5fe6973d9c949574b45ccbef8b364..6383558a7c60bda08f440f67ade6a947a1c687ca 100644 (file)
--- a/src/libstrongswan/plugins/nonce/nonce_nonceg.h
+++ b/src/libstrongswan/plugins/nonce/nonce_nonceg.h
@@ -21,6 +21,10 @@
 #ifndef NONCE_NONCEG_H_
 #define NONCE_NONCEG_H_
 
+#ifndef NONCE_RNG_QUALITY
+#define NONCE_RNG_QUALITY RNG_WEAK
+#endif
+
 typedef struct nonce_nonceg_t nonce_nonceg_t;
 
 #include <library.h>

diff --git a/src/libstrongswan/plugins/nonce/nonce_plugin.c b/src/libstrongswan/plugins/nonce/nonce_plugin.c
index 724162193e5497ce592751bc60b0953b8d3565c7..f8f4bca696c5562d3da1e9a1b07a84839ecbd6e6 100644 (file)
--- a/src/libstrongswan/plugins/nonce/nonce_plugin.c
+++ b/src/libstrongswan/plugins/nonce/nonce_plugin.c
@@ -43,7 +43,7 @@ METHOD(plugin_t, get_features, int,
        static plugin_feature_t f[] = {
                PLUGIN_REGISTER(NONCE_GEN, nonce_nonceg_create),
                        PLUGIN_PROVIDE(NONCE_GEN),
-                               PLUGIN_DEPENDS(RNG, RNG_WEAK),
+                               PLUGIN_DEPENDS(RNG, NONCE_RNG_QUALITY),
        };
        *features = f;
        return countof(f);