syncthing/lib/util
Jakob Borg 31b5156191 lib/util: Add secure random numbers source (fixes #3178)
The math/rand package contains lots of convenient functions, for example
to get an integer in a specified range without running into issues
caused by just truncating a number from a different distribution and so
on. But it's insecure, and we use if for things that benefit from being
more secure like session IDs, CSRF tokens and API keys.

This implements a math/rand.Source that reads from crypto/rand.Reader,
this bridging the gap between them. It also updates our RandomString to
use the new source, thus giving us secure session IDs and CSRF tokens.

Some future work remains:

 - Fix API keys by making the generation in the UI use this code as well

 - Refactor out these things into an actual random package, and audit
   our use of randomness everywhere

I'll leave both of those for the future in order to not muddy the waters
on this diff...

GitHub-Pull-Request: https://github.com/syncthing/syncthing/pull/3180
2016-05-25 06:38:38 +00:00
..
random_test.go lib/nat: Add a nat package and service to track mappings on multiple IGDs 2016-04-10 19:36:38 +00:00
random.go lib/util: Add secure random numbers source (fixes #3178) 2016-05-25 06:38:38 +00:00
securesource_test.go lib/util: Add secure random numbers source (fixes #3178) 2016-05-25 06:38:38 +00:00
securesource.go lib/util: Add secure random numbers source (fixes #3178) 2016-05-25 06:38:38 +00:00
utils_test.go lib/upnp: Refactor out methods to util with tests, refactor IGD 2016-03-25 20:22:29 +00:00
utils.go lib/upnp: Refactor out methods to util with tests, refactor IGD 2016-03-25 20:22:29 +00:00