Use constant time memcmp() when comparing packet HMACs.

This eliminates a timing side channel vulnerability, which could
potentially allow an attacker to compute a valid HMAC, and insert arbitrary
ciphertext data into the connection. If an attacker also identifies packets
with a plaintext it can guess (e.g. small packets every 1s are probably
pings), the attacker can xor the ciphertext to mangle the packet to
arbitrary plaintext. Although this type of attack is rarely seen in the
wild, it is generally considered technically viable.

Signed-off-by: Steffan Karger <steffan@karger.me>
Use cryptographically strong random when generating keys.

From the OpenSSL manual:

"Byte sequences generated by RAND_pseudo_bytes() will be unique
if they are of sufficient length, but are not necessarily unpredictable."

So, replace these call with RAND_bytes() to get cryptographically strong
key material.

Signed-off-by: Steffan Karger <steffan@karger.me>
Check RAND_bytes() return value, fail when getting random fails.

When RAND_bytes() does not return success, the buffer contents cannot be
used. This patch makes sure the return code is checked, and the connection
fails when keys or challenges cannot be trusted.

Signed-off-by: Steffan Karger <steffan@karger.me>