security: extract DhParams from TlsSession

TlsSession will be refactored to handle DTLS and TLS.
This patch cleanup TlsSession files to process further.

Change-Id: I76b6ac73d9fe46ee6a18c6c9d725f6fcadb465d9
Reviewed-by: Olivier Soldano <olivier.soldano@savoirfairelinux.com>

src/ringdht/ringaccount.h

@@ -26,6 +26,7 @@
 #endif
 
 #include "security/tls_session.h"
+#include "security/diffie-hellman.h"
 #include "sip/sipaccountbase.h"
 
 #include "noncopyable.h"

src/security/Makefile.am

@@ -11,4 +11,6 @@ libsecurity_la_SOURCES = \
 		certstore.cpp \
 		certstore.h \
 		memory.cpp \
-		memory.h
+		memory.h \
+		diffie-hellman.cpp \
+		diffie-hellman.h

src/security/diffie-hellman.cpp

+/*
+ *  Copyright (C) 2004-2017 Savoir-faire Linux Inc.
+ *
+ *  Author: Guillaume Roguez <guillaume.roguez@savoirfairelinux.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301 USA.
+ */
+
+#include "diffie-hellman.h"
+#include "logger.h"
+
+#include <chrono>
+
+namespace ring { namespace tls {
+
+DhParams::DhParams(const std::vector<uint8_t>& data)
+{
+    gnutls_dh_params_t new_params_;
+    int ret = gnutls_dh_params_init(&new_params_);
+    if (ret)
+        throw std::runtime_error(std::string("Error initializing DH params: ") + gnutls_strerror(ret));
+    params_.reset(new_params_);
+    const gnutls_datum_t dat {(uint8_t*)data.data(), (unsigned)data.size()};
+    if (int ret_pem = gnutls_dh_params_import_pkcs3(params_.get(), &dat, GNUTLS_X509_FMT_PEM))
+        if (int ret_der = gnutls_dh_params_import_pkcs3(params_.get(), &dat, GNUTLS_X509_FMT_DER))
+            throw std::runtime_error(std::string("Error importing DH params: ") + gnutls_strerror(ret_pem) + " " + gnutls_strerror(ret_der));
+}
+
+DhParams&
+DhParams::operator=(const DhParams& other)
+{
+    if (not params_) {
+        // We need a valid DH params pointer for the copy
+        gnutls_dh_params_t new_params_;
+        auto err = gnutls_dh_params_init(&new_params_);
+        if (err != GNUTLS_E_SUCCESS)
+            throw std::runtime_error(std::string("Error initializing DH params: ") + gnutls_strerror(err));
+        params_.reset(new_params_);
+    }
+
+    auto err = gnutls_dh_params_cpy(params_.get(), other.get());
+    if (err != GNUTLS_E_SUCCESS)
+        throw std::runtime_error(std::string("Error copying DH params: ") + gnutls_strerror(err));
+
+    return *this;
+}
+
+std::vector<uint8_t>
+DhParams::serialize() const
+{
+    if (!params_) {
+        RING_WARN("serialize() called on an empty DhParams");
+        return {};
+    }
+    gnutls_datum_t out;
+    if (gnutls_dh_params_export2_pkcs3(params_.get(), GNUTLS_X509_FMT_PEM, &out))
+        return {};
+    std::vector<uint8_t> ret {out.data, out.data+out.size};
+    gnutls_free(out.data);
+    return ret;
+}
+
+DhParams
+DhParams::generate()
+{
+    using clock = std::chrono::high_resolution_clock;
+
+    auto bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, /* GNUTLS_SEC_PARAM_HIGH */ GNUTLS_SEC_PARAM_HIGH);
+    RING_DBG("Generating DH params with %u bits", bits);
+    auto start = clock::now();
+
+    gnutls_dh_params_t new_params_;
+    int ret = gnutls_dh_params_init(&new_params_);
+    if (ret != GNUTLS_E_SUCCESS) {
+        RING_ERR("Error initializing DH params: %s", gnutls_strerror(ret));
+        return {};
+    }
+    DhParams params {new_params_};
+
+    ret = gnutls_dh_params_generate2(params.get(), bits);
+    if (ret != GNUTLS_E_SUCCESS) {
+        RING_ERR("Error generating DH params: %s", gnutls_strerror(ret));
+        return {};
+    }
+
+    std::chrono::duration<double> time_span = clock::now() - start;
+    RING_DBG("Generated DH params with %u bits in %lfs", bits, time_span.count());
+    return params;
+}
+
+}} // namespace ring::tls

src/security/diffie-hellman.h

+/*
+ *  Copyright (C) 2004-2017 Savoir-faire Linux Inc.
+ *
+ *  Author: Adrien Béraud <adrien.beraud@savoirfairelinux.com>
+ *  Author: Guillaume Roguez <guillaume.roguez@savoirfairelinux.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301 USA.
+ */
+
+#pragma once
+
+#include <gnutls/gnutls.h>
+#include <vector>
+#include <memory>
+#include <cstdint>
+
+namespace ring { namespace tls {
+
+class DhParams {
+public:
+    DhParams() = default;
+    DhParams(DhParams&&) = default;
+    DhParams(const DhParams& other) {
+        *this = other;
+    }
+
+    DhParams& operator=(DhParams&& other) = default;
+    DhParams& operator=(const DhParams& other);
+
+    /// \brief Construct by taking ownership of given gnutls DH params
+    ///
+    /// User should not call gnutls_dh_params_deinit on given \a raw_params.
+    /// The object is stolen and its live is manager by our object.
+    explicit DhParams(gnutls_dh_params_t p) : params_ {p, gnutls_dh_params_deinit} {}
+
+    /** Deserialize DER or PEM encoded DH-params */
+    DhParams(const std::vector<uint8_t>& data);
+
+    gnutls_dh_params_t get() {
+        return params_.get();
+    }
+    gnutls_dh_params_t get() const {
+        return params_.get();
+    }
+
+    explicit inline operator bool() const {
+        return bool(params_);
+    }
+
+    /** Serialize data in PEM format */
+    std::vector<uint8_t> serialize() const;
+
+    static DhParams generate();
+
+private:
+    std::unique_ptr<gnutls_dh_params_int, decltype(gnutls_dh_params_deinit)*> params_ {nullptr, gnutls_dh_params_deinit};
+};
+
+}} // namespace ring::tls

src/security/tls_session.cpp

@@ -32,6 +32,7 @@
 #include "manager.h"
 #include "certstore.h"
 #include "array_size.h"
+#include "diffie-hellman.h"
 
 #include <gnutls/gnutls.h>
 #include <gnutls/dtls.h>
@@ -83,53 +84,6 @@ array2uint(const std::array<uint8_t, 8>& a)
     return res;
 }
 
-DhParams::DhParams(const std::vector<uint8_t>& data)
-{
-    gnutls_dh_params_t new_params_;
-    int ret = gnutls_dh_params_init(&new_params_);
-    if (ret)
-        throw std::runtime_error(std::string("Error initializing DH params: ") + gnutls_strerror(ret));
-    params_.reset(new_params_);
-    const gnutls_datum_t dat {(uint8_t*)data.data(), (unsigned)data.size()};
-    if (int ret_pem = gnutls_dh_params_import_pkcs3(params_.get(), &dat, GNUTLS_X509_FMT_PEM))
-        if (int ret_der = gnutls_dh_params_import_pkcs3(params_.get(), &dat, GNUTLS_X509_FMT_DER))
-            throw std::runtime_error(std::string("Error importing DH params: ") + gnutls_strerror(ret_pem) + " " + gnutls_strerror(ret_der));
-}
-
-DhParams&
-DhParams::operator=(const DhParams& other)
-{
-    if (not params_) {
-        // We need a valid DH params pointer for the copy
-        gnutls_dh_params_t new_params_;
-        auto err = gnutls_dh_params_init(&new_params_);
-        if (err != GNUTLS_E_SUCCESS)
-            throw std::runtime_error(std::string("Error initializing DH params: ") + gnutls_strerror(err));
-        params_.reset(new_params_);
-    }
-
-    auto err = gnutls_dh_params_cpy(params_.get(), other.get());
-    if (err != GNUTLS_E_SUCCESS)
-        throw std::runtime_error(std::string("Error copying DH params: ") + gnutls_strerror(err));
-
-    return *this;
-}
-
-std::vector<uint8_t>
-DhParams::serialize() const
-{
-    if (!params_) {
-        RING_WARN("serialize() called on an empty DhParams");
-        return {};
-    }
-    gnutls_datum_t out;
-    if (gnutls_dh_params_export2_pkcs3(params_.get(), GNUTLS_X509_FMT_PEM, &out))
-        return {};
-    std::vector<uint8_t> ret {out.data, out.data+out.size};
-    gnutls_free(out.data);
-    return ret;
-}
-
 class TlsSession::TlsCertificateCredendials
 {
     using T = gnutls_certificate_credentials_t;
@@ -1085,34 +1039,6 @@ TlsSession::process()
         callbacks_.onStateChange(new_state);
 }
 
-DhParams
-DhParams::generate()
-{
-    using clock = std::chrono::high_resolution_clock;
-
-    auto bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, /* GNUTLS_SEC_PARAM_HIGH */ GNUTLS_SEC_PARAM_HIGH);
-    RING_DBG("Generating DH params with %u bits", bits);
-    auto start = clock::now();
-
-    gnutls_dh_params_t new_params_;
-    int ret = gnutls_dh_params_init(&new_params_);
-    if (ret != GNUTLS_E_SUCCESS) {
-        RING_ERR("Error initializing DH params: %s", gnutls_strerror(ret));
-        return {};
-    }
-    DhParams params {new_params_};
-
-    ret = gnutls_dh_params_generate2(params.get(), bits);
-    if (ret != GNUTLS_E_SUCCESS) {
-        RING_ERR("Error generating DH params: %s", gnutls_strerror(ret));
-        return {};
-    }
-
-    std::chrono::duration<double> time_span = clock::now() - start;
-    RING_DBG("Generated DH params with %u bits in %lfs", bits, time_span.count());
-    return params;
-}
-
 uint16_t
 TlsSession::getMtu()
 {

src/security/tls_session.h

@@ -57,6 +57,8 @@ struct PrivateKey;
 
 namespace ring { namespace tls {
 
+class DhParams;
+
 static constexpr uint8_t MTUS_TO_TEST = 3; //number of mtus to test in path mtu discovery.
 static constexpr int DTLS_MTU {1232}; // (1280 from IPv6 minimum MTU - 40 IPv6 header - 8 UDP header)
 static constexpr uint16_t MIN_MTU {512};
@@ -70,46 +72,6 @@ enum class TlsSessionState {
     SHUTDOWN
 };
 
-class DhParams {
-public:
-    DhParams() = default;
-    DhParams(DhParams&&) = default;
-    DhParams(const DhParams& other) {
-        *this = other;
-    }
-
-    DhParams& operator=(DhParams&& other) = default;
-    DhParams& operator=(const DhParams& other);
-
-    /// \brief Construct by taking ownership of given gnutls DH params
-    ///
-    /// User should not call gnutls_dh_params_deinit on given \a raw_params.
-    /// The object is stolen and its live is manager by our object.
-    explicit DhParams(gnutls_dh_params_t p) : params_ {p, gnutls_dh_params_deinit} {}
-
-    /** Deserialize DER or PEM encoded DH-params */
-    DhParams(const std::vector<uint8_t>& data);
-
-    gnutls_dh_params_t get() {
-        return params_.get();
-    }
-    gnutls_dh_params_t get() const {
-        return params_.get();
-    }
-
-    explicit inline operator bool() const {
-        return bool(params_);
-    }
-
-    /** Serialize data in PEM format */
-    std::vector<uint8_t> serialize() const;
-
-    static DhParams generate();
-
-private:
-    std::unique_ptr<gnutls_dh_params_int, decltype(gnutls_dh_params_deinit)*> params_ {nullptr, gnutls_dh_params_deinit};
-};
-
 struct TlsParams {
     // User CA list for session credentials
     std::string ca_list;