Commit b7959f5b authored by Guillaume Roguez's avatar Guillaume Roguez

security: extract DhParams from TlsSession

TlsSession will be refactored to handle DTLS and TLS.
This patch cleanup TlsSession files to process further.

Change-Id: I76b6ac73d9fe46ee6a18c6c9d725f6fcadb465d9
Reviewed-by: default avatarOlivier Soldano <olivier.soldano@savoirfairelinux.com>
parent bbfcd574
......@@ -26,6 +26,7 @@
#endif
#include "security/tls_session.h"
#include "security/diffie-hellman.h"
#include "sip/sipaccountbase.h"
#include "noncopyable.h"
......
......@@ -11,4 +11,6 @@ libsecurity_la_SOURCES = \
certstore.cpp \
certstore.h \
memory.cpp \
memory.h
memory.h \
diffie-hellman.cpp \
diffie-hellman.h
/*
* Copyright (C) 2004-2017 Savoir-faire Linux Inc.
*
* Author: Guillaume Roguez <guillaume.roguez@savoirfairelinux.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#include "diffie-hellman.h"
#include "logger.h"
#include <chrono>
namespace ring { namespace tls {
DhParams::DhParams(const std::vector<uint8_t>& data)
{
gnutls_dh_params_t new_params_;
int ret = gnutls_dh_params_init(&new_params_);
if (ret)
throw std::runtime_error(std::string("Error initializing DH params: ") + gnutls_strerror(ret));
params_.reset(new_params_);
const gnutls_datum_t dat {(uint8_t*)data.data(), (unsigned)data.size()};
if (int ret_pem = gnutls_dh_params_import_pkcs3(params_.get(), &dat, GNUTLS_X509_FMT_PEM))
if (int ret_der = gnutls_dh_params_import_pkcs3(params_.get(), &dat, GNUTLS_X509_FMT_DER))
throw std::runtime_error(std::string("Error importing DH params: ") + gnutls_strerror(ret_pem) + " " + gnutls_strerror(ret_der));
}
DhParams&
DhParams::operator=(const DhParams& other)
{
if (not params_) {
// We need a valid DH params pointer for the copy
gnutls_dh_params_t new_params_;
auto err = gnutls_dh_params_init(&new_params_);
if (err != GNUTLS_E_SUCCESS)
throw std::runtime_error(std::string("Error initializing DH params: ") + gnutls_strerror(err));
params_.reset(new_params_);
}
auto err = gnutls_dh_params_cpy(params_.get(), other.get());
if (err != GNUTLS_E_SUCCESS)
throw std::runtime_error(std::string("Error copying DH params: ") + gnutls_strerror(err));
return *this;
}
std::vector<uint8_t>
DhParams::serialize() const
{
if (!params_) {
RING_WARN("serialize() called on an empty DhParams");
return {};
}
gnutls_datum_t out;
if (gnutls_dh_params_export2_pkcs3(params_.get(), GNUTLS_X509_FMT_PEM, &out))
return {};
std::vector<uint8_t> ret {out.data, out.data+out.size};
gnutls_free(out.data);
return ret;
}
DhParams
DhParams::generate()
{
using clock = std::chrono::high_resolution_clock;
auto bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, /* GNUTLS_SEC_PARAM_HIGH */ GNUTLS_SEC_PARAM_HIGH);
RING_DBG("Generating DH params with %u bits", bits);
auto start = clock::now();
gnutls_dh_params_t new_params_;
int ret = gnutls_dh_params_init(&new_params_);
if (ret != GNUTLS_E_SUCCESS) {
RING_ERR("Error initializing DH params: %s", gnutls_strerror(ret));
return {};
}
DhParams params {new_params_};
ret = gnutls_dh_params_generate2(params.get(), bits);
if (ret != GNUTLS_E_SUCCESS) {
RING_ERR("Error generating DH params: %s", gnutls_strerror(ret));
return {};
}
std::chrono::duration<double> time_span = clock::now() - start;
RING_DBG("Generated DH params with %u bits in %lfs", bits, time_span.count());
return params;
}
}} // namespace ring::tls
/*
* Copyright (C) 2004-2017 Savoir-faire Linux Inc.
*
* Author: Adrien Béraud <adrien.beraud@savoirfairelinux.com>
* Author: Guillaume Roguez <guillaume.roguez@savoirfairelinux.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#pragma once
#include <gnutls/gnutls.h>
#include <vector>
#include <memory>
#include <cstdint>
namespace ring { namespace tls {
class DhParams {
public:
DhParams() = default;
DhParams(DhParams&&) = default;
DhParams(const DhParams& other) {
*this = other;
}
DhParams& operator=(DhParams&& other) = default;
DhParams& operator=(const DhParams& other);
/// \brief Construct by taking ownership of given gnutls DH params
///
/// User should not call gnutls_dh_params_deinit on given \a raw_params.
/// The object is stolen and its live is manager by our object.
explicit DhParams(gnutls_dh_params_t p) : params_ {p, gnutls_dh_params_deinit} {}
/** Deserialize DER or PEM encoded DH-params */
DhParams(const std::vector<uint8_t>& data);
gnutls_dh_params_t get() {
return params_.get();
}
gnutls_dh_params_t get() const {
return params_.get();
}
explicit inline operator bool() const {
return bool(params_);
}
/** Serialize data in PEM format */
std::vector<uint8_t> serialize() const;
static DhParams generate();
private:
std::unique_ptr<gnutls_dh_params_int, decltype(gnutls_dh_params_deinit)*> params_ {nullptr, gnutls_dh_params_deinit};
};
}} // namespace ring::tls
......@@ -32,6 +32,7 @@
#include "manager.h"
#include "certstore.h"
#include "array_size.h"
#include "diffie-hellman.h"
#include <gnutls/gnutls.h>
#include <gnutls/dtls.h>
......@@ -83,53 +84,6 @@ array2uint(const std::array<uint8_t, 8>& a)
return res;
}
DhParams::DhParams(const std::vector<uint8_t>& data)
{
gnutls_dh_params_t new_params_;
int ret = gnutls_dh_params_init(&new_params_);
if (ret)
throw std::runtime_error(std::string("Error initializing DH params: ") + gnutls_strerror(ret));
params_.reset(new_params_);
const gnutls_datum_t dat {(uint8_t*)data.data(), (unsigned)data.size()};
if (int ret_pem = gnutls_dh_params_import_pkcs3(params_.get(), &dat, GNUTLS_X509_FMT_PEM))
if (int ret_der = gnutls_dh_params_import_pkcs3(params_.get(), &dat, GNUTLS_X509_FMT_DER))
throw std::runtime_error(std::string("Error importing DH params: ") + gnutls_strerror(ret_pem) + " " + gnutls_strerror(ret_der));
}
DhParams&
DhParams::operator=(const DhParams& other)
{
if (not params_) {
// We need a valid DH params pointer for the copy
gnutls_dh_params_t new_params_;
auto err = gnutls_dh_params_init(&new_params_);
if (err != GNUTLS_E_SUCCESS)
throw std::runtime_error(std::string("Error initializing DH params: ") + gnutls_strerror(err));
params_.reset(new_params_);
}
auto err = gnutls_dh_params_cpy(params_.get(), other.get());
if (err != GNUTLS_E_SUCCESS)
throw std::runtime_error(std::string("Error copying DH params: ") + gnutls_strerror(err));
return *this;
}
std::vector<uint8_t>
DhParams::serialize() const
{
if (!params_) {
RING_WARN("serialize() called on an empty DhParams");
return {};
}
gnutls_datum_t out;
if (gnutls_dh_params_export2_pkcs3(params_.get(), GNUTLS_X509_FMT_PEM, &out))
return {};
std::vector<uint8_t> ret {out.data, out.data+out.size};
gnutls_free(out.data);
return ret;
}
class TlsSession::TlsCertificateCredendials
{
using T = gnutls_certificate_credentials_t;
......@@ -1085,34 +1039,6 @@ TlsSession::process()
callbacks_.onStateChange(new_state);
}
DhParams
DhParams::generate()
{
using clock = std::chrono::high_resolution_clock;
auto bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, /* GNUTLS_SEC_PARAM_HIGH */ GNUTLS_SEC_PARAM_HIGH);
RING_DBG("Generating DH params with %u bits", bits);
auto start = clock::now();
gnutls_dh_params_t new_params_;
int ret = gnutls_dh_params_init(&new_params_);
if (ret != GNUTLS_E_SUCCESS) {
RING_ERR("Error initializing DH params: %s", gnutls_strerror(ret));
return {};
}
DhParams params {new_params_};
ret = gnutls_dh_params_generate2(params.get(), bits);
if (ret != GNUTLS_E_SUCCESS) {
RING_ERR("Error generating DH params: %s", gnutls_strerror(ret));
return {};
}
std::chrono::duration<double> time_span = clock::now() - start;
RING_DBG("Generated DH params with %u bits in %lfs", bits, time_span.count());
return params;
}
uint16_t
TlsSession::getMtu()
{
......
......@@ -57,6 +57,8 @@ struct PrivateKey;
namespace ring { namespace tls {
class DhParams;
static constexpr uint8_t MTUS_TO_TEST = 3; //number of mtus to test in path mtu discovery.
static constexpr int DTLS_MTU {1232}; // (1280 from IPv6 minimum MTU - 40 IPv6 header - 8 UDP header)
static constexpr uint16_t MIN_MTU {512};
......@@ -70,46 +72,6 @@ enum class TlsSessionState {
SHUTDOWN
};
class DhParams {
public:
DhParams() = default;
DhParams(DhParams&&) = default;
DhParams(const DhParams& other) {
*this = other;
}
DhParams& operator=(DhParams&& other) = default;
DhParams& operator=(const DhParams& other);
/// \brief Construct by taking ownership of given gnutls DH params
///
/// User should not call gnutls_dh_params_deinit on given \a raw_params.
/// The object is stolen and its live is manager by our object.
explicit DhParams(gnutls_dh_params_t p) : params_ {p, gnutls_dh_params_deinit} {}
/** Deserialize DER or PEM encoded DH-params */
DhParams(const std::vector<uint8_t>& data);
gnutls_dh_params_t get() {
return params_.get();
}
gnutls_dh_params_t get() const {
return params_.get();
}
explicit inline operator bool() const {
return bool(params_);
}
/** Serialize data in PEM format */
std::vector<uint8_t> serialize() const;
static DhParams generate();
private:
std::unique_ptr<gnutls_dh_params_int, decltype(gnutls_dh_params_deinit)*> params_ {nullptr, gnutls_dh_params_deinit};
};
struct TlsParams {
// User CA list for session credentials
std::string ca_list;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment