Add 1024-bit Diffie-Hellman parameters to vconn-ssl.

1024-bit Diffie-Hellman is somewhat weak, but I haven't been able to
figure out how to make OpenSSL use longer Diffie-Hellman keys than that.
If this isn't available, OpenSSL doesn't let connections proceed.

This change should be reverted when we figure out how to make OpenSSL
use longer Diffie-Hellman keys.

lib/Makefile.am

@@ -30,12 +30,13 @@ if HAVE_OPENSSL
 libopenflow_la_SOURCES += \
 	vconn-ssl.c \
 	dhparams.c
-dhparams.c: dh2048.pem dh4096.pem
+dhparams.c: dh1024.pem dh2048.pem dh4096.pem
 	(echo '#include "dhparams.h"' &&			\
+	 openssl dhparam -C -in $(srcdir)/dh1024.pem -noout &&	\
 	 openssl dhparam -C -in $(srcdir)/dh2048.pem -noout &&	\
 	 openssl dhparam -C -in $(srcdir)/dh4096.pem -noout)	\
 	| sed 's/\(get_dh[0-9]*\)()/\1(void)/' > dhparams.c.tmp
 	mv dhparams.c.tmp dhparams.c
 endif
 
-EXTRA_DIST = dh2048.pem dh4096.pem dhparams.h
+EXTRA_DIST = dh1024.pem dh2048.pem dh4096.pem dhparams.h

lib/dh1024.pem

@@ -0,0 +1,10 @@
+-----BEGIN DH PARAMETERS-----
+MIGHAoGBAPSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY7288kjwEPwpVsY
+jY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy1obEAxnIByl6
+ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XpL3jHAgEC
+-----END DH PARAMETERS-----
+
+These are the 1024 bit DH parameters from "Assigned Number for SKIP Protocols"
+(http://www.skip-vpn.org/spec/numbers.html).
+See there for how they were generated.
+Note that g is not a generator, but this is not a problem since p is a safe prime.

lib/dhparams.h

@@ -3,6 +3,7 @@
 
 #include <openssl/dh.h>
 
+DH *get_dh1024(void);
 DH *get_dh2048(void);
 DH *get_dh4096(void);
 

lib/vconn-ssl.c

@@ -674,13 +674,14 @@ tmp_dh_callback(SSL *ssl, int is_export UNUSED, int keylength)
     };
 
     static struct dh dh_table[] = {
+        {1024, NULL, get_dh1024},
         {2048, NULL, get_dh2048},
         {4096, NULL, get_dh4096},
     };
 
     struct dh *dh;
 
-    for (dh = dh_table; dh < &dh[ARRAY_SIZE(dh_table)]; dh++) {
+    for (dh = dh_table; dh < &dh_table[ARRAY_SIZE(dh_table)]; dh++) {
         if (dh->keylength == keylength) {
             if (!dh->dh) {
                 dh->dh = dh->constructor();