Move DLTS-SRTP into libdino

7 files changed, 5 insertions, 651 deletions

diff --git a/plugins/ice/src/dtls_srtp.vala b/plugins/ice/src/dtls_srtp.vala
deleted file mode 100644
index 41918359..00000000
--- a/plugins/ice/src/dtls_srtp.vala
+++ /dev/null
@@ -1,146 +0,0 @@
-namespace Dino.Plugins.Ice.DtlsSrtp {
-
-public abstract class CredentialsCapsule : Object {
-    public uint8[] own_fingerprint;
-}
-
-public abstract class AbstractHandler {
-
-    public signal void send_data(uint8[] data);
-
-    public bool ready { get {
-        return srtp_session.has_encrypt && srtp_session.has_decrypt;
-    }}
-
-    public Mode mode { get; set; default = Mode.CLIENT; }
-    public uint8[] own_fingerprint { get; private set; }
-    public uint8[] peer_fingerprint { get; set; }
-    public string peer_fp_algo { get; set; }
-
-    protected CredentialsCapsule credentials;
-    protected Cond buffer_cond = Cond();
-    protected Mutex buffer_mutex = Mutex();
-    protected Gee.LinkedList<Bytes> buffer_queue = new Gee.LinkedList<Bytes>();
-
-    protected bool running = false;
-    protected bool stop = false;
-    protected bool restart = false;
-
-    protected Crypto.Srtp.Session srtp_session = new Crypto.Srtp.Session();
-
-    protected AbstractHandler.with_cert(CredentialsCapsule creds) {
-        this.credentials = creds;
-        this.own_fingerprint = creds.own_fingerprint;
-    }
-
-    public uint8[]? process_incoming_data(uint component_id, uint8[] data) throws Crypto.Error {
-        if (data[0] >= 128) {
-            if (!srtp_session.has_decrypt) {
-                debug("Received data before SRTP session is ready, dropping.");
-                return null;
-            }
-            if (component_id == 1) {
-                if (data.length >= 2 && data[1] >= 192 && data[1] < 224) {
-                    return srtp_session.decrypt_rtcp(data);
-                }
-                return srtp_session.decrypt_rtp(data);
-            }
-            if (component_id == 2) return srtp_session.decrypt_rtcp(data);
-        }
-        if (component_id == 1 && data.length >= 1 && (data[0] >= 20 && data[0] < 64)) {
-            on_data_rec(data);
-            return null;
-        }
-        debug("Dropping unknown data from component %u", component_id);
-        return null;
-    }
-
-    public uint8[]? process_outgoing_data(uint component_id, uint8[] data) throws Crypto.Error {
-        if (srtp_session.has_encrypt) {
-            if (component_id == 1) {
-                if (data.length >= 2 && data[1] >= 192 && data[1] < 224) {
-                    return srtp_session.encrypt_rtcp(data);
-                }
-                return srtp_session.encrypt_rtp(data);
-            }
-            if (component_id == 2) return srtp_session.encrypt_rtcp(data);
-        }
-        return null;
-    }
-
-    public void on_data_rec(owned uint8[] data) {
-        buffer_mutex.lock();
-        buffer_queue.add(new Bytes.take(data));
-        buffer_cond.signal();
-        buffer_mutex.unlock();
-    }
-
-    public void stop_dtls_connection() {
-        buffer_mutex.lock();
-        stop = true;
-        buffer_cond.signal();
-        buffer_mutex.unlock();
-    }
-
-    protected Bytes get_buffer_if_present () {
-        buffer_mutex.lock();
-        if (buffer_queue.size == 0) {
-            buffer_mutex.unlock();
-            return null;
-        }
-        Bytes res = buffer_queue.remove_at(0);
-        buffer_mutex.unlock();
-        return res;
-    }
-
-    public async Xmpp.Xep.Jingle.ContentEncryption? setup_dtls_connection() {
-        MainContext context = MainContext.current_source().get_context();
-        var thread = new Thread<Xmpp.Xep.Jingle.ContentEncryption>("dtls-connection", () => {
-            // Check we can start working on the thread
-            buffer_mutex.lock();
-            if (stop) {
-                restart = true;
-                buffer_mutex.unlock();
-                return null;
-            }
-            if (running || ready) {
-                buffer_mutex.unlock();
-                return null;
-            }
-            running = true;
-            restart = false;
-            buffer_mutex.unlock();
-
-            // Actual work
-            var res = setup_dtls_connection_thread();
-
-            // Callback
-            Source source = new IdleSource();
-            source.set_callback(setup_dtls_connection.callback);
-            source.attach(context);
-            return res;
-        });
-        yield;
-        return thread.join();
-    }
-
-    protected abstract Xmpp.Xep.Jingle.ContentEncryption? setup_dtls_connection_thread();
-}
-
-private string format_fingerprint(uint8[] fingerprint) {
-    var sb = new StringBuilder();
-    for (int i = 0; i < fingerprint.length; i++) {
-        sb.append("%02X".printf(fingerprint[i]));
-        if (i < fingerprint.length - 1) {
-            sb.append(":");
-        }
-    }
-    return sb.str;
-}
-
-
-public enum Mode {
-    CLIENT, SERVER
-}
-
-}
diff --git a/plugins/ice/src/dtls_srtp_gnutls.vala b/plugins/ice/src/dtls_srtp_gnutls.vala
deleted file mode 100644
index 91a7cfb2..00000000
--- a/plugins/ice/src/dtls_srtp_gnutls.vala
+++ /dev/null
@@ -1,245 +0,0 @@
-using GnuTLS;
-
-namespace Dino.Plugins.Ice.DtlsSrtp {
-
-public class CredentialsCapsuleGnuTLS : CredentialsCapsule {
-    public X509.Certificate[] own_cert;
-    public X509.PrivateKey private_key;
-}
-
-private uint8[] get_fingerprint(X509.Certificate certificate, DigestAlgorithm digest_algo) {
-    uint8[] buf = new uint8[512];
-    size_t buf_out_size = 512;
-    certificate.get_fingerprint(digest_algo, buf, ref buf_out_size);
-
-    uint8[] ret = new uint8[buf_out_size];
-    for (int i = 0; i < buf_out_size; i++) {
-        ret[i] = buf[i];
-    }
-    return ret;
-}
-
-internal CredentialsCapsule generate_credentials () throws GLib.Error {
-    int err = 0;
-
-    X509.PrivateKey private_key = X509.PrivateKey.create ();
-    err = private_key.generate (PKAlgorithm.ECDSA, 256);
-    throw_if_error (err);
-
-    var start_time = new DateTime.now_local().add_days(-1);
-    var end_time = start_time.add_days (2);
-
-    X509.Certificate cert = X509.Certificate.create ();
-    cert.set_key (private_key);
-    cert.set_version (1);
-    cert.set_activation_time ((time_t) start_time.to_unix ());
-    cert.set_expiration_time ((time_t) end_time.to_unix ());
-
-    uint32 serial = 1;
-    cert.set_serial (&serial, sizeof(uint32));
-
-    cert.sign (cert, private_key);
-
-    uint8[] own_fingerprint = get_fingerprint (cert, DigestAlgorithm.SHA256);
-    X509.Certificate[] own_cert = new X509.Certificate[] { (owned)cert };
-
-    var creds = new CredentialsCapsuleGnuTLS();
-    creds.own_fingerprint = own_fingerprint;
-    creds.own_cert = (owned) own_cert;
-    creds.private_key = (owned) private_key;
-
-    return creds;
-}
-
-public class Handler : AbstractHandler {
-
-    public Handler.with_cert(CredentialsCapsule creds) {
-        base.with_cert(creds);
-    }
-
-    protected override Xmpp.Xep.Jingle.ContentEncryption? setup_dtls_connection_thread() {
-        InitFlags server_or_client = mode == Mode.SERVER ? InitFlags.SERVER : InitFlags.CLIENT;
-        debug("Setting up DTLS connection using GnuTLS. We're %s", mode.to_string());
-
-        CertificateCredentials cert_cred = CertificateCredentials.create();
-        int err = cert_cred.set_x509_key(((CredentialsCapsuleGnuTLS)credentials).own_cert, ((CredentialsCapsuleGnuTLS)credentials).private_key);
-        throw_if_error(err);
-
-        Session? session = Session.create(server_or_client | InitFlags.DATAGRAM);
-        session.enable_heartbeat(1);
-        session.set_srtp_profile_direct("SRTP_AES128_CM_HMAC_SHA1_80");
-        session.set_credentials(GnuTLS.CredentialsType.CERTIFICATE, cert_cred);
-        session.server_set_request(CertificateRequest.REQUEST);
-        session.set_priority_from_string("NORMAL:!VERS-TLS-ALL:+VERS-DTLS-ALL:+CTYPE-CLI-X509");
-
-        session.set_transport_pointer(this);
-        session.set_pull_function(pull_function);
-        session.set_pull_timeout_function(pull_timeout_function);
-        session.set_push_function(push_function);
-        session.set_verify_function(verify_function);
-
-        DateTime maximum_time = new DateTime.now_utc().add_seconds(20);
-        do {
-            err = session.handshake();
-
-            DateTime current_time = new DateTime.now_utc();
-            if (maximum_time.compare(current_time) < 0) {
-                warning("DTLS handshake timeouted");
-                err = ErrorCode.APPLICATION_ERROR_MIN + 1;
-                break;
-            }
-            if (stop) {
-                debug("DTLS handshake stopped");
-                err = ErrorCode.APPLICATION_ERROR_MIN + 2;
-                break;
-            }
-        } while (err < 0 && !((ErrorCode)err).is_fatal());
-
-        buffer_mutex.lock();
-        if (stop) {
-            stop = false;
-            running = false;
-            bool restart = restart;
-            buffer_mutex.unlock();
-            if (restart) {
-                debug("Restarting DTLS handshake");
-                return setup_dtls_connection_thread();
-            }
-            return null;
-        }
-        buffer_mutex.unlock();
-        if (err != ErrorCode.SUCCESS) {
-            warning("DTLS handshake failed: %s", ((ErrorCode)err).to_string());
-            return null;
-        }
-
-        uint8[] km = new uint8[150];
-        Datum? client_key, client_salt, server_key, server_salt;
-        session.get_srtp_keys(km, km.length, out client_key, out client_salt, out server_key, out server_salt);
-        if (client_key == null || client_salt == null || server_key == null || server_salt == null) {
-            warning("SRTP client/server key/salt null");
-        }
-
-        debug("Finished DTLS connection. We're %s", mode.to_string());
-        if (mode == Mode.SERVER) {
-            srtp_session.set_encryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key.extract(), server_salt.extract());
-            srtp_session.set_decryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key.extract(), client_salt.extract());
-        } else {
-            srtp_session.set_encryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key.extract(), client_salt.extract());
-            srtp_session.set_decryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key.extract(), server_salt.extract());
-        }
-        return new Xmpp.Xep.Jingle.ContentEncryption(Xmpp.Xep.JingleIceUdp.DTLS_NS_URI, "DTLS-SRTP", credentials.own_fingerprint, peer_fingerprint);
-    }
-
-    private static ssize_t pull_function(void* transport_ptr, uint8[] buffer) {
-        Handler self = transport_ptr as Handler;
-
-        self.buffer_mutex.lock();
-        while (self.buffer_queue.size == 0) {
-            self.buffer_cond.wait(self.buffer_mutex);
-            if (self.stop) {
-                self.buffer_mutex.unlock();
-                debug("DTLS handshake pull_function stopped");
-                return -1;
-            }
-        }
-        Bytes data = self.buffer_queue.remove_at(0);
-        self.buffer_mutex.unlock();
-
-        uint8[] data_uint8 = Bytes.unref_to_data((owned) data);
-        Memory.copy(buffer, data_uint8, data_uint8.length);
-
-        // The callback should return 0 on connection termination, a positive number indicating the number of bytes received, and -1 on error.
-        return (ssize_t)data_uint8.length;
-    }
-
-    private static int pull_timeout_function(void* transport_ptr, uint ms) {
-        Handler self = transport_ptr as Handler;
-
-        int64 end_time = get_monotonic_time() + ms * 1000;
-
-        self.buffer_mutex.lock();
-        while (self.buffer_queue.size == 0) {
-            self.buffer_cond.wait_until(self.buffer_mutex, end_time);
-            if (self.stop) {
-                self.buffer_mutex.unlock();
-                debug("DTLS handshake pull_timeout_function stopped");
-                return -1;
-            }
-
-            if (get_monotonic_time() > end_time) {
-                self.buffer_mutex.unlock();
-                return 0;
-            }
-        }
-        self.buffer_mutex.unlock();
-
-        // The callback should return 0 on timeout, a positive number if data can be received, and -1 on error.
-        return 1;
-    }
-
-    private static ssize_t push_function(void* transport_ptr, uint8[] buffer) {
-        Handler self = transport_ptr as Handler;
-        self.send_data(buffer);
-
-        // The callback should return a positive number indicating the bytes sent, and -1 on error.
-        return (ssize_t)buffer.length;
-    }
-
-    private static int verify_function(Session session) {
-        Handler self = session.get_transport_pointer() as Handler;
-        try {
-            bool valid = self.verify_peer_cert(session);
-            if (!valid) {
-                warning("DTLS certificate invalid. Aborting handshake.");
-                return 1;
-            }
-        } catch (Error e) {
-            warning("Error during DTLS certificate validation: %s. Aborting handshake.", e.message);
-            return 1;
-        }
-
-        // The callback function should return 0 for the handshake to continue or non-zero to terminate.
-        return 0;
-    }
-
-    private bool verify_peer_cert(Session session) throws GLib.Error {
-        unowned Datum[] cert_datums = session.get_peer_certificates();
-        if (cert_datums.length == 0) {
-            warning("No peer certs");
-            return false;
-        }
-        if (cert_datums.length > 1) warning("More than one peer cert");
-
-        X509.Certificate peer_cert = X509.Certificate.create();
-        peer_cert.import(ref cert_datums[0], CertificateFormat.DER);
-
-        DigestAlgorithm algo;
-        switch (peer_fp_algo) {
-            case "sha-256":
-                algo = DigestAlgorithm.SHA256;
-                break;
-            default:
-                warning("Unkown peer fingerprint algorithm: %s", peer_fp_algo);
-                return false;
-        }
-
-        uint8[] real_peer_fp = get_fingerprint(peer_cert, algo);
-
-        if (real_peer_fp.length != this.peer_fingerprint.length) {
-            warning("Fingerprint lengths not equal %i vs %i", real_peer_fp.length, peer_fingerprint.length);
-            return false;
-        }
-
-        for (int i = 0; i < real_peer_fp.length; i++) {
-            if (real_peer_fp[i] != this.peer_fingerprint[i]) {
-                warning("First cert in peer cert list doesn't equal advertised one: %s vs %s", format_fingerprint(real_peer_fp), format_fingerprint(peer_fingerprint));
-                return false;
-            }
-        }
-
-        return true;
-    }
-}
-
-}
\ No newline at end of file
diff --git a/plugins/ice/src/dtls_srtp_openssl.vala b/plugins/ice/src/dtls_srtp_openssl.vala
deleted file mode 100644
index 86f080e5..00000000
--- a/plugins/ice/src/dtls_srtp_openssl.vala
+++ /dev/null
@@ -1,202 +0,0 @@
-using OpenSSL;
-
-namespace Dino.Plugins.Ice.DtlsSrtp {
-
-public class CredentialsCapsuleOpenSSL : CredentialsCapsule {
-    public X509.Certificate own_cert;
-    public EVP.Key private_key;
-}
-
-internal CredentialsCapsule generate_credentials () throws GLib.Error {
-    EVP.Key key = new EVP.Key.generate_ecdsa ("prime256v1");
-
-    var start_time = new DateTime.now_local().add_days(-1);
-    var end_time = start_time.add_days (2);
-
-    X509.Certificate cert = new X509.Certificate ();
-    cert.set_public_key (key);
-    cert.set_version (1);
-    cert.not_before.set ((time_t) start_time.to_unix ());
-    cert.not_after.set ((time_t) end_time.to_unix ());
-    cert.serial_number.set (1);
-
-    cert.sign (key, EVP.sha256 ());
-
-    CredentialsCapsuleOpenSSL credentials = new CredentialsCapsuleOpenSSL ();
-    credentials.own_fingerprint = cert.digest (EVP.sha256 ());
-    credentials.own_cert = (owned) cert;
-    credentials.private_key = (owned) key;
-    return credentials;
-}
-
-public class Handler : AbstractHandler {
-
-    public Handler.with_cert (CredentialsCapsule creds) {
-        base.with_cert (creds);
-    }
-
-    protected override Xmpp.Xep.Jingle.ContentEncryption? setup_dtls_connection_thread () {
-        debug("Setting up DTLS connection using OpenSSL. We're %s", mode.to_string());
-        SSL.Context context = new SSL.Context (mode == Mode.SERVER ? SSL.Method.DTLS_SERVER : SSL.Method.DTLS_CLIENT);
-        context.set_tlsext_use_srtp ("SRTP_AES128_CM_SHA1_80");
-        context.use_certificate (((CredentialsCapsuleOpenSSL) credentials).own_cert);
-        context.use_private_key (((CredentialsCapsuleOpenSSL) credentials).private_key);
-        SSL session = new SSL (context);
-        BIO<Handler> bio = new BIO<Handler>(get_handler_based_bio_method());
-        bio.data = this;
-        session.rbio = bio;
-        session.wbio = bio;
-
-        DateTime maximum_time = new DateTime.now_utc().add_seconds(20);
-        int err = 0;
-        if (mode == Mode.SERVER) {
-            session.set_accept_state ();
-        } else {
-            session.set_connect_state ();
-        }
-        do {
-            try {
-                SSL.Error ret = session.do_handshake();
-                switch (ret) {
-                    case SSL.Error.NONE:
-                        err = 1;
-                        break;
-                    case SSL.Error.WANT_READ:
-                        debug ("DTLS wants to read, but nothing in queue, wait for buffer");
-                        buffer_mutex.lock();
-                        if (buffer_queue.size == 0) {
-                            buffer_cond.wait_until(buffer_mutex, get_monotonic_time() + maximum_time.difference(new DateTime.now_utc()));
-                        }
-                        buffer_mutex.unlock();
-                        err = -1;
-                        break;
-                    default:
-                        warning ("DTLS Error: %s", @"$ret");
-                        err = 4;
-                        break;
-                }
-            } catch (Error e) {
-                warning ("DTLS Error: %s", e.message);
-                err = e.code;
-            }
-
-            DateTime current_time = new DateTime.now_utc();
-            if (maximum_time.compare(current_time) < 0) {
-                debug ("DTLS handshake timeouted");
-                err = 2;
-                break;
-            }
-            if (stop) {
-                debug ("DTLS handshake stopped");
-                err = 3;
-                break;
-            }
-        } while (err < 0);
-
-        buffer_mutex.lock();
-        if (stop) {
-            stop = false;
-            running = false;
-            bool restart = restart;
-            buffer_mutex.unlock();
-            if (restart) {
-                debug ("Restarting DTLS handshake");
-                return setup_dtls_connection_thread();
-            }
-            return null;
-        }
-        buffer_mutex.unlock();
-        if (err != 1) {
-            debug ("DTLS handshake failed");
-            return null;
-        }
-
-        // TODO: Check peer certificate
-
-        uint8[] km = new uint8[60];
-        session.export_keying_material (km, "EXTRACTOR-dtls_srtp");
-        uint8[] client_key = km[0:16];
-        uint8[] server_key = km[16:32];
-        uint8[] client_salt = km[32:46];
-        uint8[] server_salt = km[46:60];
-
-        debug ("Finished DTLS connection. We're %s", mode.to_string());
-        if (mode == Mode.SERVER) {
-            srtp_session.set_encryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key, server_salt);
-            srtp_session.set_decryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key, client_salt);
-        } else {
-            srtp_session.set_encryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key, client_salt);
-            srtp_session.set_decryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key, server_salt);
-        }
-        return new Xmpp.Xep.Jingle.ContentEncryption (Xmpp.Xep.JingleIceUdp.DTLS_NS_URI, "DTLS-SRTP", credentials.own_fingerprint, peer_fingerprint);
-    }
-
-    private int read_impl (BIO<Handler> bio, uint8[] out_buf) {
-        Bytes data = get_buffer_if_present ();
-        if (data == null) {
-            if (!stop) {
-                debug ("No pending buffer in queue, but end not reached yet, set_retry_read");
-                bio.set_retry_read ();
-            }
-            return -1;
-        }
-        if (data.length > out_buf.length) {
-            warning ("Buffer in queue does not fit in out_buf");
-            return -1;
-        }
-        debug ("Read %d bytes from queue", data.length);
-
-        uint8[] data_uint8 = Bytes.unref_to_data((owned) data);
-        Memory.copy (out_buf, data_uint8, data_uint8.length);
-        bio.clear_retry_flags ();
-        return data_uint8.length;
-    }
-
-    private int write_impl (BIO<Handler> bio, uint8[] buf) {
-        debug ("Write %d bytes to network", buf.length);
-        send_data (buf);
-        return buf.length;
-    }
-
-    private long ctrl_impl (BIO<Handler> bio, BIO.ControlCommand cmd, long num, void* ptr) {
-        switch (cmd) {
-            case BIO.ControlCommand.FLUSH:
-                // Datagrams are sent out immediately
-                return 1;
-            case BIO.ControlCommand.DGRAM_SET_NEXT_TIMEOUT:
-                // Datagrams are sent out immediately
-                return 1;
-            case BIO.ControlCommand.DGRAM_GET_MTU_OVERHEAD:
-                // Just some safe estimate
-                return 70;
-            case BIO.ControlCommand.DGRAM_QUERY_MTU:
-                // Just some safe estimate
-                return 1200;
-            case BIO.ControlCommand.WPENDING:
-                // Datagrams are sent out immediately
-                return 0;
-            case BIO.ControlCommand.POP:
-            case BIO.ControlCommand.PUSH:
-                // Ignored
-                return 0;
-            default:
-                warning (@"Unimplemented ctrl cmd:$cmd, num:$num");
-                return 0;
-        }
-    }
-
-    private static BIO.Method<Handler> _handler_based_bio_method_instance = null;
-
-    private static unowned BIO.Method<Handler> get_handler_based_bio_method () {
-        if (_handler_based_bio_method_instance != null) return _handler_based_bio_method_instance;
-        _handler_based_bio_method_instance = new BIO.Method<Handler> (BIO.Type.SOURCE_SINK | BIO.Type.DGRAM, "Dino DTLS Handler BIO");
-        _handler_based_bio_method_instance.read = (bio, out_buf) => bio.data.read_impl (bio, out_buf);
-        _handler_based_bio_method_instance.write = (bio, buf) => bio.data.write_impl (bio, buf);
-        _handler_based_bio_method_instance.ctrl = (bio, cmd, num, ptr) => bio.data.ctrl_impl (bio, cmd, num, ptr);
-        return _handler_based_bio_method_instance;
-    }
-}
-
-
-
-}
\ No newline at end of file
diff --git a/plugins/ice/src/module.vala b/plugins/ice/src/module.vala
index ace62108..c3c92124 100644
--- a/plugins/ice/src/module.vala
+++ b/plugins/ice/src/module.vala
@@ -1,4 +1,6 @@
 using Gee;
+
+using Dino.Crypto;
 using Xmpp;
 using Xmpp.Xep;
 
@@ -43,7 +45,7 @@ public class Dino.Plugins.Ice.Module : JingleIceUdp.Module {
         string from_to_id = local_full_jid.to_string() + peer_full_jid.to_string();
         try {
             if (!cerds.has_key(from_to_id)) cerds[from_to_id] = DtlsSrtp.generate_credentials();
-        } catch (Error e) {
+        } catch (GLib.Error e) {
             warning("Error creating dtls credentials: %s", e.message);
         }
         return cerds[from_to_id];
diff --git a/plugins/ice/src/openssl_utils.c b/plugins/ice/src/openssl_utils.c
deleted file mode 100644
index 7f4bf331..00000000
--- a/plugins/ice/src/openssl_utils.c
+++ /dev/null
@@ -1,49 +0,0 @@
-#include "openssl_utils.h"
-#include <openssl/opensslv.h>
-#include <openssl/ec.h>
-
-#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L
-// This is for OpenSSL 3.0.0 and newer
-
-EVP_PKEY *EVP_PKEY_new_generate_ecdsa (const char* curve) {
-    // Generate EVP_PKEY directly
-    EVP_PKEY *pkey = EVP_EC_gen (curve);
-    return pkey;
-}
-
-#else
-// This is for OpenSSL before 3.0.0 and forks of earlier OpenSSL versions like LibreSSL
-
-EVP_PKEY *EVP_PKEY_new_generate_ecdsa (const char* curve) {
-    // Get NID from curve name
-    int nid = OBJ_sn2nid (curve);
-    if (nid == NID_undef) return NULL;
-
-    // Create EC_KEY
-    EC_KEY *ec_key = EC_KEY_new_by_curve_name (nid);
-    if (!ec_key) return NULL;
-
-    // Generate key
-    if (!EC_KEY_generate_key (ec_key)) {
-        EC_KEY_free (ec_key);
-        return NULL;
-    }
-
-    // Create EVP_PKEY
-    EVP_PKEY *pkey = EVP_PKEY_new ();
-    if (!pkey) {
-        EC_KEY_free (ec_key);
-        return NULL;
-    }
-
-    // Assign EC_KEY to EVP_PKEY
-    if (!EVP_PKEY_assign_EC_KEY (pkey, ec_key)) {
-        EC_KEY_free (ec_key);
-        return NULL;
-    }
-
-    // EVP_PKEY_assign_EC_KEY takes ownership of ec_key, no need to free it explicitly
-    return pkey;
-}
-
-#endif
diff --git a/plugins/ice/src/openssl_utils.h b/plugins/ice/src/openssl_utils.h
deleted file mode 100644
index bcc6f53a..00000000
--- a/plugins/ice/src/openssl_utils.h
+++ /dev/null
@@ -1,8 +0,0 @@
-#ifndef DINO_OPENSSL_UTILS_H
-#define DINO_OPENSSL_UTILS_H
-
-#include <openssl/evp.h>
-
-EVP_PKEY *EVP_PKEY_new_generate_ecdsa (const char* curve);
-
-#endif //DINO_OPENSSL_UTILS_H
\ No newline at end of file
diff --git a/plugins/ice/src/transport_parameters.vala b/plugins/ice/src/transport_parameters.vala
index 66dde8b1..122207c5 100644
--- a/plugins/ice/src/transport_parameters.vala
+++ b/plugins/ice/src/transport_parameters.vala
@@ -1,4 +1,6 @@
 using Gee;
+
+using Dino.Crypto;
 using Xmpp;
 using Xmpp.Xep;