hertog/godot-module-template
Template
2
1
Fork 1
Code Issues 2 Pull requests 2 Projects Releases Packages Wiki Activity Actions

feat: updated engine version to 4.4-rc1

Browse source
This commit is contained in:
Sara 2025-02-23 14:38:14 +01:00
parent ee00efde1f
commit 21ba8e33af
5459 changed files with 1128836 additions and 198305 deletions
Download patch file Download diff file Expand all files Collapse all files

17
engine/modules/mbedtls/SCsub
View file

@ -1,4 +1,5 @@
#!/usr/bin/env python
from misc.utility.scons_hints import *
Import("env")
Import("env_modules")
@ -65,6 +66,22 @@ if env["builtin_mbedtls"]:
"platform.c",
"platform_util.c",
"poly1305.c",
"psa_crypto.c",
"psa_crypto_aead.c",
"psa_crypto_cipher.c",
"psa_crypto_client.c",
"psa_crypto_driver_wrappers_no_static.c",
"psa_crypto_ecp.c",
"psa_crypto_ffdh.c",
"psa_crypto_hash.c",
"psa_crypto_mac.c",
"psa_crypto_pake.c",
"psa_crypto_rsa.c",
"psa_crypto_se.c",
"psa_crypto_slot_management.c",
"psa_crypto_storage.c",
"psa_its_file.c",
"psa_util.c",
"ripemd160.c",
"rsa.c",
"rsa_alt_helpers.c",

39
engine/modules/mbedtls/crypto_mbedtls.cpp
View file

@ -30,17 +30,11 @@
#include "crypto_mbedtls.h"
#include "core/config/engine.h"
#include "core/config/project_settings.h"
#include "core/io/certs_compressed.gen.h"
#include "core/io/compression.h"
#include "core/io/file_access.h"
#include "core/os/os.h"
#ifdef TOOLS_ENABLED
#include "editor/editor_settings.h"
#endif
#include <mbedtls/debug.h>
#include <mbedtls/md.h>
#include <mbedtls/pem.h>
@ -49,8 +43,8 @@
#define PEM_END_CRT "-----END CERTIFICATE-----\n"
#define PEM_MIN_SIZE 54
CryptoKey *CryptoKeyMbedTLS::create() {
return memnew(CryptoKeyMbedTLS);
CryptoKey *CryptoKeyMbedTLS::create(bool p_notify_postinitialize) {
return static_cast<CryptoKey *>(ClassDB::creator<CryptoKeyMbedTLS>(p_notify_postinitialize));
}
Error CryptoKeyMbedTLS::load(const String &p_path, bool p_public_only) {
@ -105,10 +99,11 @@ Error CryptoKeyMbedTLS::save(const String &p_path, bool p_public_only) {
Error CryptoKeyMbedTLS::load_from_string(const String &p_string_key, bool p_public_only) {
int ret = 0;
const CharString string_key_utf8 = p_string_key.utf8();
if (p_public_only) {
ret = mbedtls_pk_parse_public_key(&pkey, (unsigned char *)p_string_key.utf8().get_data(), p_string_key.utf8().size());
ret = mbedtls_pk_parse_public_key(&pkey, (const unsigned char *)string_key_utf8.get_data(), string_key_utf8.size());
} else {
ret = _parse_key((unsigned char *)p_string_key.utf8().get_data(), p_string_key.utf8().size());
ret = _parse_key((const unsigned char *)string_key_utf8.get_data(), string_key_utf8.size());
}
ERR_FAIL_COND_V_MSG(ret, FAILED, "Error parsing key '" + itos(ret) + "'.");
@ -153,8 +148,8 @@ int CryptoKeyMbedTLS::_parse_key(const uint8_t *p_buf, int p_size) {
#endif
}
X509Certificate *X509CertificateMbedTLS::create() {
return memnew(X509CertificateMbedTLS);
X509Certificate *X509CertificateMbedTLS::create(bool p_notify_postinitialize) {
return static_cast<X509Certificate *>(ClassDB::creator<X509CertificateMbedTLS>(p_notify_postinitialize));
}
Error X509CertificateMbedTLS::load(const String &p_path) {
@ -250,8 +245,8 @@ bool HMACContextMbedTLS::is_md_type_allowed(mbedtls_md_type_t p_md_type) {
}
}
HMACContext *HMACContextMbedTLS::create() {
return memnew(HMACContextMbedTLS);
HMACContext *HMACContextMbedTLS::create(bool p_notify_postinitialize) {
return static_cast<HMACContext *>(ClassDB::creator<HMACContextMbedTLS>(p_notify_postinitialize));
}
Error HMACContextMbedTLS::start(HashingContext::HashType p_hash_type, const PackedByteArray &p_key) {
@ -309,15 +304,11 @@ HMACContextMbedTLS::~HMACContextMbedTLS() {
}
}
Crypto *CryptoMbedTLS::create() {
return memnew(CryptoMbedTLS);
Crypto *CryptoMbedTLS::create(bool p_notify_postinitialize) {
return static_cast<Crypto *>(ClassDB::creator<CryptoMbedTLS>(p_notify_postinitialize));
}
void CryptoMbedTLS::initialize_crypto() {
#ifdef DEBUG_ENABLED
mbedtls_debug_set_threshold(1);
#endif
Crypto::_create = create;
Crypto::_load_default_certificates = load_default_certificates;
X509CertificateMbedTLS::make_default();
@ -484,7 +475,7 @@ Vector<uint8_t> CryptoMbedTLS::sign(HashingContext::HashType p_hash_type, const
ERR_FAIL_COND_V_MSG(type == MBEDTLS_MD_NONE, Vector<uint8_t>(), "Invalid hash type.");
ERR_FAIL_COND_V_MSG(p_hash.size() != size, Vector<uint8_t>(), "Invalid hash provided. Size must be " + itos(size));
Ref<CryptoKeyMbedTLS> key = static_cast<Ref<CryptoKeyMbedTLS>>(p_key);
ERR_FAIL_COND_V_MSG(!key.is_valid(), Vector<uint8_t>(), "Invalid key provided.");
ERR_FAIL_COND_V_MSG(key.is_null(), Vector<uint8_t>(), "Invalid key provided.");
ERR_FAIL_COND_V_MSG(key->is_public_only(), Vector<uint8_t>(), "Invalid key provided. Cannot sign with public_only keys.");
size_t sig_size = 0;
#if MBEDTLS_VERSION_MAJOR >= 3
@ -510,13 +501,13 @@ bool CryptoMbedTLS::verify(HashingContext::HashType p_hash_type, const Vector<ui
ERR_FAIL_COND_V_MSG(type == MBEDTLS_MD_NONE, false, "Invalid hash type.");
ERR_FAIL_COND_V_MSG(p_hash.size() != size, false, "Invalid hash provided. Size must be " + itos(size));
Ref<CryptoKeyMbedTLS> key = static_cast<Ref<CryptoKeyMbedTLS>>(p_key);
ERR_FAIL_COND_V_MSG(!key.is_valid(), false, "Invalid key provided.");
ERR_FAIL_COND_V_MSG(key.is_null(), false, "Invalid key provided.");
return mbedtls_pk_verify(&(key->pkey), type, p_hash.ptr(), size, p_signature.ptr(), p_signature.size()) == 0;
}
Vector<uint8_t> CryptoMbedTLS::encrypt(Ref<CryptoKey> p_key, const Vector<uint8_t> &p_plaintext) {
Ref<CryptoKeyMbedTLS> key = static_cast<Ref<CryptoKeyMbedTLS>>(p_key);
ERR_FAIL_COND_V_MSG(!key.is_valid(), Vector<uint8_t>(), "Invalid key provided.");
ERR_FAIL_COND_V_MSG(key.is_null(), Vector<uint8_t>(), "Invalid key provided.");
uint8_t buf[1024];
size_t size;
Vector<uint8_t> out;
@ -529,7 +520,7 @@ Vector<uint8_t> CryptoMbedTLS::encrypt(Ref<CryptoKey> p_key, const Vector<uint8_
Vector<uint8_t> CryptoMbedTLS::decrypt(Ref<CryptoKey> p_key, const Vector<uint8_t> &p_ciphertext) {
Ref<CryptoKeyMbedTLS> key = static_cast<Ref<CryptoKeyMbedTLS>>(p_key);
ERR_FAIL_COND_V_MSG(!key.is_valid(), Vector<uint8_t>(), "Invalid key provided.");
ERR_FAIL_COND_V_MSG(key.is_null(), Vector<uint8_t>(), "Invalid key provided.");
ERR_FAIL_COND_V_MSG(key->is_public_only(), Vector<uint8_t>(), "Invalid key provided. Cannot decrypt using a public_only key.");
uint8_t buf[2048];
size_t size;

11
engine/modules/mbedtls/crypto_mbedtls.h
View file

@ -32,7 +32,6 @@
#define CRYPTO_MBEDTLS_H
#include "core/crypto/crypto.h"
#include "core/io/resource.h"
#include <mbedtls/ctr_drbg.h>
#include <mbedtls/entropy.h>
@ -49,7 +48,7 @@ private:
int _parse_key(const uint8_t *p_buf, int p_size);
public:
static CryptoKey *create();
static CryptoKey *create(bool p_notify_postinitialize = true);
static void make_default() { CryptoKey::_create = create; }
static void finalize() { CryptoKey::_create = nullptr; }
@ -57,7 +56,7 @@ public:
virtual Error save(const String &p_path, bool p_public_only);
virtual String save_to_string(bool p_public_only);
virtual Error load_from_string(const String &p_string_key, bool p_public_only);
virtual bool is_public_only() const { return public_only; };
virtual bool is_public_only() const { return public_only; }
CryptoKeyMbedTLS() {
mbedtls_pk_init(&pkey);
@ -80,7 +79,7 @@ private:
int locks;
public:
static X509Certificate *create();
static X509Certificate *create(bool p_notify_postinitialize = true);
static void make_default() { X509Certificate::_create = create; }
static void finalize() { X509Certificate::_create = nullptr; }
@ -112,7 +111,7 @@ private:
void *ctx = nullptr;
public:
static HMACContext *create();
static HMACContext *create(bool p_notify_postinitialize = true);
static void make_default() { HMACContext::_create = create; }
static void finalize() { HMACContext::_create = nullptr; }
@ -133,7 +132,7 @@ private:
static X509CertificateMbedTLS *default_certs;
public:
static Crypto *create();
static Crypto *create(bool p_notify_postinitialize = true);
static void initialize_crypto();
static void finalize_crypto();
static X509CertificateMbedTLS *get_default_certificates();

6
engine/modules/mbedtls/dtls_server_mbedtls.cpp
View file

@ -47,15 +47,15 @@ Ref<PacketPeerDTLS> DTLSServerMbedTLS::take_connection(Ref<PacketPeerUDP> p_udp_
Ref<PacketPeerMbedDTLS> out;
ERR_FAIL_COND_V(tls_options.is_null(), out);
ERR_FAIL_COND_V(!p_udp_peer.is_valid(), out);
ERR_FAIL_COND_V(p_udp_peer.is_null(), out);
out.instantiate();
out->accept_peer(p_udp_peer, tls_options, cookies);
return out;
}
DTLSServer *DTLSServerMbedTLS::_create_func() {
return memnew(DTLSServerMbedTLS);
DTLSServer *DTLSServerMbedTLS::_create_func(bool p_notify_postinitialize) {
return static_cast<DTLSServer *>(ClassDB::creator<DTLSServerMbedTLS>(p_notify_postinitialize));
}
void DTLSServerMbedTLS::initialize() {

2
engine/modules/mbedtls/dtls_server_mbedtls.h
View file

@ -37,7 +37,7 @@
class DTLSServerMbedTLS : public DTLSServer {
private:
static DTLSServer *_create_func();
static DTLSServer *_create_func(bool p_notify_postinitialize);
Ref<TLSOptions> tls_options;
Ref<CookieContextMbedTLS> cookies;

13
engine/modules/mbedtls/packet_peer_mbed_dtls.cpp
View file

@ -30,9 +30,6 @@
#include "packet_peer_mbed_dtls.h"
#include "core/io/file_access.h"
#include "core/io/stream_peer_tls.h"
int PacketPeerMbedDTLS::bio_send(void *ctx, const unsigned char *buf, size_t len) {
if (buf == nullptr || len == 0) {
return 0;
@ -114,7 +111,7 @@ Error PacketPeerMbedDTLS::_do_handshake() {
}
Error PacketPeerMbedDTLS::connect_to_peer(Ref<PacketPeerUDP> p_base, const String &p_hostname, Ref<TLSOptions> p_options) {
ERR_FAIL_COND_V(!p_base.is_valid() || !p_base->is_socket_connected(), ERR_INVALID_PARAMETER);
ERR_FAIL_COND_V(p_base.is_null() || !p_base->is_socket_connected(), ERR_INVALID_PARAMETER);
Error err = tls_ctx->init_client(MBEDTLS_SSL_TRANSPORT_DATAGRAM, p_hostname, p_options.is_valid() ? p_options : TLSOptions::client());
ERR_FAIL_COND_V(err != OK, err);
@ -135,7 +132,7 @@ Error PacketPeerMbedDTLS::connect_to_peer(Ref<PacketPeerUDP> p_base, const Strin
}
Error PacketPeerMbedDTLS::accept_peer(Ref<PacketPeerUDP> p_base, Ref<TLSOptions> p_options, Ref<CookieContextMbedTLS> p_cookies) {
ERR_FAIL_COND_V(!p_base.is_valid() || !p_base->is_socket_connected(), ERR_INVALID_PARAMETER);
ERR_FAIL_COND_V(p_base.is_null() || !p_base->is_socket_connected(), ERR_INVALID_PARAMETER);
Error err = tls_ctx->init_server(MBEDTLS_SSL_TRANSPORT_DATAGRAM, p_options, p_cookies);
ERR_FAIL_COND_V(err != OK, err);
@ -216,7 +213,7 @@ void PacketPeerMbedDTLS::poll() {
return;
}
ERR_FAIL_COND(!base.is_valid());
ERR_FAIL_COND(base.is_null());
int ret = mbedtls_ssl_read(tls_ctx->get_context(), nullptr, 0);
@ -270,8 +267,8 @@ PacketPeerMbedDTLS::Status PacketPeerMbedDTLS::get_status() const {
return status;
}
PacketPeerDTLS *PacketPeerMbedDTLS::_create_func() {
return memnew(PacketPeerMbedDTLS);
PacketPeerDTLS *PacketPeerMbedDTLS::_create_func(bool p_notify_postinitialize) {
return static_cast<PacketPeerDTLS *>(ClassDB::creator<PacketPeerMbedDTLS>(p_notify_postinitialize));
}
void PacketPeerMbedDTLS::initialize_dtls() {

2
engine/modules/mbedtls/packet_peer_mbed_dtls.h
View file

@ -50,7 +50,7 @@ private:
Ref<PacketPeerUDP> base;
static PacketPeerDTLS *_create_func();
static PacketPeerDTLS *_create_func(bool p_notify_postinitialize);
static int bio_recv(void *ctx, unsigned char *buf, size_t len);
static int bio_send(void *ctx, const unsigned char *buf, size_t len);

31
engine/modules/mbedtls/register_types.cpp
View file

@ -35,15 +35,38 @@
#include "packet_peer_mbed_dtls.h"
#include "stream_peer_mbedtls.h"
#include "core/config/project_settings.h"
#if MBEDTLS_VERSION_MAJOR >= 3
#include <psa/crypto.h>
#endif
#ifdef TESTS_ENABLED
#include "tests/test_crypto_mbedtls.h"
#endif
static bool godot_mbedtls_initialized = false;
void initialize_mbedtls_module(ModuleInitializationLevel p_level) {
if (p_level != MODULE_INITIALIZATION_LEVEL_SCENE) {
return;
}
GLOBAL_DEF("network/tls/enable_tls_v1.3", false);
#if MBEDTLS_VERSION_MAJOR >= 3
int status = psa_crypto_init();
ERR_FAIL_COND_MSG(status != PSA_SUCCESS, "Failed to initialize psa crypto. The mbedTLS modules will not work.");
#endif
#ifdef DEBUG_ENABLED
if (OS::get_singleton()->is_stdout_verbose()) {
mbedtls_debug_set_threshold(1);
}
#endif
godot_mbedtls_initialized = true;
CryptoMbedTLS::initialize_crypto();
StreamPeerMbedTLS::initialize_tls();
PacketPeerMbedDTLS::initialize_dtls();
@ -55,6 +78,14 @@ void uninitialize_mbedtls_module(ModuleInitializationLevel p_level) {
return;
}
if (!godot_mbedtls_initialized) {
return;
}
#if MBEDTLS_VERSION_MAJOR >= 3
mbedtls_psa_crypto_free();
#endif
DTLSServerMbedTLS::finalize();
PacketPeerMbedDTLS::finalize_dtls();
StreamPeerMbedTLS::finalize_tls();

69
engine/modules/mbedtls/stream_peer_mbedtls.cpp
View file

@ -30,7 +30,6 @@
#include "stream_peer_mbedtls.h"
#include "core/io/file_access.h"
#include "core/io/stream_peer_tcp.h"
int StreamPeerMbedTLS::bio_send(void *ctx, const unsigned char *buf, size_t len) {
@ -166,21 +165,24 @@ Error StreamPeerMbedTLS::put_partial_data(const uint8_t *p_data, int p_bytes, in
return OK;
}
int ret = mbedtls_ssl_write(tls_ctx->get_context(), p_data, p_bytes);
if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
// Non blocking IO
ret = 0;
} else if (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
// Clean close
disconnect_from_stream();
return ERR_FILE_EOF;
} else if (ret <= 0) {
TLSContextMbedTLS::print_mbedtls_error(ret);
disconnect_from_stream();
return ERR_CONNECTION_ERROR;
}
do {
int ret = mbedtls_ssl_write(tls_ctx->get_context(), &p_data[r_sent], p_bytes - r_sent);
if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
// Non blocking IO.
break;
} else if (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
// Clean close
disconnect_from_stream();
return ERR_FILE_EOF;
} else if (ret <= 0) {
TLSContextMbedTLS::print_mbedtls_error(ret);
disconnect_from_stream();
return ERR_CONNECTION_ERROR;
}
r_sent += ret;
} while (r_sent < p_bytes);
r_sent = ret;
return OK;
}
@ -209,26 +211,31 @@ Error StreamPeerMbedTLS::get_partial_data(uint8_t *p_buffer, int p_bytes, int &r
r_received = 0;
int ret = mbedtls_ssl_read(tls_ctx->get_context(), p_buffer, p_bytes);
if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
ret = 0; // non blocking io
} else if (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
// Clean close
disconnect_from_stream();
return ERR_FILE_EOF;
} else if (ret <= 0) {
TLSContextMbedTLS::print_mbedtls_error(ret);
disconnect_from_stream();
return ERR_CONNECTION_ERROR;
}
do {
int ret = mbedtls_ssl_read(tls_ctx->get_context(), &p_buffer[r_received], p_bytes - r_received);
if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
// Non blocking IO.
break;
} else if (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
// Clean close
disconnect_from_stream();
return ERR_FILE_EOF;
} else if (ret <= 0) {
TLSContextMbedTLS::print_mbedtls_error(ret);
disconnect_from_stream();
return ERR_CONNECTION_ERROR;
}
r_received += ret;
} while (r_received < p_bytes);
r_received = ret;
return OK;
}
void StreamPeerMbedTLS::poll() {
ERR_FAIL_COND(status != STATUS_CONNECTED && status != STATUS_HANDSHAKING);
ERR_FAIL_COND(!base.is_valid());
ERR_FAIL_COND(base.is_null());
if (status == STATUS_HANDSHAKING) {
_do_handshake();
@ -295,8 +302,8 @@ Ref<StreamPeer> StreamPeerMbedTLS::get_stream() const {
return base;
}
StreamPeerTLS *StreamPeerMbedTLS::_create_func() {
return memnew(StreamPeerMbedTLS);
StreamPeerTLS *StreamPeerMbedTLS::_create_func(bool p_notify_postinitialize) {
return static_cast<StreamPeerTLS *>(ClassDB::creator<StreamPeerMbedTLS>(p_notify_postinitialize));
}
void StreamPeerMbedTLS::initialize_tls() {

2
engine/modules/mbedtls/stream_peer_mbedtls.h
View file

@ -42,7 +42,7 @@ private:
Ref<StreamPeer> base;
static StreamPeerTLS *_create_func();
static StreamPeerTLS *_create_func(bool p_notify_postinitialize);
static int bio_recv(void *ctx, unsigned char *buf, size_t len);
static int bio_send(void *ctx, const unsigned char *buf, size_t len);

17
engine/modules/mbedtls/tls_context_mbedtls.cpp
View file

@ -30,6 +30,8 @@
#include "tls_context_mbedtls.h"
#include "core/config/project_settings.h"
static void my_debug(void *ctx, int level,
const char *file, int line,
const char *str) {
@ -144,6 +146,13 @@ Error TLSContextMbedTLS::init_server(int p_transport, Ref<TLSOptions> p_options,
cookies = p_cookies;
mbedtls_ssl_conf_dtls_cookies(&conf, mbedtls_ssl_cookie_write, mbedtls_ssl_cookie_check, &(cookies->cookie_ctx));
}
#if MBEDTLS_VERSION_MAJOR >= 3
if (Engine::get_singleton()->is_editor_hint() || !(bool)GLOBAL_GET("network/tls/enable_tls_v1.3")) {
mbedtls_ssl_conf_max_tls_version(&conf, MBEDTLS_SSL_VERSION_TLS1_2);
}
#endif
mbedtls_ssl_setup(&tls, &conf);
return OK;
}
@ -153,7 +162,7 @@ Error TLSContextMbedTLS::init_client(int p_transport, const String &p_hostname,
int authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
bool unsafe = p_options->is_unsafe_client();
if (unsafe && p_options->get_trusted_ca_chain().is_valid()) {
if (unsafe && p_options->get_trusted_ca_chain().is_null()) {
authmode = MBEDTLS_SSL_VERIFY_NONE;
}
@ -187,6 +196,12 @@ Error TLSContextMbedTLS::init_client(int p_transport, const String &p_hostname,
}
}
#if MBEDTLS_VERSION_MAJOR >= 3
if (Engine::get_singleton()->is_editor_hint() || !(bool)GLOBAL_GET("network/tls/enable_tls_v1.3")) {
mbedtls_ssl_conf_max_tls_version(&conf, MBEDTLS_SSL_VERSION_TLS1_2);
}
#endif
// Set valid CAs
mbedtls_ssl_conf_ca_chain(&conf, &(cas->cert), nullptr);
mbedtls_ssl_setup(&tls, &conf);

1
engine/modules/mbedtls/tls_context_mbedtls.h
View file

@ -33,7 +33,6 @@
#include "crypto_mbedtls.h"
#include "core/io/file_access.h"
#include "core/object/ref_counted.h"
#include <mbedtls/ctr_drbg.h>