3 files changed, 87 insertions, 0 deletions
diff --git a/modules/enet/doc_classes/NetworkedMultiplayerENet.xml b/modules/enet/doc_classes/NetworkedMultiplayerENet.xml
index 76b3710e96..456bf649d2 100644
--- a/modules/enet/doc_classes/NetworkedMultiplayerENet.xml
+++ b/modules/enet/doc_classes/NetworkedMultiplayerENet.xml
@@ -104,6 +104,24 @@
 				The IP used when creating a server. This is set to the wildcard [code]"*"[/code] by default, which binds to all available interfaces. The given IP needs to be in IPv4 or IPv6 address format, for example: [code]"192.168.1.1"[/code].
 			</description>
 		</method>
+		<method name="set_dtls_certificate">
+			<return type="void">
+			</return>
+			<argument index="0" name="certificate" type="X509Certificate">
+			</argument>
+			<description>
+				Configure the [X509Certificate] to use when [member use_dtls] is [code]true[/code]. For servers, you must also setup the [CryptoKey] via [method set_dtls_key].
+			</description>
+		</method>
+		<method name="set_dtls_key">
+			<return type="void">
+			</return>
+			<argument index="0" name="key" type="CryptoKey">
+			</argument>
+			<description>
+				Configure the [CryptoKey] to use when [member use_dtls] is [code]true[/code]. Remember to also call [method set_dtls_certificate] to setup your [X509Certificate].
+			</description>
+		</method>
 	</methods>
 	<members>
 		<member name="always_ordered" type="bool" setter="set_always_ordered" getter="is_always_ordered" default="false">
@@ -115,6 +133,9 @@
 		<member name="compression_mode" type="int" setter="set_compression_mode" getter="get_compression_mode" enum="NetworkedMultiplayerENet.CompressionMode" default="0">
 			The compression method used for network packets. These have different tradeoffs of compression speed versus bandwidth, you may need to test which one works best for your use case if you use compression at all.
 		</member>
+		<member name="dtls_verify" type="bool" setter="set_dtls_verify_enabled" getter="is_dtls_verify_enabled" default="true">
+			Enable or disable certiticate verification when [member use_dtls] [code]true[/code].
+		</member>
 		<member name="refuse_new_connections" type="bool" setter="set_refuse_new_connections" getter="is_refusing_new_connections" override="true" default="false" />
 		<member name="server_relay" type="bool" setter="set_server_relay_enabled" getter="is_server_relay_enabled" default="true">
 			Enable or disable the server feature that notifies clients of other peers' connection/disconnection, and relays messages between them. When this option is [code]false[/code], clients won't be automatically notified of other peers and won't be able to send them packets through the server.
@@ -123,6 +144,10 @@
 			Set the default channel to be used to transfer data. By default, this value is [code]-1[/code] which means that ENet will only use 2 channels, one for reliable and one for unreliable packets. Channel [code]0[/code] is reserved, and cannot be used. Setting this member to any value between [code]0[/code] and [member channel_count] (excluded) will force ENet to use that channel for sending data.
 		</member>
 		<member name="transfer_mode" type="int" setter="set_transfer_mode" getter="get_transfer_mode" override="true" enum="NetworkedMultiplayerPeer.TransferMode" default="2" />
+		<member name="use_dtls" type="bool" setter="set_dtls_enabled" getter="is_dtls_enabled" default="false">
+			When enabled, the client or server created by this peer, will use [PacketPeerDTLS] instead of raw UDP sockets for communicating with the remote peer. This will make the communication encrypted with DTLS at the cost of higher resource usage and potentially larger packet size.
+			Note: When creating a DTLS server, make sure you setup the key/certificate pair via [method set_dtls_key] and [method set_dtls_certificate]. For DTLS clients, have a look at the [member dtls_verify] option, and configure the certificate accordingly via [method set_dtls_certificate].
+		</member>
 	</members>
 	<constants>
 		<constant name="COMPRESS_NONE" value="0" enum="CompressionMode">
diff --git a/modules/enet/networked_multiplayer_enet.cpp b/modules/enet/networked_multiplayer_enet.cpp
index ca134824f7..406eb467f0 100644
--- a/modules/enet/networked_multiplayer_enet.cpp
+++ b/modules/enet/networked_multiplayer_enet.cpp
@@ -78,6 +78,7 @@ Error NetworkedMultiplayerENet::create_server(int p_port, int p_max_clients, int
 	ERR_FAIL_COND_V_MSG(p_max_clients < 1 || p_max_clients > 4095, ERR_INVALID_PARAMETER, "The number of clients must be set between 1 and 4095 (inclusive).");
 	ERR_FAIL_COND_V_MSG(p_in_bandwidth < 0, ERR_INVALID_PARAMETER, "The incoming bandwidth limit must be greater than or equal to 0 (0 disables the limit).");
 	ERR_FAIL_COND_V_MSG(p_out_bandwidth < 0, ERR_INVALID_PARAMETER, "The outgoing bandwidth limit must be greater than or equal to 0 (0 disables the limit).");
+	ERR_FAIL_COND_V(dtls_enabled && (dtls_key.is_null() || dtls_cert.is_null()), ERR_INVALID_PARAMETER);
 
 	ENetAddress address;
 	memset(&address, 0, sizeof(address));
@@ -105,6 +106,11 @@ Error NetworkedMultiplayerENet::create_server(int p_port, int p_max_clients, int
 			p_out_bandwidth /* limit outgoing bandwidth if > 0 */);
 
 	ERR_FAIL_COND_V_MSG(!host, ERR_CANT_CREATE, "Couldn't create an ENet multiplayer server.");
+#ifdef GODOT_ENET
+	if (dtls_enabled) {
+		enet_host_dtls_server_setup(host, dtls_key.ptr(), dtls_cert.ptr());
+	}
+#endif
 
 	_setup_compressor();
 	active = true;
@@ -156,6 +162,11 @@ Error NetworkedMultiplayerENet::create_client(const String &p_address, int p_por
 	}
 
 	ERR_FAIL_COND_V_MSG(!host, ERR_CANT_CREATE, "Couldn't create the ENet client host.");
+#ifdef GODOT_ENET
+	if (dtls_enabled) {
+		enet_host_dtls_client_setup(host, dtls_cert.ptr(), dtls_verify, p_address.utf8().get_data());
+	}
+#endif
 
 	_setup_compressor();
 
@@ -856,6 +867,12 @@ void NetworkedMultiplayerENet::_bind_methods() {
 	ClassDB::bind_method(D_METHOD("set_compression_mode", "mode"), &NetworkedMultiplayerENet::set_compression_mode);
 	ClassDB::bind_method(D_METHOD("get_compression_mode"), &NetworkedMultiplayerENet::get_compression_mode);
 	ClassDB::bind_method(D_METHOD("set_bind_ip", "ip"), &NetworkedMultiplayerENet::set_bind_ip);
+	ClassDB::bind_method(D_METHOD("set_dtls_enabled", "enabled"), &NetworkedMultiplayerENet::set_dtls_enabled);
+	ClassDB::bind_method(D_METHOD("is_dtls_enabled"), &NetworkedMultiplayerENet::is_dtls_enabled);
+	ClassDB::bind_method(D_METHOD("set_dtls_key", "key"), &NetworkedMultiplayerENet::set_dtls_key);
+	ClassDB::bind_method(D_METHOD("set_dtls_certificate", "certificate"), &NetworkedMultiplayerENet::set_dtls_certificate);
+	ClassDB::bind_method(D_METHOD("set_dtls_verify_enabled", "enabled"), &NetworkedMultiplayerENet::set_dtls_verify_enabled);
+	ClassDB::bind_method(D_METHOD("is_dtls_verify_enabled"), &NetworkedMultiplayerENet::is_dtls_verify_enabled);
 	ClassDB::bind_method(D_METHOD("get_peer_address", "id"), &NetworkedMultiplayerENet::get_peer_address);
 	ClassDB::bind_method(D_METHOD("get_peer_port", "id"), &NetworkedMultiplayerENet::get_peer_port);
 
@@ -875,6 +892,8 @@ void NetworkedMultiplayerENet::_bind_methods() {
 	ADD_PROPERTY(PropertyInfo(Variant::INT, "channel_count"), "set_channel_count", "get_channel_count");
 	ADD_PROPERTY(PropertyInfo(Variant::BOOL, "always_ordered"), "set_always_ordered", "is_always_ordered");
 	ADD_PROPERTY(PropertyInfo(Variant::BOOL, "server_relay"), "set_server_relay_enabled", "is_server_relay_enabled");
+	ADD_PROPERTY(PropertyInfo(Variant::BOOL, "dtls_verify"), "set_dtls_verify_enabled", "is_dtls_verify_enabled");
+	ADD_PROPERTY(PropertyInfo(Variant::BOOL, "use_dtls"), "set_dtls_enabled", "is_dtls_enabled");
 
 	BIND_ENUM_CONSTANT(COMPRESS_NONE);
 	BIND_ENUM_CONSTANT(COMPRESS_RANGE_CODER);
@@ -904,6 +923,9 @@ NetworkedMultiplayerENet::NetworkedMultiplayerENet() {
 	enet_compressor.destroy = enet_compressor_destroy;
 
 	bind_ip = IP_Address("*");
+
+	dtls_enabled = false;
+	dtls_verify = true;
 }
 
 NetworkedMultiplayerENet::~NetworkedMultiplayerENet() {
@@ -920,3 +942,31 @@ void NetworkedMultiplayerENet::set_bind_ip(const IP_Address &p_ip) {
 
 	bind_ip = p_ip;
 }
+
+void NetworkedMultiplayerENet::set_dtls_enabled(bool p_enabled) {
+	ERR_FAIL_COND(active);
+	dtls_enabled = p_enabled;
+}
+
+bool NetworkedMultiplayerENet::is_dtls_enabled() const {
+	return dtls_enabled;
+}
+
+void NetworkedMultiplayerENet::set_dtls_verify_enabled(bool p_enabled) {
+	ERR_FAIL_COND(active);
+	dtls_verify = p_enabled;
+}
+
+bool NetworkedMultiplayerENet::is_dtls_verify_enabled() const {
+	return dtls_verify;
+}
+
+void NetworkedMultiplayerENet::set_dtls_key(Ref<CryptoKey> p_key) {
+	ERR_FAIL_COND(active);
+	dtls_key = p_key;
+}
+
+void NetworkedMultiplayerENet::set_dtls_certificate(Ref<X509Certificate> p_cert) {
+	ERR_FAIL_COND(active);
+	dtls_cert = p_cert;
+}
diff --git a/modules/enet/networked_multiplayer_enet.h b/modules/enet/networked_multiplayer_enet.h
index 11487b99a5..ff436ce2c0 100644
--- a/modules/enet/networked_multiplayer_enet.h
+++ b/modules/enet/networked_multiplayer_enet.h
@@ -31,6 +31,7 @@
 #ifndef NETWORKED_MULTIPLAYER_ENET_H
 #define NETWORKED_MULTIPLAYER_ENET_H
 
+#include "core/crypto/crypto.h"
 #include "core/io/compression.h"
 #include "core/io/networked_multiplayer_peer.h"
 
@@ -111,6 +112,11 @@ private:
 
 	IP_Address bind_ip;
 
+	bool dtls_enabled;
+	Ref<CryptoKey> dtls_key;
+	Ref<X509Certificate> dtls_cert;
+	bool dtls_verify;
+
 protected:
 	static void _bind_methods();
 
@@ -166,6 +172,12 @@ public:
 	~NetworkedMultiplayerENet();
 
 	void set_bind_ip(const IP_Address &p_ip);
+	void set_dtls_enabled(bool p_enabled);
+	bool is_dtls_enabled() const;
+	void set_dtls_verify_enabled(bool p_enabled);
+	bool is_dtls_verify_enabled() const;
+	void set_dtls_key(Ref<CryptoKey> p_key);
+	void set_dtls_certificate(Ref<X509Certificate> p_cert);
 };
 
 VARIANT_ENUM_CAST(NetworkedMultiplayerENet::CompressionMode);